Explain the PROTECT Function, Its Categories, and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization is implementing a new policy requiring that only authorized clinical staff can access patient records, and that access is automatically revoked when a staff member transfers departments. The security team must also ensure that any access to patient data is logged for audit purposes. Which combination of controls best satisfies these requirements?

   • AUse a shared departmental account for all clinical staff and review access logs monthly.
   • BImplement mandatory access control (MAC) based on data classification, but do not enable logging.
   • CGrant all staff full access to patient records and rely on the honor system for data handling.
   • DImplement role-based access control (RBAC) with automated deprovisioning, and enable audit logging on the data repository.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A large enterprise is migrating to a cloud-based identity provider. The security team is concerned about the risk of a single compromised administrator account. They want to implement a control that makes it significantly harder for an attacker to use stolen administrator credentials. Which control is most directly aligned with the Identity Management, Authentication, and Access Control (PR.AA) category?

   • ARestrict administrator access to a specific IP address range.
   • BRequire multi-factor authentication (MFA) for all administrator accounts.
   • CConduct annual security awareness training for administrators.
   • DUse a longer, more complex password policy for administrator accounts.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A cloud service provider is responsible for securing the underlying infrastructure that hosts its customers' virtual machines. The provider must ensure that the hypervisor is hardened, and that customers cannot access each other's data. The provider also needs to maintain the availability of its services. Which set of controls is most aligned with the Platform Security (PR.PS) category?

   • AImplement a comprehensive backup and disaster recovery plan for customer data.
   • BRequire customers to use MFA for their cloud console access.
   • CHarden the hypervisor, apply regular security patches, and use network segmentation to isolate customer environments.
   • DDeploy a honeypot to attract and detect attackers.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A government agency is implementing a new security awareness program. The agency has a mix of technical and non-technical staff, and the security team wants to ensure that the training is effective and aligns with the NIST PROTECT function. The training must cover topics such as phishing, password hygiene, and incident reporting. The agency also wants to measure the effectiveness of the training. Which approach best aligns with the Awareness and Training (PR.AT) category?

   • AFocus only on technical staff, as they are the primary target of cyber attacks.
   • BConduct a one-time, in-person training session for all employees.
   • CProvide a single, mandatory online training course for all employees and track completion rates.
   • DDevelop role-based training modules and use simulated phishing exercises to measure employee susceptibility.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying a new line-of-business application on a fleet of Windows servers. The security team wants to ensure that only approved software can run on these servers to prevent malware and unauthorized tools. Which control is most aligned with the Platform Security (PR.PS) category?

   • ADeploy a network intrusion detection system (IDS) to monitor traffic.
   • BImplement an application allowlist that only permits approved executables to run.
   • CRequire all users to use strong passwords and enable MFA.
   • DPerform regular backups of the servers to a secure location.
   Reveal Solution Discussion Select an answer first