Apply the NIST CSF Tiers in Practical Scenarios. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   Which NIST CSF tier is characterized by risk management practices that are formally established, consistently applied, and based on organizational risk priorities?

   • ATier 3: Repeatable
   • BTier 4: Adaptive
   • CTier 2: Risk Informed
   • DTier 1: Partial
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   How can an organization progress from Tier 1 (Partial) to Tier 2 (Risk Informed) in the NIST CSF?

   • ABy increasing its cybersecurity budget to match industry benchmarks
   • BBy hiring more cybersecurity staff regardless of process
   • CBy formalizing its risk management practices and ensuring they are informed by organizational risk assessments
   • DBy implementing the most advanced security technologies available
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing company has a risk management program that is documented and approved by management, but it is only applied in the IT department. Other departments do not follow the same practices. The company wants to improve. What is the most appropriate next step?

   • AInvest in real-time threat intelligence to enable adaptive responses
   • BExpand the risk management program to all departments to achieve organization-wide consistency
   • CIncrease the security budget to purchase more tools
   • DConduct a one-time risk assessment to identify gaps
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A university has been at Tier 2 for several years. They have a risk management process but it is not consistently applied across all departments. The new CISO wants to progress to Tier 3 but faces resistance from department heads who see cybersecurity as an IT-only issue. What is the most effective approach to overcome this resistance?

   • AIncrease the security budget to hire more IT staff to handle all cybersecurity issues centrally
   • BDemonstrate how cybersecurity risks affect each department's specific objectives and involve department heads in risk management decisions
   • CWait for a major security incident to demonstrate the need for change
   • DMandate compliance through a top-down policy without seeking input from departments
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   Which NIST CSF tier is characterized by an organization that has not yet formalized its cybersecurity risk management practices and manages risk in an ad hoc and reactive manner?

   • ATier 4: Adaptive
   • BTier 1: Partial
   • CTier 2: Risk Informed
   • DTier 3: Repeatable
   Reveal Solution Discussion Select an answer first