2.1 Identify and Explain the Steps of the NIST Incident Response Plan SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the Preparation phase of the NIST incident response lifecycle, which of the following is an example of preparing the incident response team?

   • ARestoring systems from backups after an attack
   • BCollecting forensic evidence from compromised hosts
   • CReviewing the incident timeline with stakeholders
   • DConducting tabletop exercises and simulations
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a data breach, the incident response team has completed the technical response and restored all systems. The team is now writing a report that includes a timeline of events, root cause analysis, and recommendations for improving security controls. According to the NIST incident response lifecycle, which phase does this activity belong to?

   • AContainment, Eradication, and Recovery
   • BDetection and Analysis
   • CPost-Incident Activity
   • DPreparation
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst at a mid-sized company notices repeated failed login attempts from a single external IP against the VPN gateway, followed by a successful login from the same IP at 3:00 AM. The analyst checks the user's account and sees no unusual activity. According to the NIST incident response lifecycle, which action should the analyst take FIRST?

   • ANotify law enforcement and the company's legal department.
   • BProceed directly to eradication by scanning the user's workstation for malware.
   • CCollect additional evidence and correlate with other logs to determine if this is a true positive.
   • DDisable the user's account and reset the password immediately.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is creating an incident response plan. They have defined the incident response policy, established a computer security incident response team (CSIRT), and purchased forensic tools. Which additional activity is essential during the Preparation phase?

   • AWriting a post-incident report
   • BConducting regular training and tabletop exercises
   • CAnalyzing logs to identify potential incidents
   • DIsolating affected systems from the network
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After a phishing incident that compromised several user accounts, the incident response team has completed containment, eradication, and recovery. The team is now meeting to discuss what happened. Which activity is the team performing, and what is its primary purpose?

   • APost-Incident Activity; to capture lessons learned and improve future response.
   • BDetection and Analysis; to identify the root cause of the phishing attack.
   • CContainment; to ensure the phishing emails are blocked from future delivery.
   • DPreparation; to update the incident response plan based on lessons learned.
   Reveal Solution Discussion Select an answer first