Identify the Increasing Data Security Threats to IT Systems and Data. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A manufacturing company has seen a sharp increase in phishing emails that contain malicious links. The security team wants to implement a control that will have the most immediate impact on preventing users from reaching these malicious sites. Which control should they implement first?

   • ADeploy a new endpoint detection and response (EDR) agent to all endpoints
   • BImplement a new security awareness training module focused on identifying phishing links
   • CEnforce a web filtering policy that blocks access to newly registered and known malicious domains at the corporate proxy
   • DIncrease the spam filter's sensitivity to move more emails to the junk folder
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's web application was recently defaced. The attacker exploited a vulnerability in a third-party plugin. The security team wants to prevent this from happening again. Which control is most directly relevant to addressing this specific root cause?

   • AConducting annual penetration tests
   • BDeploying a Web Application Firewall (WAF) to filter malicious traffic
   • CImplementing a formal patch management process to ensure third-party plugins are updated promptly
   • DIncreasing the frequency of security awareness training for developers
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A small business owner is concerned about the threat of ransomware. They have a single file server with all their important documents. What is the most effective and practical control they can implement to mitigate the impact of a ransomware attack?

   • AInstall a free antivirus product on the file server
   • BPurchase cyber insurance
   • CDisconnect the file server from the internet
   • DMaintain a 3-2-1 backup strategy with an offline or immutable copy of critical data
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is moving its on-premises data center to a public cloud. The security team is concerned about the shared responsibility model. Which data security threat is the company's responsibility to manage, even though the infrastructure is in the cloud?

   • APhysical security of the cloud data center
   • BAvailability of the cloud provider's network infrastructure
   • CMisconfiguration of the cloud-based virtual machines and storage, such as leaving a database publicly accessible
   • DSecurity of the underlying hypervisor
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following best describes a key factor contributing to the increasing number of data security threats facing modern IT systems?

   • AThe expansion of attack surfaces due to cloud adoption, remote work, and interconnected devices.
   • BThe decreased reliance on third-party vendors and supply chains in enterprise IT environments.
   • CThe reduction in the number of security vulnerabilities in commercial software over the past decade.
   • DThe simplification of IT infrastructure through consolidation into a single on-premises data center.
   Reveal Solution Discussion Select an answer first