Explain GOVERN Function Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A technology company's cybersecurity governance process has been in place for three years. The CISO wants to ensure the process itself is improving, not just the security controls. Which approach best supports continuous improvement of the governance process?

   • AReplace the current governance framework with a new one every year to stay current.
   • BIncrease the frequency of vulnerability scans to identify more technical weaknesses.
   • CConduct an annual review of governance processes, including stakeholder feedback and lessons learned from incidents.
   • DBenchmark the company's security controls against industry peers.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a governance activity for managing supply chain cybersecurity risk?

   • AConducting penetration tests on the organization's internal network
   • BPatching vulnerabilities in the organization's own software
   • CEstablishing requirements for third-party risk assessments and contractual security clauses
   • DMonitoring network traffic for malicious activity
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company's cybersecurity governance process includes an annual review. The review consistently finds that policies are well-written but not followed. The CISO has implemented training and awareness programs, but compliance has not improved. What should the CISO do to improve the governance process itself?

   • AOutsource the enforcement of policies to a third-party security firm.
   • BAnalyze the root cause of non-compliance, such as conflicting business incentives, and adjust the governance process to address it.
   • CIncrease the frequency of security training from annually to quarterly.
   • DMake the policies more restrictive to force compliance.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's risk appetite statement says it will accept moderate risk to achieve business growth. The CISO proposes a new security initiative that would significantly reduce cyber risk but would also slow down the company's product development cycle. The board is divided: some want the reduced risk, others want faster growth. What should the CISO do?

   • APresent the trade-off to the board, showing the risk reduction versus the impact on growth, and let them decide.
   • BImplement the initiative immediately because reducing cyber risk is always the right decision.
   • CAbandon the initiative because the company's risk appetite allows for moderate risk.
   • DImplement a scaled-down version of the initiative that has minimal impact on product development.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an activity that supports continuous improvement of cybersecurity governance?

   • AConducting regular reviews of governance processes and incorporating feedback
   • BDelegating all governance decisions to external consultants
   • CFocusing only on technical controls and ignoring governance
   • DKeeping governance processes static to avoid disruption
   Reveal Solution Discussion Select an answer first