Security Frameworks and CIS Controls GSEC Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A technology startup is growing rapidly and needs to establish a security program. The founders are considering different security frameworks and want one that is flexible, widely adopted, and provides a common language for discussing security. They also want to be able to measure their security posture over time. Which framework best meets these needs?

   • ACOBIT, because it provides detailed IT governance processes.
   • BNIST Cybersecurity Framework, because it provides a common language and a flexible structure for improving security posture.
   • CCIS Controls, because they are a prioritized list of technical actions.
   • DISO 27001, because it is a certification standard that provides a common language.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is categorizing the CIS Controls for a report. Which control is correctly categorized as a Foundational control?

   • AContinuous Vulnerability Management
   • BInventory of Assets
   • CIncident Response Management
   • DPenetration Testing
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A non-profit organization with a small IT team wants to adopt the CIS Controls but is concerned about overwhelming their staff. They have limited budget and no dedicated security personnel. Which Implementation Group should they target?

   • AIG1, because it focuses on essential controls that address common attacks with minimal resources.
   • BIG3, because it provides the highest level of security.
   • CIG2, because it includes all controls needed for any organization.
   • DNone, because CIS Controls are only for large enterprises.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a well-known security framework that organizes security activities into five functions: Identify, Protect, Detect, Respond, and Recover?

   • ACOBIT
   • BNIST Cybersecurity Framework (CSF)
   • CCIS Controls
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A mid-sized manufacturing company has a small IT team and moderate risk tolerance. They have already implemented IG1 controls and now want to move to the next level of protection, especially for remote access and data protection. They have some budget for additional security measures but cannot yet justify a full security operations center. Which CIS Implementation Group should guide their next steps?

   • AIG2, which adds controls for organizations with more IT staff and greater sensitivity of data.
   • BIG3, because it provides the highest level of security and should be the goal for all organizations.
   • CSkip IG2 and implement only the Organizational controls from IG3.
   • DStay with IG1, because adding more controls will not reduce risk.
   Reveal Solution Discussion Select an answer first