Grasp Core Concepts and Structure of Cybersecurity Framework (CSF) Tiers. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is conducting a NIST CSF assessment and finds that it has formal risk management processes that are consistently applied, and it has integrated cybersecurity risk management with enterprise risk management. However, the company does not have a formal process for sharing lessons learned across the organization, and it does not use predictive indicators to adapt its security posture. The company's leadership wants to achieve a higher tier but is concerned about the cost and effort required. What is the most appropriate target tier and the primary gap to address?

   • ATarget Tier 4; the primary gap is the lack of predictive indicators
   • BTarget Tier 3; the primary gap is the lack of a formal lessons-learned process
   • CTarget Tier 2; the primary gap is the lack of consistent application
   • DTarget Tier 1; the primary gap is the lack of formal processes
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is at Tier 2 (Risk Informed) and wants to progress to Tier 4 (Adaptive). What is the most logical sequence of improvements?

   • AMaintain the current tier and only make incremental changes
   • BFirst achieve Tier 3 by integrating with enterprise risk management and establishing a lessons-learned process, then implement real-time adaptation
   • CImplement real-time adaptation immediately, skipping Tier 3
   • DFocus only on improving threat intelligence without changing risk management processes
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can an organization use CSF Tiers to assess its cybersecurity posture?

   • ABy comparing its current tier to its target tier to identify gaps and prioritize improvements
   • BBy using the tiers to determine which security controls to implement
   • CBy using the tiers to benchmark against competitors
   • DBy using the tiers to calculate a numerical risk score
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is using the NIST CSF to assess its cybersecurity posture. They have formal risk management processes that are consistently applied, and they have integrated cybersecurity risk management with enterprise risk management. They also have a formal process for sharing lessons learned across the organization. However, they do not yet have the ability to adapt their security posture in real time based on predictive indicators. What is the company's current tier?

   • ATier 2: Risk Informed
   • BTier 3: Repeatable
   • CTier 4: Adaptive
   • DTier 1: Partial
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the NIST Cybersecurity Framework, what do CSF Tiers help an organization communicate?

   • AThe budget allocated to its cybersecurity program
   • BHow its cybersecurity risk management practices align with the Framework's characteristics
   • CThe number of cybersecurity incidents it has experienced
   • DThe specific security products and tools it has deployed
   Reveal Solution Discussion Select an answer first