Utilize Effective Communication Strategies to Convey Cybersecurity Risks. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When communicating a cybersecurity risk to a non-technical executive, which approach is most appropriate?

   • AUse highly technical jargon to demonstrate the severity of the risk and gain credibility
   • BTranslate the risk into potential business impact, such as financial loss, operational downtime, or reputational damage
   • CFocus on the technical details of the vulnerability, such as the specific exploit chain and affected software versions
   • DProvide a detailed list of all affected systems and their IP addresses for their review
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A security team is communicating a new risk to the organization. The team wants to ensure the message is accurate and timely, but also wants to avoid causing unnecessary panic. Which approach best balances these concerns?

   • AWait until all details are confirmed before communicating anything.
   • BCommunicate a worst-case scenario to motivate immediate action.
   • CCommunicate only to the technical team and let them decide what to share.
   • DCommunicate the known facts immediately, clearly stating what is known and what is still under investigation.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A bank's security team identified a vulnerability in the mobile banking app that could allow unauthorized transactions. The team needs to communicate this to the product manager, who is responsible for the app's release schedule. What is the most effective way to communicate the risk?

   • AExplain the technical details of the vulnerability, including the affected code and exploit method.
   • BSend a copy of the vulnerability scan report and let the product manager interpret it.
   • CState that the vulnerability is critical and must be fixed immediately, without further explanation.
   • DDescribe the potential financial loss from unauthorized transactions and the reputational damage to the bank if the vulnerability is exploited.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A logistics company's security team identified a vulnerability that could allow attackers to reroute delivery trucks. The operations manager needs to decide whether to deploy a patch that will cause 2 hours of downtime. Which communication best supports the decision?

   • ASend a technical advisory to the IT team and let them decide.
   • BExplain that the vulnerability is a remote code execution in the GPS tracking module.
   • CState that the patch is critical and should be deployed immediately, regardless of downtime.
   • DDescribe the potential impact: attackers could reroute trucks, causing delayed deliveries and customer dissatisfaction, while the patch requires 2 hours of downtime.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A software development company needs to communicate a critical security update to its remote workforce. The update requires immediate action. Which communication method is most effective?

   • ACreate a detailed technical document and share it via the company's file-sharing service.
   • BWait for the next monthly all-hands meeting to announce the update.
   • CPost the update on the company's internal wiki page.
   • DSend an email with the subject line 'URGENT: Security Update Required' and clear instructions.
   Reveal Solution Discussion Select an answer first