Explain Cybersecurity Risks and Their Impact on Organizations. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is evaluating two risks: (1) a malware infection on a single employee's laptop, and (2) a ransomware attack on the company's file server. The malware infection is likely to occur because employees frequently download attachments, but the impact is limited to one laptop. The ransomware attack is less likely because the company has email filtering, but if it occurs, it would encrypt all company files. Which risk has a higher overall risk level?

   • AThe risk level cannot be determined without more information.
   • BThe ransomware attack, because its severity is high enough to outweigh its lower likelihood.
   • CThe malware infection, because it is more likely to occur.
   • DBoth have the same risk level because they are both cybersecurity risks.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of integrating cybersecurity risk into organizational decision-making?

   • AA company's leadership reviews cybersecurity risk reports and decides to allocate additional budget to patch a critical vulnerability.
   • BA company decides to invest in a new customer relationship management system without considering the security implications.
   • CA company conducts a risk assessment and then files the report without sharing it with leadership.
   • DA company decides to accept all cybersecurity risks because they are too difficult to mitigate.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization experiences a data breach that exposes protected health information (PHI) of 10,000 patients. The organization faces regulatory fines, loses patient trust, and must spend significant resources on credit monitoring for affected individuals. Which impact categories are most clearly demonstrated?

   • ALegal, reputational, and financial
   • BOperational and legal only
   • CFinancial and operational only
   • DReputational and financial only
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A small e-commerce company uses a third-party payment processor. The company's website is hosted on a shared server. A vulnerability in the shared server's operating system could allow an attacker to access the website's database, which contains customer payment information. Which of the following best represents the threat in this scenario?

   • AThe customer payment information stored in the database
   • BThe shared server hosting the website
   • CThe potential attacker who could exploit the vulnerability
   • DThe vulnerability in the operating system
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following correctly lists the three components of cybersecurity risk as defined in the NIST Cybersecurity Framework?

   • ALikelihood, probability, and frequency
   • BAsset, control, and countermeasure
   • CThreat, vulnerability, and impact
   • DConfidentiality, integrity, and availability
   Reveal Solution Discussion Select an answer first