Identify and Inventory All Assets and Categorize Them Based on Their Criticality and Sensitivity. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   What is the primary purpose of asset categorization in the NIST Cybersecurity Framework?

   • ATo identify vulnerabilities in each asset
   • BTo determine the order in which assets should be patched
   • CTo assign a monetary value to each asset
   • DTo group assets based on their type, function, and role within the organization
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A retail company is prioritizing its assets for a security investment. The e-commerce website is critical for online sales and contains customer payment data. The warehouse management system is critical for inventory control but contains only product codes and quantities. The employee portal is important for HR tasks and contains employee personal data. The company has a limited budget and must choose one asset to protect first. Which asset should be the top priority?

   • AE-commerce website
   • BEmployee portal
   • CAll should be protected equally
   • DWarehouse management system
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A utility company is assessing the criticality of its assets. The supervisory control and data acquisition (SCADA) system controls the power grid, the customer billing system manages payments, and the employee intranet hosts internal announcements. Which asset should be considered the most critical?

   • AAll are equally critical because they are all part of the company
   • BEmployee intranet
   • CCustomer billing system
   • DSCADA system
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A technology company is assessing the sensitivity of its source code repositories. The main product source code is proprietary and critical to the business. The internal tools source code is used by employees but is not customer-facing. The open-source libraries used in the product are publicly available. Which asset should be classified as having the highest sensitivity?

   • AOpen-source libraries
   • BMain product source code
   • CInternal tools source code
   • DAll source code has the same sensitivity because it is all code
   Reveal Solution Discussion Select an answer first