Establish Clear Policies and Procedures to Guide Cybersecurity Activities. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A marketing agency has a policy that requires all client data to be encrypted on laptops. The policy is enforced through a technical control that encrypts all hard drives. However, an audit reveals that some employees are using personal laptops for work, which are not encrypted. The company wants to enforce the policy without hindering productivity. What is the best approach?

   • ABlock access to company resources from personal laptops.
   • BProvide company-issued encrypted laptops to all employees who need to work remotely.
   • CUpdate the policy to allow personal laptops if they are used only for non-client work.
   • DRequire employees to sign an agreement that they will not use personal laptops for work.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A software development company has a policy that requires all code changes to be reviewed by a senior developer before deployment. However, in a recent incident, a junior developer deployed a critical fix without review, causing a service outage. The company wants to prevent this from happening again. What is the most effective approach?

   • AProvide additional training to the junior developer on the importance of following the policy.
   • BUpdate the policy to allow junior developers to deploy critical fixes without review during emergencies.
   • CRevoke the junior developer's deployment permissions and require all deployments to be done by senior developers.
   • DImplement a technical control that prevents deployment without an approved review, and communicate the consequences of bypassing the process.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing company is developing a new policy for the use of personal mobile devices in the workplace. The company wants to allow employees to use their personal devices for work but also needs to protect sensitive production data. What is the most important consideration when developing this policy?

   • AThe policy should be written by the legal department to ensure compliance with all regulations.
   • BThe policy should balance employee privacy, security requirements, and organizational objectives.
   • CThe policy should focus on the technical controls that will be implemented, such as mobile device management.
   • DThe policy should be reviewed and updated annually to keep up with technology changes.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an effective method for communicating cybersecurity policies to employees?

   • AConducting regular training sessions and providing easy access to policy documents
   • BSending a one-time email and never mentioning the policies again
   • CVerbally explaining policies only to new hires during onboarding
   • DPosting policies only on a hidden internal server that few employees know about
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of developing cybersecurity policies and procedures that align with organizational objectives?

   • ATo guarantee that all cyber threats are eliminated
   • BTo ensure that cybersecurity activities are consistent with the organization's mission and risk tolerance
   • CTo satisfy external auditors without considering internal needs
   • DTo replace the need for technical security controls
   Reveal Solution Discussion Select an answer first