Define Clear Roles and Responsibilities for Cybersecurity Personnel. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A bank's security charter assigns the 'Fraud Analyst' role the task of reviewing and approving all wire transfers over $10,000. The charter is stored in a secure document management system that only the compliance team can access. The fraud analysts have never seen the charter. What is the most likely consequence of this situation?

   • AThe fraud analysts will not know they are responsible for approving large wire transfers.
   • BThe wire transfers will be delayed because the analysts will ask for the charter.
   • CThe wire transfers will be approved by the bank's CEO by default.
   • DThe compliance team will approve the wire transfers instead.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A startup is defining its first cybersecurity roles. The CEO wants a single point of contact for all security matters and a clear chain of command. The company has only five employees, and the CEO is not technical. Which role definition best meets the CEO's needs?

   • AAssign the CEO as the Security Lead since they are ultimately accountable.
   • BCreate a 'Security Lead' role with overall responsibility, and have all security questions routed to this person.
   • COutsource all security roles to a managed security service provider (MSSP) and have no internal lead.
   • DCreate a security committee of all five employees to make decisions by consensus.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturing company's cybersecurity charter states that the plant manager is responsible for approving all OT network changes. The company recently hired a dedicated OT security engineer and created a new security operations center (SOC) that monitors the OT network. The charter has not been updated in two years. Which action best reflects the Review and Update concept?

   • ACreate a separate SOC charter and leave the main cybersecurity charter as is.
   • BUpdate the charter to delegate daily OT change approval to the new OT security engineer while the plant manager retains oversight.
   • CRemove the plant manager from the charter entirely since they are not a security professional.
   • DKeep the charter unchanged because the plant manager still has final authority over the plant.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A healthcare provider has a policy that grants the 'Privacy Officer' the authority to approve all access to patient records. The Privacy Officer is a part-time contractor who works only two days a week. The clinical staff need access to patient records 24/7 for emergency care. The current process causes dangerous delays. The CIO wants to maintain compliance with privacy regulations while ensuring timely access. What is the most balanced solution?

   • AAutomate the approval process so that any access request is granted automatically after 30 minutes.
   • BRequire the Privacy Officer to be on call 24/7 to approve access requests.
   • CGrant the on-call clinical supervisor the authority to approve emergency access, with the Privacy Officer reviewing all such approvals within 48 hours.
   • DGive all clinical staff permanent access to all patient records to avoid delays.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A mid-sized e-commerce company is defining roles for its new security program. The CISO wants to ensure that the person who approves access to the production database is not the same person who administers the database. This is a classic separation-of-duties requirement. Which role definition best satisfies this control?

   • AThe database administrator (DBA) approves access requests, and the security team audits the approvals quarterly.
   • BThe DBA approves and implements access changes, and the CISO reviews the logs monthly.
   • CThe help desk approves access requests, and the DBA implements them, with no further review.
   • DThe security team approves access requests, and the DBA implements the approved changes.
   Reveal Solution Discussion Select an answer first