Understand the Application of NIST CSF Profiles in Practical Scenarios. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A multinational corporation has a Current Profile that shows strong cybersecurity maturity in its European operations but weaker maturity in its Asian operations. The CISO must develop a Target Profile that balances global consistency with regional regulatory requirements. What is the best approach?

   • ACreate a single global Target Profile that sets the same target outcomes for all regions, overriding regional differences.
   • BCreate separate Target Profiles for each region with no common baseline.
   • CUse the European Current Profile as the global Target Profile, since it is the most mature.
   • DDevelop a global Target Profile as a baseline and allow regional variations where local regulations require higher or different outcomes.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A healthcare organization must comply with HIPAA, which requires safeguarding electronic protected health information (ePHI). The security team is developing a Target Profile to demonstrate compliance. Which approach best aligns the Target Profile with this regulatory requirement?

   • ACreate a Target Profile that includes only the five functions, ignoring Subcategories, to keep it simple.
   • BMap relevant HIPAA safeguards to CSF Subcategories and set target outcomes that meet or exceed those requirements.
   • CSet the Target Profile to the same level as the Current Profile to avoid overcommitting resources.
   • DUse the HIPAA Security Rule text as the Target Profile without mapping to CSF Subcategories.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the NIST CSF, what does a Profile represent?

   • AA set of mandatory implementation steps for each CSF function
   • BA snapshot of an organization's cybersecurity outcomes at a point in time
   • CA list of all security controls required by law
   • DA benchmark score comparing an organization to its industry peers
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of a NIST Cybersecurity Framework (CSF) Profile?

   • ATo replace the organization's existing security policies and standards
   • BTo align an organization's cybersecurity activities with its business requirements, risk tolerance, and resources
   • CTo provide a detailed step-by-step implementation guide for every security control
   • DTo certify that an organization meets all NIST CSF requirements
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A mid-sized retailer has completed both a Current and Target Profile. The security team must now communicate the results to the executive board to justify a proposed budget increase. What is the most effective way to use the Profiles in this communication?

   • APresent a side-by-side comparison of the Current and Target Profiles, highlighting the highest-priority gaps in business terms.
   • BProvide the full list of Subcategories in both Profiles and let the board infer the priorities.
   • CFocus only on the Target Profile and describe the desired future state without referencing the Current Profile.
   • DExplain that the Current Profile is sufficient and the Target Profile is only a theoretical exercise.
   Reveal Solution Discussion Select an answer first