Explain the Categories and Subcategories of the DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a subcategory under the Continuous Monitoring category of the DETECT function?

   • ADefining the roles and responsibilities for detection personnel
   • BAnalyzing detected events to understand the nature of a threat
   • CMonitoring physical activity to detect potential cybersecurity threats
   • DDetermining the impact of an incident on critical services
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A financial institution is required by regulation to detect insider threats. The security team has implemented user behavior analytics (UBA) that monitors employee activity across systems, and has deployed cameras and badge readers in the data center. However, the team has not implemented any network traffic analysis. The regulator has asked the institution to demonstrate that it can detect both malicious insider activity and unauthorized physical access. Which DETECT subcategories are most directly relevant to the regulator's request?

   • AAlerting and logging
   • BCorrelating events and analyzing detected events
   • CMonitoring personnel activity and monitoring physical activity
   • DMonitoring network activity and monitoring personnel activity
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A logistics company has deployed badge readers at all facility entrances, installed cameras in server rooms, and implemented a policy requiring all employees to wear visible ID badges. The security team wants to detect unauthorized physical access attempts. Which DETECT subcategory is the company primarily implementing?

   • AMonitoring physical activity
   • BMonitoring personnel activity
   • CCorrelating events from multiple sources
   • DMonitoring network activity
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a subcategory of Incident Analysis in the NIST Cybersecurity Framework 2.0?

   • ADeclaring an incident when predefined criteria are met
   • BMonitoring the physical environment for unauthorized access
   • CDefining the roles of detection personnel
   • DCorrelating event data from multiple sources
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital's SOC receives an alert about a potential phishing email that was opened by a staff member. The tier-1 analyst reviews the alert, determines that the email is indeed malicious, and then assigns a priority level of 'high' based on the fact that the staff member has access to patient records. The analyst then escalates the case to the tier-2 team for further investigation. Which DETECT subcategory does the analyst's action of assigning a priority level represent?

   • AEstimating incident impact
   • BIncident triage
   • CIncident declaration
   • DAnalyzing detected events
   Reveal Solution Discussion Select an answer first