Explain GOVERN Function Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A large retail chain's cybersecurity strategy was developed two years ago. Since then, the company has expanded into e-commerce and now processes significantly more customer payment data. The board is reviewing the strategy and asks the CISO how they know it is still effective. What should the CISO do?

   • AAsk the external auditor to verify that the company meets all regulatory requirements.
   • BReissue the existing strategy with a new approval date to show the board it is current.
   • CConduct a formal review of the strategy against the current business environment and risk profile, and report findings to the board.
   • DConfirm that all existing security controls are operating as designed and report the uptime statistics.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is selecting a new cloud provider. The provider offers excellent security features but is based in a country with different data protection laws. The company's legal team has determined that using this provider would require transferring customer data across borders, which may violate the company's data residency obligations. The provider is also significantly cheaper than local alternatives. What should the company do?

   • AUse the cheaper provider but require them to sign a contract indemnifying the company for any legal penalties.
   • BUse the cheaper provider and accept the legal risk because the security features are excellent.
   • CChoose a different provider that can guarantee data residency within the required jurisdiction, even if it costs more.
   • DAsk the provider to store data in a different region, even if it is not their primary data center.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of the organization's oversight of its cybersecurity strategy?

   • ATo ensure that all employees have the same level of security clearance
   • BTo ensure the strategy remains aligned with the organization's objectives and adapts to changes
   • CTo reduce the cybersecurity budget to the minimum possible
   • DTo guarantee that no cybersecurity incidents ever occur
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How does an organization's risk appetite guide cybersecurity risk management decisions?

   • AIt helps prioritize which risks to mitigate, accept, transfer, or avoid
   • BIt determines the exact security controls to be implemented for every asset
   • CIt guarantees that all risks are eliminated
   • DIt replaces the need for detailed risk assessments
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's ERM team uses a 5x5 risk matrix to evaluate all business risks, including financial, operational, and strategic. The cybersecurity team currently uses a separate, more detailed cyber-specific risk assessment methodology. The board is concerned that cyber risks are not being compared with other enterprise risks. What should the company do?

   • AReport only high-severity cyber risks to the ERM team and handle the rest internally.
   • BKeep the two methodologies separate to maintain detail in cyber risk assessment.
   • CMap cyber risk assessment results to the enterprise risk matrix so cyber risks can be compared with other business risks.
   • DReplace the enterprise risk matrix with the more detailed cyber risk methodology.
   Reveal Solution Discussion Select an answer first