A government contractor is required to comply with NIST SP 800-171 and wants to use a security framework to structure its security program. The contractor has a small security team and a limited budget. They need a framework that provides specific, prioritized controls that can be mapped to NIST SP 800-171 requirements. Which approach is most effective?

Implement NIST SP 800-171 directly, since it is the required standard.

Use ISO 27001, since it is internationally recognized and covers all necessary controls.

Adopt COBIT, since it provides comprehensive IT governance.

Use the CIS Controls as a baseline and map them to NIST SP 800-171 requirements.

A mid-sized e-commerce company processes customer payments and has a small security team. They want to use the CIS Controls to guide their security program. According to the CIS Implementation Groups, which group is most appropriate for this organization?

IG1, because they are not a large enterprise.

IG2, because they have moderate resources and handle sensitive data.

Any group works because the controls are identical.

IG3, because they process payments and must implement every control.

A security analyst is explaining the CIS Controls to a new team member. They note that the controls are grouped into categories. Which statement correctly describes the categories?

Foundational controls are optional and can be skipped if resources are tight.

Basic controls are the most advanced and require mature security programs.

The categories are independent and do not build on each other.

Organizational controls focus on management and governance activities.

A regional bank with a mature security program and a dedicated security team is adopting the CIS Controls. They have already implemented IG1 and IG2 controls. They are now considering additional controls to further reduce risk. Which factor should primarily guide their decision to move to IG3?

The organization's risk tolerance and available resources.

The need to comply with industry regulations.

The number of employees in the organization.

The desire to implement all 18 controls regardless of cost.

GIAC Security Essentials

Domain 1Objective 3

Security Frameworks and CIS Controls GSEC Practice Questions (Page 5)

Part of the Foundations of Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

5concepts

Questions 21–25

21expert · medium
A government contractor is required to comply with NIST SP 800-171 and wants to use a security framework to structure its security program. The contractor has a small security team and a limited budget. They need a framework that provides specific, prioritized controls that can be mapped to NIST SP 800-171 requirements. Which approach is most effective?
Select an answer first
22application · medium
A mid-sized e-commerce company processes customer payments and has a small security team. They want to use the CIS Controls to guide their security program. According to the CIS Implementation Groups, which group is most appropriate for this organization?
Select an answer first
23application · medium
A security analyst is explaining the CIS Controls to a new team member. They note that the controls are grouped into categories. Which statement correctly describes the categories?
Select an answer first
24foundation · easy
Which CIS Implementation Group is designed for organizations with limited cybersecurity expertise and resources, focusing on essential hygiene controls?
Select an answer first
25expert · hard
A regional bank with a mature security program and a dedicated security team is adopting the CIS Controls. They have already implemented IG1 and IG2 controls. They are now considering additional controls to further reduce risk. Which factor should primarily guide their decision to move to IG3?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Security Frameworks and CIS Controls GSEC Practice Questions (Page 5)

Questions 21–25

A mid-sized e-commerce company processes customer payments and has a small security team. They want to use the CIS Controls to guide their security program. According to the CIS Implementation Groups, which group is most appropriate for this organization?

A security analyst is explaining the CIS Controls to a new team member. They note that the controls are grouped into categories. Which statement correctly describes the categories?

Which CIS Implementation Group is designed for organizations with limited cybersecurity expertise and resources, focusing on essential hygiene controls?

A regional bank with a mature security program and a dedicated security team is adopting the CIS Controls. They have already implemented IG1 and IG2 controls. They are now considering additional controls to further reduce risk. Which factor should primarily guide their decision to move to IG3?

Keep studying — Foundations of Security