Understand the Application of NIST CSF Profiles in Practical Scenarios. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a primary benefit of using NIST CSF Profiles to communicate cybersecurity risk?

   • AThey guarantee that all risks are eliminated
   • BThey provide a standardized language that is understandable to both technical and non-technical stakeholders
   • CThey automatically prioritize all actions without human input
   • DThey replace the need for executive buy-in
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A large hospital system is acquiring a smaller clinic. The hospital's security team must assess the clinic's cybersecurity posture before integrating it into the hospital's network. The clinic has never used the NIST CSF. What is the most efficient way to perform this assessment?

   • ARequire the clinic to develop a full Target Profile before the acquisition is finalized.
   • BConduct a full NIST CSF assessment of the clinic, including developing a Current Profile, before making any integration decisions.
   • CUse a simplified questionnaire based on the CSF Categories to quickly gauge the clinic's maturity and identify high-risk gaps.
   • DSkip the assessment and rely on the clinic's existing security certifications.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small nonprofit organization wants to adopt the NIST CSF but has limited resources. The executive director asks the IT lead to create a Profile that reflects the organization's mission and risk tolerance. What is the most appropriate way to define the Profile for this organization?

   • ATailor the Profile by selecting only the Categories and Subcategories that are relevant to the nonprofit's mission and risk tolerance.
   • BAdopt the full CSF framework as the Profile to ensure maximum security coverage.
   • CUse the Profile from a similar-sized nonprofit as a template without modification.
   • DDefine the Profile as a list of security tools the organization plans to purchase.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A logistics company has a Current Profile that shows strong controls in the Protect function but weak controls in the Recover function. The company's leadership wants to prioritize investments that reduce downtime after a cyber incident. What should the security team do?

   • ADevelop a Target Profile that emphasizes Recover-related Subcategories and set higher target outcomes for them.
   • BFocus on the Detect function to identify incidents faster, which indirectly improves recovery.
   • CKeep the Current Profile unchanged and invest in Protect controls to prevent incidents from happening.
   • DCreate a Target Profile that lowers the Recover outcomes to match the Current Profile, reducing the gap.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A new CISO at a company is reviewing the existing NIST CSF Profiles. She notices that the Current Profile was created two years ago and the Target Profile has not been updated since then. The company's business has changed significantly, including a new line of online services. What is the most important action for the CISO to take?

   • AUpdate the Current Profile to reflect the new business environment, then reassess the Target Profile.
   • BDiscard both Profiles and start from scratch, as they are clearly outdated.
   • CKeep the existing Target Profile because it represents the desired state, which does not change with business changes.
   • DImmediately implement the existing Target Profile to catch up on the two-year gap.
   Reveal Solution Discussion Select an answer first