Identify and Inventory All Assets and Categorize Them Based on Their Criticality and Sensitivity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A large healthcare organization has an asset inventory that is stored in a spreadsheet and updated manually. The inventory is often outdated, and recent audits have found unauthorized devices on the network. The organization wants to improve its inventory management without disrupting operations. What is the most effective solution?

   • ARequire all employees to register their devices with IT before connecting to the network
   • BImplement a network access control (NAC) solution that automatically discovers and blocks unauthorized devices
   • CDeploy an automated asset discovery tool that continuously scans the network and updates the inventory
   • DConduct quarterly manual audits of the network
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A multinational corporation is expanding its asset inventory to include all subsidiaries. The IT team has discovered that some subsidiaries use legacy systems that are not connected to the corporate network, and they are not sure if these systems are still in use. What is the most effective approach to identify these assets?

   • ARely on the subsidiaries' IT staff to report their assets
   • BConduct on-site physical audits of each subsidiary
   • CUse a combination of automated discovery tools and interviews with local staff
   • DAssume that all assets are connected to the corporate network and use network scanning only
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is the primary purpose of asset identification in the NIST Cybersecurity Framework's Identify function?

   • ATo assign a risk score to each asset based on its vulnerabilities
   • BTo determine the financial value of each asset for insurance purposes
   • CTo create a list of assets that require immediate patching
   • DTo discover and document all physical, digital, and human assets within the organization's scope
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What does criticality assessment primarily measure about an asset?

   • AThe sensitivity of the data stored on the asset
   • BThe likelihood that the asset will be compromised
   • CThe cost of replacing the asset
   • DThe importance of the asset to organizational operations and mission
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A government agency is prioritizing assets for a security upgrade. The citizen services portal is critical for public access and contains sensitive personal data. The internal email system is critical for daily operations but contains only routine communications. The public information website is non-critical and contains only public data. Which asset should be upgraded first?

   • AAll should be upgraded simultaneously
   • BPublic information website
   • CCitizen services portal
   • DInternal email system
   Reveal Solution Discussion Select an answer first