Understand the Need for Awareness and Training. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can leadership support help foster a security-conscious culture?

   • ABy keeping security policies confidential from employees
   • BBy providing security training only to executives
   • CBy modeling secure behaviors and prioritizing security in decision-making
   • DBy delegating all security responsibilities to the IT department
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A mid-sized law firm wants to foster a security-conscious culture. The managing partner is skeptical about the value of security training and rarely participates. The IT manager believes that leadership support is critical. Which action would most effectively integrate security awareness into the firm's culture?

   • AHave the managing partner record a short video endorsing the training program and participate in the first session.
   • BOutsource all security training to an external provider and only track completion rates.
   • CMake security training mandatory for all staff, but exempt partners to avoid disrupting their billable hours.
   • DFocus training only on new hires during onboarding and rely on their good habits to influence existing staff.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A university is developing a security awareness program for its diverse community, including faculty, students, and external researchers. Each group has different levels of access and risk. What is the best way to structure the training?

   • ARequire all groups to complete the same online module annually, but allow faculty to skip the quiz.
   • BProvide a single, comprehensive training course for all groups to ensure everyone receives the same information.
   • CCreate separate training tracks: faculty focus on research data protection and phishing, students on account security and safe browsing, and researchers on data sharing and compliance.
   • DOffer training only to faculty and researchers, as students are not permanent staff and pose less risk.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the NIST Cybersecurity Framework's PROTECT function, what is the primary purpose of an awareness and training program?

   • ATo satisfy regulatory compliance without changing employee behavior
   • BTo reduce human-related security risks by ensuring personnel understand and follow security policies and practices
   • CTo replace technical security controls with human vigilance
   • DTo ensure that all employees have the technical skills to configure security tools
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company is designing its annual security awareness curriculum. The security manager wants to ensure the training covers the most relevant topics for reducing human-related risks in a production environment. Which set of topics should be prioritized?

   • ANetwork architecture, firewall configuration, and intrusion detection system tuning.
   • BBudgeting for security tools, vendor contract negotiation, and procurement policies.
   • CPhishing and social engineering recognition, safe handling of sensitive data, and reporting suspicious activity.
   • DIncident response procedures, business continuity planning, and disaster recovery testing.
   Reveal Solution Discussion Select an answer first