Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A financial regulator is examining a bank's cybersecurity program. The bank has implemented the CIS Controls and uses them for internal risk management. The regulator asks how the bank demonstrates that its security controls are effective. Which practice best satisfies the regulator's expectation?

   • AExplain that the CIS Controls are a best-practice framework and therefore effective by default.
   • BShow the regulator the CIS Controls document and state that the bank follows it.
   • CProvide a list of security products purchased to support the controls.
   • DProvide evidence of continuous monitoring, testing, and reporting of CIS Controls implementation status to the board.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a major structural change introduced in CIS Controls v8 compared to v7.1?

   • AThe controls were renamed to align with ISO 27001 Annex A control names
   • BThe controls were consolidated from 20 to 18, and each control now includes implementation groups
   • CThe controls were reorganized into five functions: Identify, Protect, Detect, Respond, and Recover
   • DThe controls were expanded from 18 to 20, and each control now includes a separate set of sub-controls
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of Implementation Groups (IGs) in the CIS Controls?

   • ATo define mandatory compliance levels that organizations must achieve to avoid penalties
   • BTo categorize organizations by industry sector and apply sector-specific controls
   • CTo replace the need for risk assessments by providing a one-size-fits-all set of controls
   • DTo provide a tiered approach to implementation based on an organization's cybersecurity maturity and resources
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A hospital system is developing its annual cybersecurity strategy. The board wants to ensure that security investments align with patient safety and operational continuity. The CISO proposes using the CIS Controls as the foundation. Which action best demonstrates the integration of cybersecurity governance with organizational objectives?

   • AConduct a risk assessment and select CIS Controls based on the hospital's specific threats and regulatory requirements.
   • BAdopt the CIS Controls as a static checklist and review them annually without changes.
   • CImplement all CIS Controls immediately to achieve the highest possible security posture.
   • DDelegate all security decisions to the IT department to ensure technical expertise is applied.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In what way do the CIS Controls assist with compliance reporting?

   • AThey eliminate the need for external audits by providing self-certification
   • BThey provide a common language and set of metrics that can be used to demonstrate security posture to auditors and stakeholders
   • CThey are a regulatory requirement that mandates specific reporting formats
   • DThey automatically generate compliance reports for all regulatory frameworks
   Reveal Solution Discussion Select an answer first