Which of the following activities is part of the eradication step in the Containment, Eradication, and Recovery phase?

Isolating the affected network segment

Conducting a post-incident review

Removing malware from affected systems

In the NIST incident response lifecycle, what is the primary purpose of the Post-Incident Activity phase?

To contain the incident and prevent further damage to systems

To establish policies and procedures for handling incidents

To detect and analyze potential security incidents

To identify lessons learned and improve future incident response capabilities

A security operations center (SOC) receives an alert for a potential malware infection on a critical server. The alert is based on a single endpoint detection and response (EDR) signal. The SOC manager must decide whether to escalate the alert to a full incident response. Which factor should be the PRIMARY consideration in this decision?

The availability of additional evidence to corroborate the alert

The time of day the alert was generated

The criticality of the server to business operations

The number of similar alerts received in the past week

Which of the following is a typical output of the Post-Incident Activity phase?

A backup plan for restoring systems

A set of containment strategies to stop the spread

A list of compromised systems and their impact

An updated incident response plan based on lessons learned

After a major incident, the incident response team conducts a lessons-learned meeting. The team identifies that the lack of a formal communication plan caused delays in notifying stakeholders. Which action best addresses this gap in the context of the NIST lifecycle?

Focus only on the technical aspects of the incident and ignore communication gaps.

Document the communication plan in the incident response plan and conduct a tabletop exercise to test it.

Create a communication plan but do not test it until the next incident.

Assign a communication lead but do not document the process.

Palo Alto NetworksCertified Security Operations Professional

Domain 2Objective 1

2.1 Identify and Explain the Steps of the NIST Incident Response Plan SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Part of the Threat Intelligence and Incident / Case Response domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

28questions here

6free pages

5concepts

16%of the exam

Questions 11–15

11foundation · easy
Which of the following activities is part of the eradication step in the Containment, Eradication, and Recovery phase?
Select an answer first
12foundation · easy
In the NIST incident response lifecycle, what is the primary purpose of the Post-Incident Activity phase?
Select an answer first
13expert · hard
A security operations center (SOC) receives an alert for a potential malware infection on a critical server. The alert is based on a single endpoint detection and response (EDR) signal. The SOC manager must decide whether to escalate the alert to a full incident response. Which factor should be the PRIMARY consideration in this decision?
Select an answer first
14foundation · easy
Which of the following is a typical output of the Post-Incident Activity phase?
Select an answer first
15expert · hard
After a major incident, the incident response team conducts a lessons-learned meeting. The team identifies that the lack of a formal communication plan caused delays in notifying stakeholders. Which action best addresses this gap in the context of the NIST lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.