Explain Cybersecurity Risks and Their Impact on Organizations. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the NIST Cybersecurity Framework context, which statement best defines cybersecurity risk?

   • AThe probability that a threat event will occur, regardless of any vulnerabilities or impacts.
   • BThe likelihood that an organization will experience a data breach in the next twelve months.
   • CThe potential for a threat to exploit a vulnerability and cause harm to an organizational asset.
   • DThe total number of security controls an organization has implemented to protect its assets.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key principle of effective cybersecurity risk communication?

   • ATailor the message to the audience's role, knowledge, and decision-making authority.
   • BUse technical jargon to ensure precision among all audiences.
   • CShare all risk details with every stakeholder to ensure full transparency.
   • DCommunicate only the risks that have a high likelihood of occurring.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which type of impact is most directly associated with an organization being fined for failing to protect customer data under a privacy regulation?

   • ALegal impact
   • BFinancial impact
   • CReputational impact
   • DOperational impact
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational corporation experiences a cyberattack that disrupts its manufacturing operations for a week. The company loses $5 million in revenue, pays $2 million in ransom, faces a class-action lawsuit from shareholders, and sees a 10% drop in stock price. Which impact categories are most comprehensively illustrated?

   • AFinancial, operational, legal, and reputational
   • BOperational, legal, and reputational only
   • CFinancial and operational only
   • DFinancial, operational, and reputational
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A bank is assessing two risks: (1) a phishing email that could trick an employee into revealing credentials, and (2) a distributed denial-of-service (DDoS) attack that could take down the online banking portal. The phishing email is very likely but would only affect one employee's account. The DDoS attack is unlikely but would disrupt service for all customers. Which risk should be prioritized?

   • AThe phishing risk, because it is more likely to occur.
   • BNeither risk, because both are unlikely to cause significant harm.
   • CBoth risks equally, because any risk with a potential impact should be treated the same.
   • DThe DDoS risk, because its severity is high enough to outweigh its lower likelihood.
   Reveal Solution Discussion Select an answer first