Understand the Strategies and Techniques to Minimize the Impact of an Incident. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which method is commonly used to coordinate response efforts among incident response team members?

   • ADedicated incident response chat channel
   • BPublic social media posts
   • CPhysical bulletin board
   • DPersonal email accounts
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A data breach has occurred, and the incident response team is coordinating with legal, PR, and IT. The legal team advises that the breach must be reported to regulators within 72 hours. The PR team wants to issue a public statement immediately. The IT team is still investigating the scope of the breach. Which communication approach best minimizes impact?

   • AHave the IT team communicate directly with regulators to provide technical details.
   • BCoordinate with legal to ensure regulatory reporting is accurate, while PR prepares a statement that does not disclose unverified details.
   • CWait for the IT investigation to be complete before communicating with anyone.
   • DAllow PR to issue a statement immediately, even if the scope is not fully known.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization has just completed the recovery phase of a significant incident. The incident response team is now in the post-incident phase. Which action is most effective for reducing the impact of future incidents?

   • ADelete all temporary files created during the incident to free up storage.
   • BSend a thank-you note to all team members for their hard work.
   • CArchive all incident-related logs and close the incident ticket.
   • DUpdate the incident response plan based on lessons learned and conduct a tabletop exercise to test the changes.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst discovers that a compromised user account is being used to access sensitive data. The account belongs to a senior executive, and disabling it would disrupt their work. The analyst needs to contain the incident while minimizing disruption. Which action is most appropriate?

   • AMonitor the account's activity to gather more evidence before taking action.
   • BTemporarily restrict the account's access to sensitive resources while investigating the compromise.
   • CChange the account's password and inform the executive to use the new password.
   • DDisable the account immediately to stop the unauthorized access.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of establishing a communication plan during an incident?

   • AEnsure all stakeholders receive timely and accurate information
   • BPrevent the incident from being reported to authorities
   • CReplace the need for technical incident response
   • DDocument the incident for legal purposes only
   Reveal Solution Discussion Select an answer first