Explain GOVERN Function Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a well-defined cybersecurity governance structure. The board receives a quarterly cybersecurity report from the CISO. However, a recent major incident revealed that the board was not aware of a known critical vulnerability in a key system. The vulnerability had been reported to the CISO but was not included in the board report. What is the most significant governance failure?

   • AThe company did not have enough security tools to detect the vulnerability.
   • BThe CISO failed to escalate a critical risk to the board, indicating a breakdown in the oversight process.
   • CThe vulnerability was not patched quickly enough by the IT team.
   • DThe board did not ask the right questions during the quarterly review.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of an oversight activity for the cybersecurity strategy?

   • ADeploying a new firewall to the network
   • BConducting periodic reviews of the strategy's performance against defined metrics
   • CResetting a user's password
   • DInstalling antivirus software on endpoints
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How are cybersecurity policies typically communicated to employees to ensure they are understood and followed?

   • ABy posting them on the company's public website
   • BThrough formal training and awareness programs
   • CBy including them only in the employee handbook
   • DBy keeping them confidential and only sharing with the security team
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a legal or regulatory requirement that should shape an organization's cybersecurity risk management approach?

   • AThe organization's marketing strategy
   • BThe organization's internal employee training schedule
   • CThe organization's preferred technology vendors
   • DData protection regulations such as GDPR or HIPAA
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the NIST CSF 2.0 GOVERN function, which group is typically responsible for establishing the organization's cybersecurity risk management strategy and ensuring it aligns with business objectives?

   • ABoard of directors and senior leadership
   • BExternal auditors
   • CIT help desk staff
   • DCybersecurity analysts
   Reveal Solution Discussion Select an answer first