200-201 Question 343
Select 2Your company is in the process of implementing a formal Incident Response (IR) plan based on the NIST SP 800-61 framework. As the cybersecurity analyst, you have been asked to align key organizational stakeholders with the appropriate NIST IR categories. Which of the following stakeholders should be primarily responsible for the 'Containment, Eradication, and Recovery' phase?
- A
IT Operations Team
- B
Legal Counsel
- C
Incident Response Team
- D
Public Relations Team
- E
Human Resources Department
Show answer and explanation
Correct answers: A, C
Explanation
The 'Containment, Eradication, and Recovery' phase of the NIST Incident Response framework requires both technical expertise and coordinated execution. The IT Operations Team implements the necessary technical actions, while the Incident Response Team provides overall leadership and coordination. These stakeholders work together to minimize the impact of the incident and restore normal operations. Other departments, such as Legal, Public Relations, and Human Resources, contribute to different phases of the incident response process but are not directly involved in this specific phase.
- A. Correct.
The IT Operations Team plays a critical role in the 'Containment, Eradication, and Recovery' phase by executing technical measures such as isolating affected systems, removing malicious software, and restoring systems to their operational state.
- B. Incorrect.
While Legal Counsel is crucial in ensuring compliance with regulatory and legal obligations, they are not directly involved in the technical tasks associated with containment, eradication, and recovery.
- C. Correct.
The Incident Response Team is responsible for leading and coordinating the entire response effort, including containment, eradication, and recovery. They work closely with IT Operations to implement technical solutions.
- D. Incorrect.
The Public Relations Team is responsible for managing external communications during a cybersecurity incident, but they are not involved in the containment, eradication, and recovery processes.
- E. Incorrect.
The Human Resources Department primarily manages internal organizational matters, such as employee-related issues, and is not part of the technical or operational response to an incident.