RESPONSE: What are the key steps in an effective response plan?

• Identify the threat, assess the impact, develop a strategy, implement the plan, review and revise

• Identify the threat, plan for impact, develop a strategy, implement the plan, review and revise

• Identify the threat, assess the impact, develop a strategy, implement the plan

• Identify the threat, assess the impact, develop a strategy, plan, review and revise

IDENTITY: The five core functions of the NIST Cybersecurity Framework are:

• Prepare, Prevent, Respond, Mitigate, Restore

• Identify, Protect, Detect, Respond, Recover

• Plan, Execute, Monitor, Control, Close

• Assess, Implement, Evaluate, Report, Improve

The purpose of a risk assessment in the Identify function is to:

• Identify potential risks and vulnerabilities.

• Identify who is responsible

• Recover from security breaches.

• Respond to security incidents.

PROTECT: What are the key security measures in the Protect function of NIST?

• Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, Maintenance, and Protective Technology

• Risk Assessment, Risk Management Strategy, Supply Chain Risk Management

• Protecting from Anomalies and Events, through Continuous Monitoring, Detection Processes

• Response Planning, Communications, Analysis, Mitigation, Improvements

IDENTIFY: Why is asset management critical in the Identify function of NIST?

• Asset management helps in identifying and managing cybersecurity risks to systems, people, assets, data, and capabilities.

• Asset management is critical to the Recovery function of NIST.

• Asset management only deals with allocating financial assets properly

• Asset management is only about maintaining an monitoring the inventory of assets.

The purpose of forensic analysis in the response process is to:

• usually useless to solving the problem

• Identify the cause of a security breach

• improve the ability to repel a similar future attack

• Improve the time it takes to shutdown a network.

The primary goal of the Detect function in the NIST framework is to:

• Identify cybersecurity events in a timely manner

• Protect data from unauthorized access

• Respond to detected cybersecurity events

• Recover from cybersecurity incidents

PROTECT: How does multi-factor authentication (MFA) contribute to the Protect function?

• By requiring biometric scans

• By providing an additional layer of security

• By frustrating the attacker

• By eliminating the need for passwords

Continuous monitoring is important for cybersecurity because:

• it helps in early detection of threats and vulnerabilities.

• it reduces the need for cybersecurity professionals.

• it eliminates all cyber threats.

• it is a regulatory requirement only.

RESPONSE: Why is it important to have a pre-defined communication plan in the Respond function?

• To allow for spontaneous decision-making

• To ensure clear and efficient communication during a response

• To increase the number of communication channels

• To reduce the need for training