Security Frameworks and CIS Controls GSEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A startup company is building its security program from scratch. The founders want a framework that is easy to understand, provides a clear set of prioritized actions, and can be implemented incrementally as the company grows. Which framework best meets these requirements?

   • ACOBIT, because it provides detailed IT governance processes.
   • BNIST SP 800-53, because it is the most detailed control catalog.
   • CCIS Controls, because they are prioritized and can be implemented in phases.
   • DISO 27001, because it is the most widely recognized certification standard.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A global logistics company has operations in multiple countries and a mature security team. They have implemented IG1 and IG2 controls and are now considering IG3. However, they are concerned about the cost and effort required for IG3, and some executives question whether the additional controls are worth it. The company handles sensitive customer data and is subject to data protection regulations. Which consideration is most important when deciding whether to pursue IG3?

   • AThe geographic locations of the organization's offices.
   • BThe number of employees in the organization.
   • CThe organization's risk tolerance and the regulatory requirements it must meet.
   • DThe age of the organization's IT infrastructure.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large university with a decentralized IT structure and a moderate security budget is adopting the CIS Controls. They have implemented IG1 and IG2 controls but are struggling with resource allocation across departments. Which approach would best help them progress toward IG3?

   • ADefer IG3 until all IG2 controls are perfectly implemented.
   • BFocus only on technical controls and ignore organizational controls.
   • CCentralize security governance to ensure consistent implementation of advanced controls.
   • DAllow each department to independently decide which controls to implement.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A startup with 15 employees and no security team wants to implement the CIS Controls. They have a limited budget and need to prioritize actions that will have the most impact against common attacks. Which approach is most aligned with the CIS Controls framework?

   • ASkip technical controls and only implement security awareness training.
   • BFocus on IG1 controls, which address basic hygiene and common attacks.
   • CWait until they hire a security team before implementing any controls.
   • DImplement all 18 controls at once to ensure full coverage.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A small law firm with 40 employees has no dedicated security staff and a limited budget. They need to prioritize security actions that will mitigate the most common attacks. Which approach aligns with the CIS Controls framework for an organization with their resource constraints?

   • AImplement all 18 CIS Controls simultaneously to ensure comprehensive coverage.
   • BStart with the controls in Implementation Group 1 (IG1) that address basic hygiene, then expand as resources allow.
   • CAdopt only the Organizational controls because they are the most strategic and require no technical implementation.
   • DDefer all security work until a dedicated security team is hired.
   Reveal Solution Discussion Select an answer first