Utilize Effective Communication Strategies to Convey Cybersecurity Risks. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A security analyst needs to inform non-technical employees about a new malware threat. Which message best follows the principles of clarity and relevance?

   • AA simple warning: 'Be cautious of email attachments from unknown senders. If you receive a suspicious attachment, do not open it and report it to IT.'
   • BA statistical analysis of the malware's infection rates across different industries.
   • CA detailed description of the malware's code obfuscation techniques and command-and-control infrastructure.
   • DAn email stating that 'a new malware variant is circulating' with no further details.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A company's security team identified a vulnerability that could allow attackers to access customer data. The team needs to decide whether to disclose the vulnerability publicly or keep it confidential while patching. The legal team is concerned about regulatory requirements. What is the most effective communication approach?

   • ACommunicate the risk to the board and legal team, presenting the regulatory requirements and the potential business impact of both disclosure and non-disclosure.
   • BDisclose the vulnerability to customers immediately, but do not inform the board or legal team.
   • CImmediately disclose the vulnerability publicly to be transparent, without waiting for the patch.
   • DKeep the vulnerability confidential until the patch is ready, and then disclose it without prior communication.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which communication channel is best suited for providing real-time updates on an ongoing cybersecurity incident to the incident response team?

   • AA dedicated chat channel or incident management platform
   • BA formal report sent via email at the end of the week
   • CA monthly newsletter
   • DA poster on the office notice board
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A university's IT department needs to communicate a new data protection policy to faculty, students, and administrative staff. What is the most effective approach?

   • ASend the same detailed policy document to all groups via email.
   • BHold a single town hall meeting for all groups and present the policy.
   • CPost the policy on the university's website and hope everyone reads it.
   • DCreate tailored messages: a summary for faculty, a simplified version for students, and a detailed procedure for administrative staff.
   Reveal Solution Discussion Select an answer first