CAP Incident Response & Recovery 5

Question 1

Under NIST SP 800-61, what is the recommended first action when an incident is confirmed during the Detection and Analysis phase?

Accepted Answer

Document all findings and prioritize the incident based on impact

Answer

Upon confirming an incident, the handler should document findings and prioritize response efforts based on the incident's functional impact and information impact.

Question 2

What distinguishes a Disaster Recovery Plan (DRP) from a Business Continuity Plan (BCP)?

Accepted Answer

A DRP covers IT systems only; a BCP addresses the full business operation

Answer

A DRP focuses specifically on recovering IT systems and data, while a BCP addresses maintaining all critical business functions during and after a disruption.

Question 3

Which indicator type, according to NIST SP 800-61, is considered the MOST reliable for confirming a security incident?

Accepted Answer

Indicators of Compromise (IoCs)

Answer

Indicators of Compromise (IoCs) are direct evidence that an incident has occurred or is in progress, making them the most reliable confirmation of an actual incident.

Question 4

A system owner wants to minimize data loss in the event of a ransomware attack. Which contingency planning element directly addresses this goal?

Accepted Answer

Backup and restoration strategy aligned with a low RPO

Answer

A backup and restoration strategy designed to meet a low Recovery Point Objective (RPO) directly limits how much data can be lost in the event of an attack.

Question 5

When conducting a post-incident review, which of the following questions is MOST important for improving the authorization process?

Accepted Answer

Were the security controls in the SSP effective, and should the ATO conditions be updated?

Answer

The CAP professional's primary post-incident concern is whether the security controls and authorization basis remain valid and if the ATO needs to be updated to reflect new risks.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Incident Response & Recovery 5