Security Frameworks CAS-005 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes the structure of the NIST Cybersecurity Framework?

   • AA framework that focuses only on technical controls and ignores organizational and operational aspects
   • BA collection of mandatory controls organized by compliance domains
   • CA single set of prescriptive steps that all organizations must follow in order
   • DA framework composed of three parts: Core, Implementation Tiers, and Profiles
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is migrating its customer relationship management (CRM) system to a public cloud provider. The security team wants to use a framework that specifically addresses cloud security challenges and provides a comprehensive set of controls for cloud environments. Which framework is most appropriate for this purpose?

   • ANIST Cybersecurity Framework
   • BISO/IEC 27001
   • CCOBIT
   • DCloud Security Alliance (CSA) Cloud Controls Matrix (CCM)
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a widely used framework for information security management that provides a systematic approach to managing sensitive information?

   • ACOBIT
   • BISO/IEC 27001
   • CCSA Cloud Controls Matrix
   • DNIST Cybersecurity Framework
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has experienced a ransomware attack that encrypted critical data. After restoring systems from backups, the security team wants to improve its ability to detect similar attacks in the future. According to the NIST Cybersecurity Framework, which core function should the team focus on to achieve this goal?

   • ADetect
   • BProtect
   • CRespond
   • DRecover
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is implementing the NIST Cybersecurity Framework and wants to understand the significance of the implementation tiers. Which of the following best describes the purpose of the implementation tiers?

   • ATo describe the maturity of an organization's cybersecurity risk management practices
   • BTo provide a list of mandatory security controls
   • CTo replace the need for a risk assessment
   • DTo rank organizations against each other
   Reveal Solution Discussion Select an answer first