Understand the Concept of NIST CSF Organizational Profiles. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A university is developing a current profile for its research data environment. The team has limited time and must involve stakeholders from multiple departments. Which approach is most effective for creating an accurate current profile?

   • AGather evidence from each department about how they currently achieve each Subcategory outcome.
   • BCreate the current profile based on the target profile from a peer university.
   • CAsk the IT department to estimate the current state based on their knowledge.
   • DUse the previous year's audit report as the sole source of information.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A regional bank is adopting the NIST CSF 2.0. The board wants to understand how current cybersecurity activities compare to the level of protection needed to support the bank's new digital lending platform. The CISO decides to create Organizational Profiles. Which approach best supports the board's need?

   • ADevelop a current profile and a target profile, then use the difference to prioritize investments.
   • BUse the CSF's Quick-Start Guide to select a baseline profile and implement all its controls immediately.
   • CCreate a single profile that documents all existing cybersecurity controls and present it to the board.
   • DMap the bank's controls to the CSF Functions and report the number of controls per Function.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of using profiles to communicate with external stakeholders?

   • AUsing the profile to hire new security staff
   • BSharing the target profile with a business partner to demonstrate cybersecurity expectations
   • CUsing the profile to generate a list of security patches
   • DUsing the profile to configure firewall rules
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A healthcare provider is developing a target profile to support its expansion into telehealth services. The organization has a low risk tolerance for patient data breaches. Which consideration is most important when defining the target profile?

   • ASelecting the highest possible tier for every Subcategory to maximize security.
   • BAligning the target profile with the organization's business requirements and risk tolerance.
   • CUsing the same target profile as the current profile to avoid confusion.
   • DBasing the target profile on the current profile to ensure minimal change.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A retail company has completed its current and target profiles. The CISO needs to decide which cybersecurity improvements to fund first. Which use of the profiles provides the best basis for prioritization?

   • APrioritize gaps that align with the organization's risk management strategy and business objectives.
   • BImplement all gaps simultaneously to achieve the target profile faster.
   • CFocus only on gaps in the Protect Function because it is the largest.
   • DAddress gaps in the order they appear in the CSF document.
   Reveal Solution Discussion Select an answer first