Identify and Inventory All Assets and Categorize Them Based on Their Criticality and Sensitivity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following assets would most likely be assessed as having HIGH criticality?

   • AA printer in a break room
   • BA customer relationship management (CRM) system used by the sales team
   • CA backup server that is only used during disaster recovery
   • DA development environment used for testing new features
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of maintaining an up-to-date asset inventory?

   • ATo provide a static snapshot of assets at a single point in time
   • BTo satisfy regulatory compliance requirements only
   • CTo have a complete and current list of all hardware, software, data, and personnel assets
   • DTo replace the need for asset categorization
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An organization has two assets: Asset A is a customer database with high criticality and high sensitivity. Asset B is a public website with low criticality and low sensitivity. How should the organization prioritize its protection efforts?

   • APrioritize Asset B because it is publicly accessible
   • BPrioritize Asset A because it has higher combined criticality and sensitivity
   • CPrioritize Asset B because it is more likely to be attacked
   • DPrioritize both assets equally because all assets need protection
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large organization has an asset inventory that is maintained by multiple departments, each with its own spreadsheet. The IT department has its own list, the facilities department has a list of physical assets, and the HR department has a list of personnel. The organization wants to create a single, comprehensive inventory. What is the most effective approach?

   • AImplement a centralized asset management system with a common data model and automated discovery
   • BMerge all spreadsheets into one master spreadsheet
   • CAssign one department to be responsible for all asset inventory
   • DUse a cloud-based file sharing service to store all spreadsheets in one place
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional hospital is building its asset inventory for the NIST Identify function. The IT manager wants to ensure all critical assets are captured, including those that may not be on the traditional network. Which asset category is most likely to be overlooked and should be explicitly included?

   • AEmployee laptops and mobile devices
   • BSoftware licenses and cloud subscriptions
   • CBuilding management systems (HVAC, access control) on a separate OT network
   • DMedical devices connected to the internal network
   Reveal Solution Discussion Select an answer first