Identify and Manage Cybersecurity Risks Associated with Suppliers and Third-Party Vendors. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of a third-party risk assessment in the NIST CSF 2.0 GOVERN function?

   • ATo evaluate the cybersecurity posture of suppliers and determine the potential risk they pose to the organization
   • BTo ensure suppliers use the same security tools as the organization
   • CTo negotiate the lowest possible price for supplier services
   • DTo transfer all cybersecurity risk to the supplier through insurance
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A hospital relies on a medical device vendor for critical patient monitoring equipment. The vendor's software has a known vulnerability that could allow remote exploitation. The vendor has not yet released a patch. The hospital's risk team must decide how to respond while ensuring patient safety and operational continuity. What is the best approach?

   • AImplement network segmentation and monitoring for the affected devices while working with the vendor on a patch timeline.
   • BAccept the risk because the vendor is reputable and will eventually release a patch.
   • CDisconnect all affected devices from the network immediately to prevent exploitation.
   • DReplace all affected devices with new equipment from a different vendor.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a third-party risk assessment activity?

   • ACreating a new user account for a supplier's employee
   • BConfiguring the organization's firewall to block all inbound traffic
   • CReviewing a supplier's SOC 2 report and security certifications
   • DUpdating the organization's incident response plan
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the NIST Cybersecurity Framework 2.0 GOVERN function, what is the primary purpose of supplier risk identification?

   • ATo eliminate all third-party dependencies by moving all operations in-house
   • BTo catalog all suppliers and determine which ones introduce cybersecurity risk to the organization
   • CTo continuously monitor supplier security operations centers for active threats
   • DTo negotiate contract terms that transfer all cybersecurity liability to the supplier
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which activity is most directly associated with supplier risk identification in the NIST CSF 2.0 GOVERN function?

   • AConducting an annual penetration test of the organization's internal network
   • BImplementing multi-factor authentication for all employee accounts
   • CDeveloping a business continuity plan for the organization's headquarters
   • DCreating an inventory of suppliers and mapping their access to organizational data and systems
   Reveal Solution Discussion Select an answer first