Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A medium-sized financial services firm has a mature security program and has implemented all IG1 and IG2 controls. The firm is considering whether to pursue IG3 implementation. The board is concerned about the cost and effort required. The CISO must decide whether IG3 is necessary. Which factor should most influence the decision?

   • AThe number of security staff, because IG3 requires a minimum headcount.
   • BThe firm's budget, because IG3 is only worthwhile if it is inexpensive.
   • CThe size of the firm, because IG3 is only for large enterprises.
   • DThe firm's risk appetite, threat landscape, and regulatory requirements, which may justify the additional investment in IG3.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A new cybersecurity analyst is reading the CIS Controls v8 document and notices that each control has multiple 'Safeguards'. What is the purpose of this structure?

   • ASafeguards break each control into specific, actionable steps that can be implemented and measured individually.
   • BSafeguards are only for organizations that have achieved IG3 status.
   • CSafeguards replace the need for the control itself, so you can implement safeguards instead of controls.
   • DSafeguards are optional recommendations that are not necessary for compliance.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A startup with 50 employees and a single IT generalist is adopting the CIS Controls. They have a low risk profile but handle some customer data. The founder wants to know which Implementation Group they should target. What is the most appropriate guidance?

   • ATarget IG1, which provides a baseline of essential safeguards suitable for organizations with limited security resources.
   • BTarget IG2, since the startup has some customer data and needs more than the baseline.
   • CTarget IG3, because handling customer data requires the highest level of security.
   • DSkip Implementation Groups and implement all 18 controls at once to ensure full coverage.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A small regional bank with 200 employees and a limited IT staff is adopting the CIS Controls. They have no dedicated security team and need to prioritize actions that address the most common attack techniques with the least overhead. Which approach aligns with the CIS Controls guidance?

   • AAdopt the latest CIS Controls version in full, regardless of implementation group, to ensure completeness.
   • BImplement all IG1 safeguards first, then move to IG2 and IG3 as resources allow.
   • CImplement only the CIS Controls that map to regulatory requirements, skipping the rest.
   • DBegin with IG3 safeguards to achieve the highest possible security posture immediately.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A consulting firm is helping a client that already has ISO/IEC 27001 certification. The client now wants to adopt the CIS Controls to improve its technical safeguards. What is the best way to describe the relationship between ISO 27001 and the CIS Controls?

   • AThe CIS Controls replace ISO 27001, so the client should drop its certification.
   • BISO 27001 and the CIS Controls are competing standards, and an organization must choose one exclusively.
   • CISO 27001 provides a management system framework, while the CIS Controls offer specific technical safeguards that can complement it.
   • DThe CIS Controls are a subset of ISO 27001, so certification automatically means full CIS implementation.
   Reveal Solution Discussion Select an answer first