Define the Reasons Why an Effective Cybersecurity Stance Is Important. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A retail company suffers a data breach that exposes customer payment information. The company must pay for credit monitoring for affected customers, faces a class-action lawsuit, and sees a drop in repeat purchases. Which consequence of inadequate cybersecurity is NOT directly illustrated in this scenario?

   • AFinancial cost from credit monitoring and legal fees.
   • BLegal liability from the class-action lawsuit.
   • COperational disruption causing a halt in business operations.
   • DReputational damage leading to reduced customer loyalty.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is using the NIST CSF to improve its cybersecurity. The CISO wants to ensure that the company's cybersecurity investments are aligned with its overall business objectives. Which NIST CSF concept is most directly relevant to this goal?

   • AThe Recover function, which focuses on restoring capabilities after an incident.
   • BThe Identify function, which focuses on understanding organizational risks.
   • CThe Govern function, which focuses on establishing cybersecurity risk management strategy and expectations.
   • DThe Protect function, which focuses on implementing safeguards.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is an effective cybersecurity stance important for business continuity?

   • AIt helps the organization continue operating during and after a security incident.
   • BIt ensures that all employees have access to the internet at all times.
   • CIt eliminates the need for backup systems and disaster recovery plans.
   • DIt guarantees that the organization's stock price will remain stable.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is deciding between two cybersecurity strategies: Strategy A focuses on preventing attacks through firewalls and patching. Strategy B focuses on detecting and responding to attacks through monitoring and incident response. The company has a limited budget and must choose one. Which consideration is most important for making this decision?

   • AThe company should evaluate its specific risk profile, including the likelihood and impact of different attack types, to determine which strategy addresses its greatest risks.
   • BStrategy A is always better because prevention is the only effective way to protect assets.
   • CThe company should choose the strategy that is cheaper, regardless of risk, to save money.
   • DStrategy B is always better because no prevention measure can stop a determined attacker.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A manufacturing company wants to ensure that a ransomware attack on its IT network does not halt its production line. The company decides to implement network segmentation, offline backups, and an incident response plan. Which reason for maintaining an effective cybersecurity stance does this decision best support?

   • ATransferring cyber risk to a third-party insurance provider.
   • BEnsuring business continuity by reducing the operational impact of a cyber incident.
   • CProtecting the organization's brand reputation from negative media coverage.
   • DMeeting regulatory compliance requirements for the manufacturing industry.
   Reveal Solution Discussion Select an answer first