Define Clear Roles and Responsibilities for Cybersecurity Personnel. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   According to the NIST Cybersecurity Framework, what should role definitions for cybersecurity personnel be based on?

   • AThe personal preferences of the chief information security officer
   • BThe number of cybersecurity incidents reported in the past year
   • CThe organizational needs and the functions that must be performed to manage cybersecurity risk
   • DThe existing job titles in the human resources system
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why should an organization periodically review and update its cybersecurity roles and responsibilities?

   • ATo give employees the opportunity to request different assignments
   • BTo reduce the frequency of security awareness training
   • CTo ensure that roles remain aligned with changes in the organization and the threat landscape
   • DTo comply with a legal requirement that mandates annual role reviews
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A regional hospital has a small IT team where the network administrator also handles firewall rule changes, and the help desk manager approves access requests. After a ransomware incident, the board asks who was accountable for approving the firewall change that allowed the initial compromise. The hospital's cybersecurity policy does not name any specific role for firewall changes. What should the hospital do first to address the board's question?

   • ACreate a new cybersecurity committee to review all future firewall changes and report directly to the board.
   • BAssign firewall change approval to the network administrator and document it in the next policy revision.
   • CAsk the network administrator to explain the change and then hold them personally accountable for the incident.
   • DReview the existing policy and, if it is silent, formally document the firewall approval role and its accountable owner before the next change.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which scenario best demonstrates the need to update cybersecurity roles and responsibilities?

   • AThe organization's office moves to a new building
   • BThe organization adopts a new cloud-based customer relationship management system
   • CThe organization's marketing team launches a new advertising campaign
   • DThe organization hires a new chief financial officer
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary goal of communicating roles and responsibilities to all relevant stakeholders?

   • ATo identify which employees should be promoted to higher positions
   • BTo create a record of who was informed in case of a legal dispute
   • CTo ensure that everyone understands their own duties and how they fit into the overall cybersecurity effort
   • DTo satisfy the requirements of external cybersecurity certifications
   Reveal Solution Discussion Select an answer first