Explain GOVERN Function Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is defining cybersecurity roles and responsibilities. The CISO wants to ensure that the board is actively involved in cybersecurity oversight. Which responsibility should be assigned to the board?

   • AWriting detailed security policies for each department.
   • BInvestigating individual security incidents.
   • CReviewing and approving the cybersecurity strategy and risk appetite.
   • DConfiguring firewalls and other security devices.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A university has a cybersecurity policy that requires all faculty to use multi-factor authentication (MFA). However, a survey shows that only 40% of faculty have enrolled in MFA. The policy is well-written but is not being followed. What is the most likely missing element in the policy lifecycle?

   • AA defined process for enforcing the policy and holding non-compliant faculty accountable.
   • BA longer grace period for faculty to enroll in MFA.
   • CA more complex password policy to complement MFA.
   • DA more detailed technical specification of how MFA should be implemented.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services firm is considering a new vendor that will process customer loan applications. The vendor is a startup with limited security track record. The firm's risk appetite is conservative, and it requires all third parties handling customer data to meet strict security standards. What should the firm do before signing the contract?

   • ARely on the vendor's marketing materials that claim they are 'secure' and 'compliant'.
   • BSign the contract and require the vendor to provide a security report after six months of operation.
   • CConduct a thorough third-party risk assessment, including security questionnaires and on-site review, before approval.
   • DAsk the vendor to sign a contract clause stating they will be liable for any breach.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a large supply chain with hundreds of suppliers. A recent audit found that a critical supplier has weak security controls, but replacing the supplier would be costly and time-consuming. The company's risk appetite is moderate, but the supplier handles sensitive customer data. What is the most appropriate governance response?

   • ATerminate the relationship with the supplier immediately to eliminate the risk.
   • BImplement compensating controls to mitigate the risk while working with the supplier to improve their security posture.
   • CAccept the risk without any action because the company's risk appetite is moderate.
   • DTransfer the risk to the supplier by requiring them to purchase cyber insurance.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a key responsibility of the Chief Information Security Officer (CISO) within the GOVERN function?

   • ATo lead the development and implementation of the cybersecurity program
   • BTo approve all employee hiring decisions
   • CTo manage the organization's financial investments
   • DTo conduct external audits of the organization's financial statements
   Reveal Solution Discussion Select an answer first