2.1 Identify and Explain the Steps of the NIST Incident Response Plan SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a ransomware incident, the incident response team has isolated the affected servers and confirmed the malware's propagation method. According to the NIST incident response lifecycle, what should the team do NEXT?

   • AConduct a lessons-learned meeting to discuss what went wrong.
   • BNotify the public relations team to prepare a press release.
   • CRestore the systems from the latest backups and verify they are clean.
   • DEradicate the malware from all affected systems and remove the propagation vector.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common source of information used to detect potential incidents during the Detection and Analysis phase?

   • AIncident response policy documents
   • BBackup restoration logs
   • CIntrusion detection system (IDS) alerts
   • DPatch management reports
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is establishing an incident response capability. They have defined roles and responsibilities, purchased a SIEM, and conducted tabletop exercises. According to the NIST incident response lifecycle, which phase are they in?

   • APost-Incident Activity
   • BDetection and Analysis
   • CContainment, Eradication, and Recovery
   • DPreparation
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is developing its incident response capability. They have a small security team and limited budget. They need to prioritize their preparation activities. Which activity should be the HIGHEST priority to ensure an effective response?

   • ADefining roles, responsibilities, and escalation procedures
   • BHiring external consultants for incident response
   • CPurchasing an expensive SIEM solution
   • DConducting a full risk assessment of all assets
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has just experienced a significant data breach. During the post-incident review, the team realizes that the incident response plan was outdated and did not include clear escalation procedures. The team wants to improve the plan. According to the NIST incident response lifecycle, what is the most effective way to incorporate these lessons learned?

   • AWait for the next incident to test the updated plan.
   • BConduct a lessons-learned meeting, update the plan, and schedule training and exercises to validate the changes.
   • CUpdate the incident response plan immediately and distribute it to the team.
   • DOnly update the escalation procedures and ignore other gaps.
   Reveal Solution Discussion Select an answer first