Define Clear Roles and Responsibilities for Cybersecurity Personnel. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A software development company has an informal practice where the senior developer reviews all code for security issues. The developer is leaving the company, and the CEO wants to ensure this practice is not lost. What is the most important action to take before the developer leaves?

   • AHire a new senior developer with the same skills and hope they continue the practice.
   • BAsk the senior developer to train another developer informally before they leave.
   • CDocument the code review responsibility in the security policy and assign it to a specific role.
   • DStop doing code reviews until a new process is defined.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A utility company's security charter assigns the 'OT Network Manager' the responsibility for all security patching on the operational technology (OT) network. The company is merging with another utility that has a different patching schedule and a different role called 'OT Systems Lead' who currently performs patching. The merger will result in the OT Network Manager role being eliminated. What is the most important action to take during the merger to maintain clear roles?

   • AImmediately reassign all patching duties to the OT Systems Lead and update the charter.
   • BConduct a review of both companies' patching processes and roles, then update the charter to define a single, clear owner for patching in the merged entity.
   • CLeave the charter unchanged until the merger is legally finalized.
   • DKeep both roles and have them share patching duties until the merger is complete.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an effective way to communicate roles and responsibilities to stakeholders?

   • AVerbally informing each employee individually without any written record
   • BPosting the information on a public website
   • CIncluding them in the employee handbook and conducting training sessions
   • DSending a one-time email to the executive team only
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following best illustrates the assignment of a cybersecurity task with appropriate authority?

   • AThe compliance officer is responsible for ensuring regulatory compliance but has no access to the systems that need to be monitored
   • BThe network administrator is given the task of managing firewall rules and is authorized to implement changes according to the change management policy
   • CThe incident response team is told to handle any security incident, but they must wait for executive approval before taking any action
   • DThe security analyst is assigned to monitor alerts but is not allowed to escalate any findings to management
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital's cybersecurity policy assigns the 'Clinical Informatics Manager' the authority to grant access to the electronic health record (EHR) system. The manager is often unavailable, and clinicians are waiting days for access. The CIO wants to speed up the process without sacrificing accountability. Which change best achieves this?

   • AAutomate the approval process with no human review.
   • BAllow any clinician to self-approve their own access to the EHR.
   • CDelegate the approval authority to the shift leads in the clinical informatics team, with the manager retaining oversight.
   • DKeep the manager as the sole approver but require them to respond within 24 hours.
   Reveal Solution Discussion Select an answer first