What is the primary purpose of the CIS Critical Security Controls?

To serve as a mandatory compliance standard that all organizations must adopt to meet legal requirements

To provide a detailed technical specification for implementing every possible security control

To replace all other cybersecurity frameworks and standards with a single universal approach

To provide a prioritized set of actions that organizations can take to defend against known cyber attacks

A government agency is required to report its security posture to a federal oversight body. The agency uses the CIS Controls and also references the NIST CSF. What is the most effective way to use both frameworks in its reporting?

Create two separate reports, one for each framework, without cross-referencing.

Report only the CIS Controls, since they are more specific than the NIST CSF.

Report only the NIST CSF, since it is the official federal framework.

Use the NIST CSF to organize the report by function, and map the CIS Controls to those functions to show implementation.

GIAC Critical Controls Certification

Domain 1Objective 1

Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 9)

Part of the Foundations and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 41–42

41foundation · easy
What is the primary purpose of the CIS Critical Security Controls?
Select an answer first
42application · medium
A government agency is required to report its security posture to a federal oversight body. The agency uses the CIS Controls and also references the NIST CSF. What is the most effective way to use both frameworks in its reporting?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 9)

Questions 41–42

What is the primary purpose of the CIS Critical Security Controls?

A government agency is required to report its security posture to a federal oversight body. The agency uses the CIS Controls and also references the NIST CSF. What is the most effective way to use both frameworks in its reporting?

Keep studying — Foundations and Governance