Understand the Application of NIST CSF Profiles in Practical Scenarios. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A technology company is preparing for a cybersecurity insurance renewal. The insurer requires evidence that the company has a structured approach to managing cyber risk. Which use of NIST CSF Profiles would best support the insurance application?

   • ASubmit the company's vulnerability scan reports as proof of security controls.
   • BUse the Target Profile only, as it shows the company's future plans, which is what insurers care about.
   • CState that the company is compliant with NIST CSF without providing any supporting documentation.
   • DProvide the company's Current and Target Profiles to demonstrate a clear understanding of its risk posture and improvement plan.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing company is starting to develop its first NIST CSF Profile. The CISO wants the profile to reflect the company's specific business goals, such as protecting intellectual property and ensuring production uptime. What is the first step the team should take in the Profile development process?

   • AIdentify the organization's objectives and priorities, including risk appetite and regulatory requirements.
   • BAssign Implementation Tiers to each of the five functions before selecting Categories.
   • CConduct a vulnerability scan of all production systems to establish a baseline.
   • DSelect all Subcategories from the CSF to ensure comprehensive coverage.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a key activity when developing a NIST CSF Profile?

   • AReplacing the organization's risk management framework
   • BHiring an external auditor to certify the profile
   • CSelecting relevant Categories and Subcategories that align with organizational objectives
   • DImplementing all CSF Subcategories regardless of relevance
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An organization is evaluating the cybersecurity posture of a potential cloud service provider. Which NIST CSF Profile application is most suitable?

   • ARegulatory compliance
   • BVendor assessment
   • CGap analysis
   • DIncident response
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A government agency is required to align with a national cybersecurity framework that is similar to but not identical to the NIST CSF. The agency has already developed a NIST CSF Target Profile. How should the agency proceed to meet the national framework's requirements?

   • AUse the national framework as a secondary reference but keep the NIST CSF Target Profile unchanged.
   • BAssume the NIST CSF Target Profile automatically satisfies the national framework because both are based on similar principles.
   • CAbandon the NIST CSF Target Profile and develop a completely new profile based solely on the national framework.
   • DMap the national framework's controls to the NIST CSF Subcategories and adjust the Target Profile where the national framework is more stringent.
   Reveal Solution Discussion Select an answer first