Understand the Strategies and Techniques to Minimize the Impact of an Incident. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A malware infection is spreading across a network segment that hosts both production servers and development workstations. The incident response team needs to contain the spread while maintaining business-critical operations. Which containment strategy best balances these needs?

   • ADisconnect only the infected workstations and leave the rest of the segment fully operational.
   • BApply a new firewall rule to block all outbound traffic from the segment, but allow inbound traffic.
   • CIsolate the affected segment by blocking traffic at the network firewall, but allow access to critical production servers through a controlled path.
   • DShut down the entire network segment to ensure complete isolation.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An organization is experiencing a distributed denial-of-service (DDoS) attack that is overwhelming its public-facing web servers. The incident response team needs to minimize the impact on customers while mitigating the attack. Which strategy is most effective?

   • AIgnore the attack and wait for it to stop on its own.
   • BEnable rate limiting and traffic filtering at the edge to drop malicious traffic while allowing legitimate users through.
   • CIncrease the bandwidth of the internet connection to absorb the attack traffic.
   • DTake the web servers offline to stop the attack.
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   A malware outbreak is affecting multiple departments in an organization. The incident response team has identified that the malware spreads through a specific network share. The team needs to contain the outbreak while allowing employees to continue working. Which strategy is most effective?

   • AMonitor the share for malicious activity and delete infected files as they appear.
   • BDisable the network share and provide employees with an alternative secure file transfer method.
   • CIsolate all affected departments from the network and have them work offline.
   • DKeep the share enabled but restrict access to read-only for all users.
   Reveal Solution Discussion Select an answer first