2.1 Identify and Explain the Steps of the NIST Incident Response Plan SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the Detection and Analysis phase of the NIST incident response lifecycle, what is the primary goal of analyzing a potential incident?

   • ATo determine the scope, impact, and nature of the incident
   • BTo update the incident response policy based on findings
   • CTo restore affected systems to normal operation
   • DTo prevent the incident from spreading to other systems
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is responding to a ransomware incident that has encrypted files on several file servers. The team has isolated the affected servers, but the ransomware is still spreading to other systems. The team needs to stop the spread while preserving evidence for potential legal action. Which approach best balances containment and evidence preservation?

   • ADisconnect the affected servers from the network but keep them powered on to preserve volatile evidence, and use network segmentation to block the ransomware's propagation path.
   • BRun a full antivirus scan on the affected servers to remove the ransomware, then collect evidence from the cleaned systems.
   • CRestore the affected servers from backups immediately to minimize downtime, and then analyze the backups for the ransomware.
   • DImmediately shut down all affected servers to stop the spread, then collect evidence from the powered-off systems.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the Containment, Eradication, and Recovery phase, what is the primary objective of the containment step?

   • ATo limit the damage and prevent the incident from spreading further
   • BTo identify the root cause of the incident
   • CTo restore systems to normal operation
   • DTo document lessons learned from the incident
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company has successfully contained and eradicated a malware outbreak. They are now restoring systems from clean backups and verifying that they are operating normally. According to the NIST incident response lifecycle, which phase are they in?

   • ADetection and Analysis
   • BPreparation
   • CContainment, Eradication, and Recovery
   • DPost-Incident Activity
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC analyst is investigating a potential incident involving a compromised user account. The analyst has confirmed that the account was used to access sensitive data. The analyst must decide whether to contain the incident immediately or continue gathering evidence. Which approach aligns with the NIST incident response lifecycle?

   • AContain the incident immediately to limit damage, then continue analysis.
   • BDisable the account but do not isolate the system.
   • CContinue gathering evidence until the full scope is known, then contain.
   • DWait for management approval before taking any action.
   Reveal Solution Discussion Select an answer first