Apply the NIST CSF Tiers in Practical Scenarios. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · medium

   A small organization has no formal cybersecurity risk management process. Cybersecurity decisions are made only when an incident occurs, and there is little awareness of cyber risk at the executive level. Which NIST CSF tier best describes this organization?

   • ATier 2: Risk Informed
   • BTier 4: Adaptive
   • CTier 3: Repeatable
   • DTier 1: Partial
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A government agency has a cybersecurity program that is fully integrated into their enterprise risk management. They continuously monitor threats and adapt their security controls in real time. They also share threat information with other agencies and private sector partners. Which NIST CSF tier best describes this agency?

   • ATier 1: Partial
   • BTier 4: Adaptive
   • CTier 3: Repeatable
   • DTier 2: Risk Informed
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is at Tier 3 and wants to progress to Tier 4. They already have consistent risk management practices and share threat information with partners. What is the most critical capability they need to develop?

   • AA more detailed risk assessment methodology
   • BReal-time threat intelligence and the ability to adapt security controls dynamically
   • CBetter documentation of existing processes
   • DIncreased budget for more security staff
   Reveal Solution Discussion Select an answer first
5. 19foundation · medium

   Which of the following is a key consideration when an organization selects a NIST CSF tier?

   • AThe tier should always be set to Tier 4 to ensure maximum security
   • BThe tier should be determined by the cybersecurity vendor's recommendations
   • CThe tier should reflect the organization's current risk management practices, not an aspirational target
   • DThe tier should be chosen based on the industry average to remain competitive
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has been at Tier 3 for three years. They have a consistent risk management program and share threat information with partners. The board is considering a move to Tier 4, but the CISO is concerned about the ongoing costs of maintaining real-time threat intelligence and adaptive response capabilities. What is the best course of action?

   • AProceed with Tier 4 because it is the natural progression and will improve security
   • BRemain at Tier 3 because Tier 4 is never worth the cost
   • CConduct a cost-benefit analysis to determine if the risk reduction justifies the investment in Tier 4 capabilities
   • DMove to Tier 4 but only in the IT department to reduce costs
   Reveal Solution Discussion Select an answer first