Utilize Effective Communication Strategies to Convey Cybersecurity Risks. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A company's security team wants to ensure that cybersecurity risks are considered in all major business decisions. Which approach best integrates risk communication into the decision-making process?

   • ACreate a cybersecurity dashboard that is available to all employees.
   • BEstablish a process where risk assessments are communicated to decision-makers before major projects or changes are approved.
   • CHold an annual cybersecurity awareness day for all employees.
   • DSend a monthly cybersecurity report to the executive team.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A hospital's IT security team needs to communicate a new phishing threat to three groups: the board of directors, the clinical staff, and the IT helpdesk. What is the most effective way to tailor the communication?

   • AProvide a high-level summary to the board, practical examples for clinical staff, and technical indicators for the helpdesk.
   • BSend the same detailed technical report to all three groups to ensure consistency.
   • CFocus only on the clinical staff because they are most likely to click phishing links.
   • DCreate a single infographic with technical details and ask all groups to review it.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A retail company's security team identified a high-risk vulnerability in the payment processing system. The team needs to convince the executive committee to allocate budget for an immediate fix. What is the most effective way to present this risk?

   • AShow a slide with the CVSS score and a list of affected servers.
   • BPresent the potential financial impact of a data breach, including regulatory fines and customer loss.
   • CState that the vulnerability is critical and must be fixed immediately without further explanation.
   • DSend a technical report to the IT director and ask them to relay the information.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which stakeholder audience is most likely to require detailed technical information about a specific vulnerability, such as the affected software versions and patch details?

   • AThe board of directors
   • BNon-technical employees in the marketing department
   • CExternal auditors reviewing compliance
   • DIT security operations staff
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A multinational corporation is deciding whether to invest in a new security information and event management (SIEM) system. The CISO must present the business case to the board, which is concerned about cost. The technical team has provided detailed performance metrics. What is the most effective communication strategy for the CISO?

   • APresent the SIEM's technical capabilities, such as log ingestion rate and correlation rules, to demonstrate its superiority.
   • BFrame the investment in terms of reduced risk of a data breach, potential cost savings from faster detection, and alignment with regulatory requirements.
   • CAsk the technical team to present the detailed performance metrics directly to the board.
   • DEmphasize that the SIEM is the industry standard and that competitors are using it.
   Reveal Solution Discussion Select an answer first