200-201 Question 329
Select 4A cybersecurity operations team is developing their organization's incident response plan in alignment with NIST.SP800-61. Which of the following are key elements that must be included in the plan to ensure proper incident handling and response?
- A
Preparation phase to establish policies, tools, and training
- B
Incident containment strategies to minimize the impact of attacks
- C
Detailed list of all network devices and their configurations
- D
Root cause analysis and lessons learned after an incident
- E
Coordination with law enforcement and external entities when necessary
- F
A log of all employee vacation schedules
Show answer and explanation
Correct answers: A, B, D, E
Explanation
NIST.SP800-61 outlines four key phases of an incident response plan: preparation, detection and analysis, containment/eradication/recovery, and post-incident activities. Preparation ensures readiness, while containment strategies mitigate damage. Post-incident activities like lessons learned enhance future responses. Coordination with external entities is vital for compliance and support. Elements unrelated to incident response, such as vacation schedules or generalized IT inventory, do not align with NIST's guidelines.
- A. Correct.
Preparation is a critical element of NIST.SP800-61's incident response plan, as it ensures the organization is equipped with the necessary resources to handle incidents effectively.
- B. Correct.
Incident containment strategies are essential for limiting the damage caused during an incident and are a core component of the incident response process.
- C. Incorrect.
While maintaining a list of network devices may be useful for IT operations, it is not explicitly part of the incident response plan as defined by NIST.SP800-61.
- D. Correct.
Conducting a root cause analysis and documenting lessons learned is an important step to improve future response efforts and reduce the likelihood of similar incidents.
- E. Correct.
Coordination with external entities, including law enforcement, is a key aspect of managing incidents, especially when dealing with legal or regulatory requirements.
- F. Incorrect.
A log of employee vacation schedules is unrelated to incident response planning and does not contribute to handling or mitigating cybersecurity incidents.