Explain IDENTITY Function with Its Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which subcategory of Risk Assessment (ID.RA) in the NIST Cybersecurity Framework 2.0 involves analyzing the potential impact and likelihood of threats exploiting vulnerabilities?

   • AID.RA-02: Threat intelligence is received from information sharing forums and sources
   • BID.RA-03: Internal and external threats are identified and recorded
   • CID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified
   • DID.RA-01: Vulnerabilities in assets are identified, validated, and recorded
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A hospital's security team is updating its asset inventory. They have cataloged all networked medical devices, the software versions they run, and the patient data they process. They have also assigned a named individual to each device for maintenance and security updates. Which subcategory of Asset Management (ID.AM) is the team addressing by assigning these named individuals?

   • AID.AM-04: Roles and responsibilities for assets
   • BID.AM-01: Inventory of physical devices and systems
   • CID.AM-02: Inventory of software platforms and applications
   • DID.AM-03: Organizational communication and data flows
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which subcategory of Risk Management Strategy (ID.RM) in the NIST Cybersecurity Framework 2.0 focuses on prioritizing cybersecurity activities?

   • AID.RM-03: Prioritization of cybersecurity activities is established
   • BID.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained
   • CID.RM-01: Risk management objectives are established and tracked
   • DID.RM-04: Risk management is integrated into organization-wide activities
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A multinational corporation operates in multiple jurisdictions with conflicting data privacy regulations. One region requires data to be stored locally, while another allows cross-border transfers. The CISO must develop a cybersecurity governance framework that satisfies both regions while maintaining a unified risk management strategy. Which approach best aligns with the IDENTIFY function?

   • ADevelop region-specific policies that address local regulatory requirements while aligning with the global risk management strategy.
   • BDevelop a single global policy that applies the strictest regulatory requirements to all regions.
   • CDefer policy development until the regulations are harmonized.
   • DDevelop a single global policy that applies the least restrictive regulatory requirements to all regions.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A newly hired security analyst is reviewing the NIST CSF 2.0 documentation and notices that the IDENTIFY function has six categories. The analyst is asked to explain to a colleague how these categories work together to support the overall function. Which statement best describes the relationship between the six categories?

   • AThe categories are interrelated and collectively provide a comprehensive view of the organization's risk posture.
   • BEach category operates independently, and organizations can choose to implement only the ones relevant to their industry.
   • CThe categories are only relevant for large enterprises and are not applicable to small businesses.
   • DThe categories are sequential, and an organization must fully complete one category before starting the next.
   Reveal Solution Discussion Select an answer first