Describe Risk Assessment. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which statement best describes a risk assessment as defined in the NIST Cybersecurity Framework?

   • AA process of identifying, analyzing, and evaluating risk to organizational operations and assets
   • BA technique for mapping all network traffic to detect intrusions in real time
   • CA one-time activity performed only after a security incident occurs
   • DA method for assigning monetary value to every asset in the organization
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A retail chain has completed a risk assessment and produced a risk register. The chief information security officer (CISO) wants to present the findings to the board of directors to justify the cybersecurity budget. Which output of the risk assessment would be most useful for this presentation?

   • AThe detailed vulnerability scan reports
   • BThe incident response plan
   • CA risk assessment report summarizing prioritized risks and recommendations
   • DThe raw data from the quantitative analysis
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is it important to prioritize risks after evaluating them?

   • ATo focus resources on the risks that pose the greatest potential harm
   • BTo satisfy regulatory requirements only
   • CTo eliminate the need for ongoing risk monitoring
   • DTo ensure all risks are treated equally regardless of their potential impact
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A small e-commerce company is implementing the NIST Cybersecurity Framework. They want to understand their current security posture and decide where to focus limited resources. They have started by cataloging their assets, threats, and vulnerabilities. What is the primary purpose of this activity within the Identify function?

   • ATo prioritize risks and inform resource allocation
   • BTo comply with regulatory requirements
   • CTo eliminate all cybersecurity risks
   • DTo detect security incidents in real time
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional bank is conducting its annual risk assessment. The team has identified that a legacy internet-facing application has a known unpatched vulnerability. They are now determining the potential financial loss if the vulnerability is exploited and the likelihood of exploitation based on current threat intelligence. Which step of the risk assessment process are they performing?

   • ARisk treatment
   • BRisk identification
   • CRisk analysis
   • DRisk evaluation
   Reveal Solution Discussion Select an answer first