Discover How to Develop and Apply Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of creating a CSF Organizational Profile?

   • ATo replace the organization's existing risk management framework
   • BTo provide a one-size-fits-all set of security controls for all organizations
   • CTo prioritize and communicate cybersecurity outcomes based on the organization's mission and risk appetite
   • DTo certify that the organization has achieved a specific level of cybersecurity maturity
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary output of comparing the current and target profiles?

   • AA compliance certificate
   • BA list of employees to train
   • CA list of gaps in cybersecurity outcomes
   • DA list of security products to purchase
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In what way do Organizational Profiles inform decision-making?

   • AThey provide a basis for deciding where to invest in cybersecurity improvements
   • BThey automatically select the best security products
   • CThey replace the need for executive judgment
   • DThey guarantee compliance with all regulations
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A manufacturing company has developed current and target profiles. The gap analysis shows that the 'Protect' function has gaps in both access control and data security. The company's risk assessment indicates that a data breach would have a high financial impact, while an access control failure would have a moderate impact. The company has a limited budget. What is the most appropriate prioritization?

   • AAddress both gaps simultaneously, even if it exceeds the budget.
   • BDelay any action until the risk assessment is updated.
   • CPrioritize the access control gaps because they are easier to fix and can be completed quickly.
   • DPrioritize the data security gaps because they align with the higher financial impact risk.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A non-profit organization is applying for a grant that requires demonstrating a commitment to cybersecurity. The grant reviewer is not a cybersecurity expert. What is the best way to use the CSF Organizational Profile in the grant application?

   • ASubmit only the target profile to show the organization's future goals.
   • BProvide a narrative that explains the current profile, target profile, and the prioritized improvements planned.
   • CState that the organization has achieved full implementation of all CSF subcategories.
   • DInclude the full technical details of every subcategory rating to show thoroughness.
   Reveal Solution Discussion Select an answer first