Security Frameworks and CIS Controls GSEC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A healthcare organization is required to comply with HIPAA and wants to use a security framework to structure its security program. The organization has a moderate budget and a small security team. They want a framework that provides specific, prioritized technical controls. Which framework is the best fit for their needs?

   • ACIS Controls, because they offer a prioritized set of technical actions that can help meet compliance requirements.
   • BNIST Cybersecurity Framework, because it is the only framework recognized by HIPAA.
   • CISO 27001, because it is a certification standard that guarantees compliance with HIPAA.
   • DCOBIT, because it focuses on IT governance and is required for healthcare organizations.
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   A large university with a decentralized IT structure is implementing the CIS Controls. Different departments have varying levels of security maturity and resources. The university wants to use the Implementation Groups to guide each department. Which approach is most appropriate?

   • AApply IG2 to all departments, since it is the middle ground.
   • BRequire all departments to implement IG3 to ensure uniform security across the university.
   • CLet each department choose its own Implementation Group without central oversight.
   • DApply IG1 as a baseline for all departments, and allow departments with higher risk and resources to implement IG2 or IG3.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A non-profit organization with 20 employees and no IT staff wants to improve its security posture. They have a very limited budget and need to focus on the most critical controls. Which CIS Implementation Group should they use as their baseline?

   • AIG1, because it is designed for organizations with limited resources and covers the essential controls.
   • BIG2, because it provides more comprehensive protection for sensitive data.
   • CNo Implementation Group, because the non-profit is too small to benefit from the CIS Controls.
   • DIG3, because it offers the highest level of security.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is reviewing the CIS Controls and wants to identify which controls are categorized as 'Organizational'. Which controls should they select?

   • AControls 17-18, such as Incident Response Management and Penetration Testing.
   • BControls 7-16, such as Continuous Vulnerability Management and Audit Log Management.
   • CControls 1-6, such as Inventory of Assets and Secure Configuration.
   • DAll controls are considered Organizational because they are part of the same framework.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which organization is responsible for developing and maintaining the CIS Controls?

   • AOpen Web Application Security Project (OWASP)
   • BNational Institute of Standards and Technology (NIST)
   • CInternational Organization for Standardization (ISO)
   • DCenter for Internet Security (CIS)
   Reveal Solution Discussion Select an answer first