Explain the PROTECT Function, Its Categories, and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A financial institution is required to protect customer financial data both at rest and in transit. They are also required to maintain the integrity of transaction records and ensure the availability of their trading platform. The security architect is evaluating different controls. Which control set best addresses the confidentiality, integrity, and availability aspects of the Data Security (PR.DS) category?

   • APerform daily backups and store them in a secure offsite location.
   • BEncrypt all data at rest and in transit, implement database integrity checks, and deploy redundant systems with automated failover.
   • CImplement strong password policies and MFA for all users.
   • DDeploy a web application firewall (WAF) and conduct regular penetration testing.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the main purpose of the Platform Security (PR.PS) category in the NIST Cybersecurity Framework 2.0?

   • ATo protect data confidentiality, integrity, and availability
   • BTo provide cybersecurity awareness training
   • CTo manage identities and access control
   • DTo secure hardware, software, and platforms against threats
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A retail company is implementing the NIST Cybersecurity Framework 2.0. The CISO wants to ensure that the PROTECT function is prioritized based on the company's risk assessment. The company has identified that its point-of-sale (POS) systems are a high-risk asset, and that customer payment data must be protected. The security team is considering various controls. Which approach best reflects a risk-based implementation of the PROTECT function?

   • ADefer all security investments until after a full risk assessment is completed.
   • BImplement a comprehensive set of controls across all PROTECT categories, regardless of the asset's risk level.
   • CFocus only on implementing technical controls, such as firewalls and antivirus, for all systems.
   • DPrioritize controls for the POS systems, including network segmentation, encryption of payment data, and strict access controls.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A software development company stores its source code in a central repository. The security team is concerned about a malicious insider or a compromised developer account exfiltrating the code. They want to implement a control that protects the confidentiality of the data at rest and limits the impact of a single compromised credential. Which control is most aligned with the Data Security (PR.DS) category?

   • APerform daily full backups of the repository to an offsite location.
   • BEncrypt the repository data at rest and enforce multi-factor authentication (MFA) for all developer accounts.
   • CRestrict physical access to the server room where the repository is hosted.
   • DImplement a network firewall to block external access to the repository server.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which subcategory of PR.AT emphasizes the need for personnel to understand their roles and responsibilities in supporting the organization's cybersecurity program?

   • APR.AT-01: Awareness training is provided to all personnel
   • BPR.AT-03: Cybersecurity training is provided to individuals with specialized roles
   • CPR.AT-04: Cybersecurity training is provided to executives and leaders
   • DPR.AT-02: Technical training is provided to users of technology
   Reveal Solution Discussion Select an answer first