A company has experienced a data breach. The incident response team has contained the incident and eradicated the threat. However, the team is unsure whether the attacker had access to the data before containment. What is the most important action to take during the recovery phase?

Implement additional security controls before restoring systems.

Restore all systems from backups as quickly as possible to minimize downtime.

Conduct a thorough forensic analysis to determine the full scope of the breach.

Notify all affected customers immediately, even if the scope is not fully known.

A company has suffered a ransomware attack. The incident response team has contained the incident and eradicated the malware. However, the team is unsure whether the backups are clean because the ransomware may have been present for several weeks. What is the most appropriate next step?

Restore from the most recent backups and hope they are clean.

Skip recovery and rebuild all systems from scratch.

Immediately restore the backups and then monitor for re-infection.

Analyze the backups for indicators of compromise before restoring.

Which of the following activities is a key component of the Preparation phase in the NIST incident response lifecycle?

Isolating affected systems to prevent lateral movement

Establishing an incident response policy and training the response team

Conducting a lessons-learned meeting after an incident

Determining the scope and impact of a confirmed incident

In the Post-Incident Activity phase, what is the purpose of a lessons-learned meeting?

To restore systems to normal operation

To contain the incident and prevent further damage

To detect and analyze the incident

To review what happened and identify improvements for future incident response

A security analyst is investigating an alert about a potential data exfiltration. The analyst has gathered logs from the firewall, the endpoint, and the authentication server. What is the analyst doing in this step?

Analyzing the incident to determine scope and impact

Palo Alto NetworksCertified Security Operations Professional

Domain 2Objective 1

2.1 Identify and Explain the Steps of the NIST Incident Response Plan SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Threat Intelligence and Incident / Case Response domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

28questions here

6free pages

5concepts

16%of the exam

Questions 16–20

16expert · hard
A company has experienced a data breach. The incident response team has contained the incident and eradicated the threat. However, the team is unsure whether the attacker had access to the data before containment. What is the most important action to take during the recovery phase?
Select an answer first
17expert · hard
A company has suffered a ransomware attack. The incident response team has contained the incident and eradicated the malware. However, the team is unsure whether the backups are clean because the ransomware may have been present for several weeks. What is the most appropriate next step?
Select an answer first
18foundation · easy
Which of the following activities is a key component of the Preparation phase in the NIST incident response lifecycle?
Select an answer first
19foundation · easy
In the Post-Incident Activity phase, what is the purpose of a lessons-learned meeting?
Select an answer first
20application · medium
A security analyst is investigating an alert about a potential data exfiltration. The analyst has gathered logs from the firewall, the endpoint, and the authentication server. What is the analyst doing in this step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.