Explain Cybersecurity Risks and Their Impact on Organizations. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization is planning to migrate its customer database to a cloud provider. The CISO has identified a risk of data exposure due to misconfigured cloud storage. How should the CISO communicate this risk to the project manager who is responsible for the migration timeline?

   • AAsk the project manager to review the technical security documentation on their own.
   • BExplain the risk in terms of potential project delays, additional costs, and the need for security reviews before go-live.
   • CProvide a detailed technical explanation of cloud misconfiguration and its potential attack vectors.
   • DState that the risk is acceptable and proceed with the migration as planned.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A CISO needs to communicate the risk of a potential data breach to the board of directors. The board is not technical and is primarily concerned with financial and reputational impact. Which approach is most effective?

   • AUse a risk matrix showing likelihood and impact, and translate the risk into potential financial loss and reputational damage.
   • BPresent a detailed technical report explaining the specific vulnerabilities and attack vectors.
   • CFocus only on the technical controls in place to mitigate the risk, reassuring the board that the risk is managed.
   • DSend a lengthy email with all the details and ask the board to read it before the next meeting.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A financial services firm is assessing the risk of a phishing campaign targeting its employees. The firm has implemented multi-factor authentication (MFA) and security awareness training, which reduces the likelihood of successful credential theft. However, if an attacker does compromise an employee's credentials, they could access sensitive client financial data. The firm's risk manager must determine the overall risk level. Which statement best reflects the risk assessment?

   • AThe risk cannot be determined without a quantitative analysis.
   • BThe risk is moderate because the likelihood is reduced by controls, but the impact remains high if a breach occurs.
   • CThe risk is high because the impact of a data breach is severe, regardless of the likelihood.
   • DThe risk is low because MFA and training significantly reduce the likelihood of a successful attack.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is it important to communicate cybersecurity risks to different stakeholders in an organization?

   • ATo enable informed decision-making and appropriate risk response at all levels of the organization.
   • BTo ensure that all stakeholders have the same level of technical expertise.
   • CTo assign blame for security failures to specific individuals or departments.
   • DTo satisfy regulatory requirements that mandate public disclosure of all security incidents.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A vulnerability in a public-facing web server has a high likelihood of exploitation and could result in a complete loss of customer data. How would this risk be characterized in terms of likelihood and severity?

   • AHigh likelihood and low severity
   • BLow likelihood and high severity
   • CHigh likelihood and high severity
   • DLow likelihood and low severity
   Reveal Solution Discussion Select an answer first