Security Frameworks and CIS Controls GSEC Practice Questions (Page 8)

Questions 36–39

1. 36expert · medium

   A hospital is implementing the CIS Controls and has completed the Basic controls. The security team is now deciding which Foundational controls to prioritize. They have limited budget and want to address the most significant risks, including ransomware and data breaches. Which Foundational control should they prioritize?

   • ASecurity awareness training, because it prevents phishing attacks.
   • BData recovery, because it ensures the organization can restore systems after a ransomware attack.
   • CPenetration testing, because it identifies vulnerabilities before attackers do.
   • DIncident response, because it helps manage breaches when they occur.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A financial services firm with a high-risk profile and ample resources is implementing the CIS Controls. They have already implemented IG1 and IG2 controls. They are now considering IG3. Which factor should be the primary driver for this decision?

   • AThe number of employees in the firm.
   • BThe firm's risk tolerance and capacity to implement advanced controls.
   • CThe desire to achieve compliance with industry standards.
   • DThe cost of implementing IG3 controls.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A retail company has experienced several ransomware attacks in the past year. The management wants to adopt a security framework that specifically helps mitigate the most common attack vectors. Which framework is most directly aligned with this goal?

   • ATOGAF, because it provides an enterprise architecture framework.
   • BISO 27001, because it provides a comprehensive information security management system.
   • CCOBIT, because it focuses on IT governance and control objectives.
   • DCIS Controls, because they are a prioritized set of actions to mitigate the most common cyber attacks.
   Reveal Solution Discussion Select an answer first
5. 39expert · medium

   A security manager is reviewing the organization's implementation of the CIS Controls. The organization has completed all Basic controls and is now working on Foundational controls. The manager notices that some Foundational controls are not fully implemented and wants to prioritize the remaining work. Which factor should be the primary consideration when prioritizing Foundational controls?

   • AThe order in which the controls are listed in the CIS Controls document.
   • BThe preferences of the security team members.
   • CThe organization's specific risk profile and the likelihood of each attack vector.
   • DThe cost of implementing each control.
   Reveal Solution Discussion Select an answer first