Establish Clear Policies and Procedures to Guide Cybersecurity Activities. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of defining enforcement mechanisms for cybersecurity policies?

   • ATo ensure that policies are followed and violations are addressed consistently
   • BTo allow managers to apply penalties arbitrarily
   • CTo eliminate the need for employee training on policies
   • DTo shift all responsibility for security to the enforcement team
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A retail company has a policy that prohibits employees from sharing their passwords. However, a recent incident revealed that several employees shared passwords to access a shared mailbox. The company wants to prevent this from happening again. What is the most effective measure?

   • AIncrease the severity of disciplinary actions for password sharing.
   • BDisable shared mailboxes and require employees to use individual accounts.
   • CImplement a technical solution that allows shared mailboxes without sharing passwords, such as delegation.
   • DSend a company-wide email reminding employees of the policy.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a policy enforcement mechanism?

   • ARegular compliance audits and access reviews
   • BPublishing policies on the company intranet
   • CCreating a policy without any follow-up actions
   • DHolding a one-time policy awareness event
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key element of a policy review and update process?

   • AReviewing policies only when a breach occurs
   • BKeeping the review process informal and undocumented
   • CScheduling reviews at regular intervals and after significant incidents or changes
   • DDelegating all updates to a single individual without oversight
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization has a policy that requires all patient data to be encrypted in transit. Recently, a new type of ransomware has been discovered that can intercept data before it is encrypted. The security team wants to update the policy to address this new threat. What is the first step in the policy update process?

   • AImmediately change the policy to require additional encryption layers.
   • BConduct a review of the current policy and assess the impact of the new threat on existing controls.
   • CCommunicate the new threat to all employees and ask them to be more careful.
   • DEnforce the current policy more strictly to ensure compliance.
   Reveal Solution Discussion Select an answer first