Discover How to Develop and Apply Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a benefit of using Organizational Profiles for internal communication?

   • AIt eliminates the need for any other security documentation
   • BIt guarantees that all security risks are eliminated
   • CIt helps align cybersecurity efforts with business objectives
   • DIt automatically generates compliance reports
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes what an Organizational Profile communicates?

   • AThe specific security products and tools the organization has purchased
   • BThe organization's compliance with every applicable law and regulation
   • CThe organization's cybersecurity outcomes and priorities in the context of its mission and risk appetite
   • DThe names and contact information of all cybersecurity personnel
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A multinational corporation is preparing for an external audit. The auditor requests documentation of the company's cybersecurity risk posture. The CISO wants to provide a clear, standardized view that the auditor can understand. What is the best way to use the CSF Organizational Profile for this purpose?

   • AProvide only the target profile to show the company's commitment to future improvements.
   • BProvide the auditor with the raw data used to create the profiles, including all interview notes.
   • CShare the current and target profiles, along with the gap analysis, to demonstrate the company's posture and improvement plan.
   • DCreate a custom report that uses the company's internal terminology instead of CSF language.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A government agency has developed current and target profiles. The gap analysis shows that the 'Recover' function has gaps in communication and testing. The agency's risk assessment indicates that a prolonged outage would have a severe impact on public services. The agency has a limited budget and must choose between improving communication or testing. What should the agency do?

   • APrioritize the gap that is most likely to reduce the impact of a prolonged outage, based on a detailed risk analysis.
   • BSplit the budget evenly between communication and testing to avoid making a difficult choice.
   • CPrioritize communication because it ensures stakeholders are informed during an outage, which is essential for public trust.
   • DPrioritize testing because it directly validates the ability to recover, which is critical for reducing outage impact.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How should an organization prioritize actions to address gaps identified in a gap analysis?

   • ABased on the organization's mission, business needs, and risk appetite
   • BBased on the order the gaps appear in the CSF document
   • CBased on the preferences of the IT department
   • DBased solely on the cost of implementing each action
   Reveal Solution Discussion Select an answer first