Establish Clear Policies and Procedures to Guide Cybersecurity Activities. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why should cybersecurity policies be regularly reviewed and updated?

   • ATo ensure that policies remain unchanged regardless of new risks
   • BTo keep policies aligned with the evolving threat landscape and organizational changes
   • CTo make policies more complex and difficult to follow
   • DTo reduce the frequency of security audits
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A multinational corporation has updated its data classification policy. The policy now requires that all sensitive data be encrypted at rest. The IT department has sent a single email to all employees with the policy attached. Two weeks later, an internal audit reveals that several departments have not implemented encryption for their shared drives. What is the most likely reason for this non-compliance?

   • AThe policy lacked an enforcement mechanism.
   • BEmployees did not understand the policy because it was not effectively communicated and reinforced.
   • CThe policy was not aligned with organizational objectives.
   • DThe policy is not technically feasible for shared drives.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A university has a policy that requires all faculty and staff to complete annual cybersecurity awareness training. The training is offered online and is mandatory. However, the completion rate is only 60%. The university wants to increase compliance. What is the most effective approach?

   • AReport non-compliance to department heads and require them to ensure their staff complete the training.
   • BBlock network access for employees who do not complete the training by the deadline.
   • CMake the training more engaging and relevant to different roles, and communicate the importance of completing it.
   • DSend a reminder email to all employees who have not completed the training.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A government agency has a policy that requires all employees to use a VPN when accessing the network remotely. The policy is communicated through the employee handbook, but many employees are not using the VPN. An investigation reveals that the VPN is difficult to install and configure. What is the most effective way to improve compliance?

   • AProvide step-by-step instructions and technical support for VPN installation.
   • BRequire employees to sign a form acknowledging the VPN policy.
   • CDisconnect employees from the network if they do not use the VPN.
   • DUpdate the employee handbook to include more details about the VPN policy.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A logistics company is developing a policy for the use of cloud storage services. The company wants to enable employees to use approved cloud services for collaboration but needs to prevent the upload of sensitive customer data. What is the most important element to include in the policy?

   • AA technical control that automatically blocks all uploads to cloud services.
   • BA list of approved cloud services and a clear definition of what constitutes sensitive data.
   • CA statement that all cloud storage is prohibited to avoid any risk.
   • DA requirement for employees to sign an acknowledgment that they have read the policy.
   Reveal Solution Discussion Select an answer first