CND Incident Response & Disaster Recovery 5

Question 1

Under the NIST Cybersecurity Framework, which function covers activities to restore services impaired by a cybersecurity incident?

Accepted Answer

Recover

Answer

The 'Recover' function encompasses activities to restore capabilities or services that were impaired during an incident, including communications and improvement plans.

Question 2

What is 'data exfiltration' in the context of a security incident?

Accepted Answer

Unauthorized copying or transfer of data from an organization to an external destination

Answer

Data exfiltration refers to the unauthorized transfer of data from within an organization to an outside location controlled by an attacker.

Question 3

Which document provides pre-approved procedures for responding to common incident types, reducing decision fatigue during an active incident?

Accepted Answer

Playbook (runbook)

Answer

Playbooks are pre-defined, step-by-step response procedures for specific incident scenarios that allow responders to act quickly and consistently without improvising under pressure.

Question 4

In forensic investigations, what is 'write blocking' and why is it used?

Accepted Answer

Using a hardware or software device to prevent any changes to the original evidence media

Answer

A write blocker prevents any write operations to the original storage media during imaging, ensuring that the evidence remains unaltered and legally admissible.

Question 5

Which business continuity concept identifies which business processes are most critical and must be restored first after a disaster?

Accepted Answer

Business Impact Analysis (BIA)

Answer

A Business Impact Analysis (BIA) identifies critical business functions, quantifies the impact of disruptions, and prioritizes recovery order based on operational and financial consequences.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Incident Response & Disaster Recovery 5