Establish Clear Policies and Procedures to Guide Cybersecurity Activities. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes the relationship between cybersecurity policies and procedures?

   • AProcedures are optional, while policies are mandatory
   • BPolicies are high-level statements of intent, while procedures are detailed step-by-step instructions
   • CPolicies and procedures are interchangeable terms with no practical difference
   • DProcedures are broad statements, and policies are specific technical configurations
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm has a policy that requires all employees to change their passwords every 90 days. The security team has noticed an increase in phishing attacks that successfully compromise accounts. The team believes that frequent password changes are not effectively mitigating the risk. What should the security team do?

   • AIncrease the frequency of password changes to every 30 days.
   • BProvide additional training on phishing awareness without changing the policy.
   • CEnforce the current policy more strictly by locking accounts after one failed login.
   • DReview and update the policy to align with current best practices, such as longer passphrases and multi-factor authentication.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is it important to communicate cybersecurity policies to all relevant stakeholders?

   • ATo satisfy legal requirements for public disclosure of all security measures
   • BTo replace the need for security awareness training
   • CTo allow stakeholders to modify policies as they see fit
   • DTo ensure that stakeholders understand their responsibilities and can comply with the policies
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A multinational bank has a policy that requires all customer data to be stored in the country of origin. Due to a recent acquisition, the bank now has operations in a new country with stricter data protection laws. The security team is reviewing the policy. What is the most important factor to consider during this review?

   • AThe technical capabilities of the existing IT infrastructure to support data storage.
   • BThe new country's data protection laws and how they align with the existing policy.
   • CThe opinions of the acquired company's employees regarding the policy.
   • DThe cost of implementing new data storage solutions in the new country.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A global company has a policy that requires all employees to report any suspected security incidents to the IT help desk within one hour. The policy is communicated through an online portal, but many employees in remote locations are not reporting incidents. An investigation reveals that employees are unsure how to report incidents and fear retaliation. What is the most effective way to improve reporting?

   • ARequire all employees to sign a form acknowledging the reporting policy.
   • BSimplify the policy to require reporting only for major incidents.
   • CDiscipline employees who fail to report incidents within the required time.
   • DProvide multiple reporting channels, such as a hotline and email, and clearly communicate that reporting is confidential and protected.
   Reveal Solution Discussion Select an answer first