Discover How to Develop and Apply Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A technology startup is developing its first CSF Organizational Profile. The leadership team is unfamiliar with cybersecurity concepts and wants to understand how the profile will help them make better business decisions. Which explanation best describes the value of the profile?

   • AThe profile will guarantee compliance with all relevant regulations.
   • BThe profile will replace the need for a separate risk management process.
   • CThe profile will help the company prioritize cybersecurity investments based on its business goals and risk tolerance.
   • DThe profile will automatically identify and remediate all cybersecurity vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A hospital network is developing its first CSF Organizational Profile. The CISO has limited time and budget. The network's leadership wants a profile that can be used to communicate with both the board and regulators. Which approach best balances thoroughness with efficiency?

   • ADevelop both current and target profiles, using existing documentation and stakeholder interviews to gather data efficiently.
   • BFocus on developing a detailed target profile first, then create the current profile later.
   • CDevelop a single profile that combines current and target states to save time.
   • DHire an external consultant to develop the profiles without involving internal stakeholders.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A logistics company has developed current and target CSF profiles. The gap analysis reveals that the 'Recover' function has significant gaps, while the 'Identify' function is nearly complete. The company has a limited budget and must decide where to allocate resources. Which approach best uses the profiles to support risk-based decision-making?

   • ADelay any investment until the target profile is revised to be less ambitious.
   • BPrioritize the 'Recover' gaps that align with the company's highest-risk business processes and allocate budget accordingly.
   • CAllocate all remaining budget to the 'Identify' function because it is already nearly complete and can be finished quickly.
   • DSplit the budget evenly across all functions to avoid appearing biased toward any single area.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does an Organizational Profile support the risk management process?

   • ABy eliminating the need for a separate risk assessment
   • BBy helping to prioritize cybersecurity outcomes based on risk
   • CBy automatically transferring all risks to an insurance provider
   • DBy providing a list of all potential threats
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A retail company is developing its CSF Organizational Profile for the first time. The company has a complex IT environment with many legacy systems. The CISO wants to ensure the profile accurately reflects the current state. What is the most effective way to gather data for the current profile?

   • ARely on the IT team's knowledge without formal documentation, as they know the environment best.
   • BCombine automated scans with stakeholder interviews and review of existing policies and procedures.
   • CBase the current profile on the target profile, assuming the organization is closer to the target than it actually is.
   • DUse only automated vulnerability scans to collect data, as they are objective and comprehensive.
   Reveal Solution Discussion Select an answer first