Utilize Effective Communication Strategies to Convey Cybersecurity Risks. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After a security incident, an organization sends a communication to employees. To improve future incident communications, what should the organization do?

   • AConduct a post-incident review with employees to gather feedback on the communication's clarity and usefulness.
   • BReview the incident timeline to identify any delays in sending the communication.
   • CCompare the communication with industry best practices and make adjustments.
   • DAssume the communication was effective because no complaints were received.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company wants to improve its cybersecurity risk communication to employees. The team has identified that employees often ignore emails about security. What is the most effective way to improve engagement?

   • ASend more frequent emails with more detailed information.
   • BUse a variety of channels, such as short videos, infographics, and interactive quizzes, and solicit feedback on what employees find useful.
   • COnly communicate risks when they are critical to avoid overwhelming employees.
   • DMake the emails more technical to show the seriousness of the risks.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A global company needs to communicate a security policy change to employees in different regions. The change affects how employees handle personal data. What is the most effective communication strategy?

   • AHold a single global town hall meeting via video conference.
   • BCreate localized communications that consider language, cultural context, and regional regulatory requirements.
   • CPost the policy on the company intranet and rely on employees to read it.
   • DSend a single email to all employees with the policy change and a link to the full policy.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company's security team discovered a ransomware vulnerability in the production scheduling system. The CEO needs to decide whether to fund an emergency patch rollout. Which communication approach best supports the CEO's decision-making?

   • AExplain that the vulnerability could halt production for up to three days, costing an estimated $500,000 in lost revenue and recovery efforts.
   • BState that the vulnerability is critical and recommend immediate action without providing further details.
   • CSend a brief email to all employees warning them not to click suspicious links until the issue is resolved.
   • DProvide a detailed technical analysis of the vulnerability, including the exploit chain and affected code modules.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which communication method is most appropriate for providing a high-level overview of cybersecurity risks to a large group of non-technical employees?

   • AA technical webinar focused on the latest malware analysis techniques
   • BA short email summarizing key risks and recommended actions in plain language
   • CA one-on-one meeting with each employee to discuss their specific risk exposure
   • DA detailed technical report with network diagrams and exploit code
   Reveal Solution Discussion Select an answer first