Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A non-profit organization has a small IT team and wants to improve its security posture without adopting a heavy compliance program. They are considering the CIS Controls. Which characteristic of the CIS Controls makes them a good fit?

   • AThey are a regulatory requirement that all non-profits must follow.
   • BThey are a one-time project that, once completed, requires no further maintenance.
   • CThey are a certification scheme that guarantees compliance with international standards.
   • DThey are a prioritized set of actions that can be implemented incrementally based on the organization's resources.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security architect is comparing CIS Controls v7 and v8 to decide which to reference in a new security policy. The architect notes that v8 has fewer controls and is more streamlined. What is the primary reason for this consolidation?

   • ATo make the controls easier to memorize for certification exams.
   • BTo reduce redundancy and align controls with modern threats and technology changes.
   • CTo eliminate the need for implementation groups.
   • DTo align with a single regulatory standard.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturing company must comply with a customer contract that requires alignment with the NIST Cybersecurity Framework (CSF). The company has already implemented the CIS Controls v8. Which action best demonstrates that the CIS Controls satisfy the NIST CSF requirement?

   • AMap the implemented CIS Controls to the relevant NIST CSF functions and categories in the compliance documentation.
   • BReplace the CIS Controls with the NIST CSF because the contract requires NIST, not CIS.
   • CSubmit the CIS Controls implementation report without any mapping, since both are recognized by regulators.
   • DAdopt ISO/IEC 27001 instead, since it is an international standard that supersedes both NIST and CIS.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A government agency with a moderate risk profile has implemented all IG1 controls and is considering whether to implement IG2. The agency has limited budget but faces increasing cyber threats. The security director must justify the investment in IG2 to the budget office. Which argument is most compelling?

   • AIG2 controls are inexpensive and easy to implement.
   • BIG2 controls address the specific threats the agency faces and are necessary to reduce risk to an acceptable level.
   • CIG2 is the minimum for any organization that uses the CIS Controls.
   • DIG2 is required by law for all government agencies.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization has been using CIS Controls v7.1 for several years and has documented its implementation in detail. The security team is planning to transition to v8. The team is concerned about losing the detailed sub-control documentation they relied on. What is the best way to manage this transition?

   • AAdopt v8 but only for new projects, keeping v7.1 for existing systems.
   • BRecreate all documentation from scratch to align with v8.
   • CUse the CIS-provided mapping between v7.1 and v8 to update documentation and identify any new or changed safeguards.
   • DKeep using v7.1 because v8 does not provide the same level of detail.
   Reveal Solution Discussion Select an answer first