Assign Ownership and Responsibility for Each Asset. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which event would most likely trigger a review of asset ownership?

   • AThe asset passes a vulnerability scan with no findings.
   • BThe asset is backed up successfully.
   • CAn employee who owns an asset leaves the organization.
   • DThe asset is accessed by a new user for the first time.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A software development company has assigned product owners for each of its software applications. The security team wants to ensure that the product owners understand their security responsibilities. What is the most effective way to communicate these responsibilities?

   • ASend a one-time email to all product owners outlining their security duties.
   • BRely on the product owners to ask questions if they are unsure about their responsibilities.
   • CDevelop a formal document that defines the roles and responsibilities of asset owners and review it with each product owner.
   • DInclude a section on security responsibilities in the product owner's job description.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A hospital has an asset inventory that includes medical devices, IT systems, and building management systems. The security officer wants to ensure that all assets have current owners. Which action is most effective for maintaining accurate ownership?

   • AAssign a single person in the IT department to be the owner of all assets.
   • BConduct a physical audit of all assets twice a year to verify ownership.
   • CIntegrate the asset inventory with the HR system to automatically flag when an owner leaves the organization.
   • DRequire each department to submit an annual list of asset owners.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which responsibility is typically assigned to an asset owner?

   • AMaking decisions about risk acceptance or mitigation for the asset.
   • BEnsuring the asset is never exposed to the internet.
   • CPerforming all vulnerability scans on the asset.
   • DWriting the organization's incident response plan.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes the primary responsibility of an asset owner under the NIST Cybersecurity Framework?

   • ATo perform daily backups of the asset's data to the organization's storage system.
   • BTo physically secure the asset in a locked facility or controlled environment.
   • CTo ensure the asset is protected in a manner consistent with the organization's risk tolerance and security policies.
   • DTo approve every change request that involves the asset, regardless of risk level.
   Reveal Solution Discussion Select an answer first