Explain the PROTECT Function, Its Categories, and Subcategories. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An online service provider wants to ensure that its critical database can continue to operate with minimal downtime if a server fails. The database is replicated across multiple servers in a cluster. Which additional measure best aligns with the Technology Infrastructure Resilience (PR.IR) category?

   • AIncrease the database server's memory and CPU capacity.
   • BImplement automated failover so that a standby server takes over immediately if the primary fails.
   • CEncrypt the database connections to protect data in transit.
   • DConduct regular vulnerability scans on the database servers.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A hospital is implementing a new electronic health record (EHR) system. The security team must ensure that only authorized medical staff can access patient data, and that access is granted based on the principle of least privilege. The hospital also has a high turnover of temporary staff and contractors. The compliance officer requires that all access to patient data be logged and reviewed. Which combination of controls best meets these requirements while minimizing administrative overhead?

   • AGrant all medical staff full access to the EHR and rely on periodic manual reviews of access logs.
   • BImplement attribute-based access control (ABAC) with policies based on user attributes, but do not integrate with HR systems.
   • CUse a single shared account for all temporary staff to simplify management.
   • DUse role-based access control (RBAC) with automated provisioning and deprovisioning based on HR records, and enable detailed audit logging.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A manufacturing company's IT department has noticed that employees frequently share their passwords with colleagues to expedite work. The security manager wants to address this risky behavior through a structured program. Which initiative is most aligned with the Awareness and Training (PR.AT) category?

   • ADisable password sharing by configuring the system to prevent multiple simultaneous logins.
   • BTerminate employees who are found sharing passwords.
   • CImplement a password manager and enforce its use through a technical policy.
   • DDevelop and deliver a training module on password hygiene and the risks of sharing credentials.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A university is implementing a new identity and access management (IAM) system. The system must support a wide range of users, including students, faculty, and external researchers. The security team is concerned about the risk of unauthorized access to research data. They want to implement a control that provides fine-grained access control based on user attributes, such as department and project affiliation. Which control is most aligned with the Identity Management, Authentication, and Access Control (PR.AA) category?

   • AImplement attribute-based access control (ABAC) to grant access based on user attributes and resource characteristics.
   • BGrant all users access to all research data to simplify management.
   • CRely on the users' self-reported affiliations to determine access.
   • DUse a simple role-based access control (RBAC) model with a few predefined roles.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A research institution stores sensitive experimental data that must remain unaltered for legal and scientific integrity. The IT team is designing a solution to ensure that any unauthorized modification to the data is detected. Which control is most directly aligned with the Data Security (PR.DS) category?

   • AStore the data on a redundant array of independent disks (RAID) to protect against disk failure.
   • BEncrypt the data at rest using a strong encryption algorithm.
   • CImplement file integrity monitoring (FIM) on the storage systems.
   • DReplicate the data to a secondary site for disaster recovery.
   Reveal Solution Discussion Select an answer first