Explain IDENTITY Function with Its Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the NIST Cybersecurity Framework 2.0, which statement best describes the role of the IDENTIFY function in organizational risk management?

   • AIt ensures that all cybersecurity incidents are automatically prevented before they occur
   • BIt focuses solely on the technical vulnerabilities of software and hardware
   • CIt provides a structured way to understand and prioritize cybersecurity risks to support informed decision-making
   • DIt is the first step in responding to an active security breach
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the Risk Management Strategy (ID.RM) category of the NIST Cybersecurity Framework 2.0, which subcategory focuses on establishing risk appetite?

   • AID.RM-03: Prioritization of cybersecurity activities is established
   • BID.RM-04: Risk management is integrated into organization-wide activities
   • CID.RM-01: Risk management objectives are established and tracked
   • DID.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which statement best describes the relationship between the categories and subcategories of the IDENTIFY function?

   • ACategories and subcategories are interchangeable terms
   • BCategories are the high-level outcomes, and subcategories are the specific outcomes that support them
   • CSubcategories are only used in the IDENTIFY function, not in other functions
   • DSubcategories are the high-level outcomes, and categories are the specific outcomes
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A company is starting to implement the NIST Cybersecurity Framework 2.0. They first create an inventory of all hardware and software, then identify which data is most critical, and then define who is responsible for protecting each asset. Which IDENTIFY category are they primarily addressing?

   • ARisk Assessment
   • BSupply Chain Risk Management
   • CAsset Management
   • DGovernance
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A university's IT department has an asset inventory that lists all servers, workstations, and network devices. However, the inventory does not include data assets, such as research data, student records, or financial information. The risk team is about to conduct a risk assessment and realizes that the missing data asset inventory will significantly impact the accuracy of the assessment. Which subcategory of Asset Management (ID.AM) is most directly missing from the current inventory?

   • AID.AM-02: Inventory of software platforms and applications
   • BID.AM-01: Inventory of physical devices and systems
   • CID.AM-03: Organizational communication and data flows
   • DID.AM-05: Inventory of data and corresponding metadata
   Reveal Solution Discussion Select an answer first