Define the Reasons Why an Effective Cybersecurity Stance Is Important. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a potential reputational consequence of inadequate cybersecurity?

   • AIncreased customer loyalty because the organization is transparent about incidents.
   • BImproved brand image due to increased media coverage.
   • CLoss of customer trust and confidence in the organization.
   • DEnhanced reputation as a leader in cybersecurity innovation.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is implementing the NIST CSF. The CISO wants to use the framework to communicate cybersecurity risk to the board of directors. Which approach best leverages the NIST CSF for this purpose?

   • APresent a detailed list of all technical vulnerabilities and exploits that could affect the company.
   • BFocus only on the financial impact of past incidents, avoiding any discussion of future risks.
   • CShare the full NIST CSF document with the board and ask them to read it before the next meeting.
   • DUse the NIST CSF tiers and functions to describe the current and target cybersecurity posture in business terms.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare provider suffers a ransomware attack that encrypts patient records. The provider cannot access records for three days, leading to delayed treatments and a loss of patient trust. Which consequence of inadequate cybersecurity is most directly illustrated?

   • AOperational disruption that compromises patient care and damages the organization's reputation.
   • BNo significant consequence, because the provider can restore from backups.
   • CFinancial loss only, because the provider will have to pay the ransom.
   • DLegal liability only, because the provider failed to protect patient data.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is adopting the NIST CSF. The CISO must decide whether to invest in advanced threat detection tools or in employee security awareness training. The company has a limited budget and a history of phishing incidents. Which decision-making approach best aligns with the NIST CSF?

   • AConduct a risk assessment to determine which investment will most reduce the likelihood and impact of phishing incidents.
   • BInvest in awareness training because phishing is a known problem.
   • CSplit the budget equally between both options to avoid making a difficult choice.
   • DInvest in threat detection tools because they are more advanced and technical.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A mid-sized company has a weak cybersecurity posture. The CEO believes that because the company has never been breached, the risk is low. The CISO wants to convince the CEO to invest in stronger security. Which argument is most compelling and accurate?

   • AThe absence of past breaches proves that the company is not a target and future incidents are unlikely.
   • BA single significant breach could cause financial, reputational, and operational damage that far exceeds the cost of preventive measures.
   • CCybersecurity investments are guaranteed to prevent all breaches, so the company will never face an incident.
   • DThe company should wait until a breach occurs to justify the budget, as that will make the need obvious.
   Reveal Solution Discussion Select an answer first