Understand the Application of NIST CSF Profiles in Practical Scenarios. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard · select all that apply

   A company is using NIST CSF Profiles to support a regulatory compliance audit. The auditor has asked for evidence that the company's cybersecurity program is aligned with its business objectives. Which of the following are valid uses of Profiles in this context? (Select all that apply.)

   • AUse the Profiles to identify gaps between current and target states, which can inform the audit's scope.
   • BUse the Target Profile to show the company's planned improvements and commitment to continuous improvement.
   • CUse the Profiles as a substitute for the actual security controls and evidence of implementation.
   • DUse the Current Profile to demonstrate the company's existing security posture.
   • EUse the Profiles to communicate cybersecurity risk to the board in business terms.
   Check answers Discussion Select an answer first
2. 12application · medium

   A regional hospital has completed a NIST CSF Current Profile and is now developing a Target Profile. The hospital's board has approved a budget that prioritizes protecting patient data over all other assets. The security team must decide which CSF Categories to emphasize in the Target Profile. Which approach aligns with the board's directive?

   • ASelect Categories that directly support the Protect and Detect functions, such as PR.DS and DE.CM, and set higher target outcomes for those areas.
   • BFocus only on the Identify function because understanding risks is the first step in any cybersecurity program.
   • CInclude all Categories at the same Implementation Tier to ensure balanced coverage across the framework.
   • DUse the Current Profile as the Target Profile to avoid introducing new risks during the transition.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A company wants to assess its current cybersecurity posture against its desired state. Which NIST CSF Profile application is most appropriate?

   • AVendor assessment
   • BRegulatory compliance
   • CIncident response
   • DGap analysis
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How can NIST CSF Profiles support risk management decisions?

   • ABy eliminating the need for continuous monitoring
   • BBy communicating cybersecurity risk and prioritizing actions based on gaps
   • CBy providing a legal defense against cybersecurity incidents
   • DBy automatically implementing security controls
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a Target Profile that includes a high target outcome for the PR.PT (Protective Technology) Category. However, the budget committee has only approved funding for half of the required initiatives. The CISO must decide how to proceed. What is the best course of action?

   • ARevise the Target Profile to a lower outcome for PR.PT that can be achieved with the approved budget.
   • BProceed with all initiatives and exceed the budget, as the Target Profile is a commitment.
   • CImplement the most critical PR.PT subcategories first and defer the rest, documenting the residual risk.
   • DCancel the PR.PT initiatives and focus on other Categories that are fully funded.
   Reveal Solution Discussion Select an answer first