Security Frameworks CAS-005 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a key difference between the NIST CSF and the CSA framework?

   • AThe NIST CSF provides certification, while the CSA framework does not
   • BThe NIST CSF is voluntary, while the CSA framework is mandatory
   • CThe NIST CSF is cloud-specific, while the CSA framework is general
   • DThe NIST CSF focuses on general cybersecurity risk, while the CSA framework focuses on cloud-specific risks
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a key change in the NIST CSF 2.0 compared to the original version?

   • AIt added a sixth core function called 'Govern'
   • BIt removed the implementation tiers
   • CIt made the framework mandatory for federal agencies
   • DIt eliminated the profiles component
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization is developing a plan to restore systems and data after a ransomware attack. Which NIST Cybersecurity Framework core function does this activity primarily support?

   • ADetect
   • BRespond
   • CProtect
   • DRecover
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of the NIST Cybersecurity Framework (CSF) 2.0?

   • ATo provide a mandatory set of security controls for all organizations
   • BTo certify organizations that meet its requirements
   • CTo help organizations understand and manage cybersecurity risks
   • DTo replace all other security frameworks and standards
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is using the NIST Cybersecurity Framework to manage its cybersecurity risk. The company has created a current-state profile and a target-state profile. The gap analysis reveals that the company is falling short in several areas, but the budget is limited. What is the best next step for the company?

   • ARevise the target-state profile to be less ambitious
   • BImplement all identified gaps immediately to achieve full alignment
   • CAbandon the NIST CSF and use a different framework
   • DPrioritize the gaps based on risk and business impact, and address the most critical ones first
   Reveal Solution Discussion Select an answer first