Define Clear Roles and Responsibilities for Cybersecurity Personnel. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A government contractor updated its security charter to assign the role of 'Data Owner' to the head of each department. The charter was distributed as a PDF via email to all department heads. Six months later, an audit finds that most department heads cannot name their responsibilities as Data Owner. Which action would most effectively improve the situation?

   • ARemove the Data Owner role from the charter because it is not working.
   • BConduct a training session that explains the Data Owner role and its specific responsibilities, and confirm understanding.
   • CRe-send the same PDF with a reminder to read it carefully.
   • DAssign the Data Owner role to the CISO instead of the department heads.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of defining clear roles and responsibilities for cybersecurity personnel in an organization?

   • ATo reduce the total number of cybersecurity personnel required by the organization
   • BTo establish accountability and ensure that cybersecurity activities are performed by the right people with the right authority
   • CTo satisfy external auditors that the organization has a cybersecurity team
   • DTo ensure that every cybersecurity task is assigned to the most senior available employee
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A defense contractor's security charter is a 200-page document that defines hundreds of roles. An audit reveals that the 'System Administrator' role is defined in three different sections, each with slightly different responsibilities. In one section, the admin is responsible for patching; in another, the same role is responsible for approving patches; in a third, the role is not mentioned. This has led to confusion and missed patches. What is the most effective remediation?

   • ACreate a separate 'Patch Management' charter and leave the main charter as is.
   • BConsolidate all role definitions into a single, authoritative section of the charter, with clear and non-conflicting responsibilities.
   • CAdd a note to each of the three sections explaining that they refer to the same role.
   • DDelete the role from the charter and rely on the IT team's informal understanding.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A university's IT security policy defines the role of 'Security Awareness Coordinator' but does not specify whether this role is responsible for creating training content or only for scheduling training sessions. Two staff members each assumed they were responsible for content creation, and the training was never built. What is the primary weakness in the role definition?

   • AThe role was not assigned to a specific individual.
   • BThe role's responsibilities were not documented with enough detail to be unambiguous.
   • CThe role should have been reviewed and updated before the training was due.
   • DThe role was not communicated to the rest of the university.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of documenting cybersecurity roles and responsibilities?

   • AAn email from the IT manager to the team listing their duties
   • BA presentation slide shown during a security awareness training
   • CA section in the organization's security policy that defines the responsibilities of the incident response team
   • DA verbal agreement between the CISO and the security team about who handles incidents
   Reveal Solution Discussion Select an answer first