Explain IDENTITY Function with Its Categories and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the Governance (ID.GV) category of the NIST Cybersecurity Framework 2.0, which subcategory focuses on establishing cybersecurity policy?

   • AID.GV-02: Cybersecurity roles and responsibilities are coordinated and aligned
   • BID.GV-04: Governance and risk management activities are reviewed
   • CID.GV-03: Legal and regulatory requirements are understood and managed
   • DID.GV-01: Organizational cybersecurity policy is established and communicated
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which subcategory of Improvement (ID.IM) in the NIST Cybersecurity Framework 2.0 focuses on identifying improvements from evaluations and tests?

   • AID.IM-01: Improvements are identified from evaluations
   • BID.IM-04: Dependencies and priorities of organizational activities are considered
   • CID.IM-03: Risk responses are identified and prioritized
   • DID.IM-02: Organizational risk management processes are reviewed and updated
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A manufacturing company has been using NIST CSF 2.0 for two years. During a recent audit, the team discovered that its risk assessment process did not account for new types of cyber-physical attacks targeting its industrial control systems. The team also found that its asset inventory was outdated, missing several new IoT sensors. The CISO wants to address both issues. Which sequence of actions best aligns with the IDENTIFY function?

   • AUpdate the asset inventory first, then update the risk assessment process to include cyber-physical attacks.
   • BUpdate both simultaneously without prioritizing one over the other.
   • CUpdate the risk assessment process first, then update the asset inventory.
   • DFocus only on the risk assessment process and defer the asset inventory update.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the Risk Assessment (ID.RA) category of the NIST Cybersecurity Framework 2.0, which subcategory focuses on identifying vulnerabilities in the organization's systems?

   • AID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified
   • BID.RA-02: Threat intelligence is received from information sharing forums and sources
   • CID.RA-03: Internal and external threats are identified and recorded
   • DID.RA-01: Vulnerabilities in assets are identified, validated, and recorded
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of the IDENTIFY function in the NIST Cybersecurity Framework 2.0?

   • ATo develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities
   • BTo contain and eradicate the effects of a cybersecurity incident
   • CTo restore capabilities or services that were impaired due to a cybersecurity incident
   • DTo detect cybersecurity events and anomalies in real time
   Reveal Solution Discussion Select an answer first