Industry Best Practices, Guidance, Frameworks, and Standards CCOA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement accurately describes the structure of the ISO/IEC 27001 standard?

   • AIt is a framework that specifies requirements for an information security management system (ISMS)
   • BIt is a list of mandatory technical controls that must be implemented exactly as written
   • CIt is a certification that guarantees an organization is free from security breaches
   • DIt is a set of best practices for securing cloud environments only
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is investigating a potential data breach. The analyst needs to determine the scope of the incident and identify which assets were affected. The organization has a well-documented asset inventory and configuration management database (CMDB). Which practice is most directly supported by this documentation?

   • ARapidly identifying which systems and data were impacted
   • BPreventing the attacker from gaining initial access
   • CEliminating the need for forensic analysis
   • DAutomatically containing the breach
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of the NIST Cybersecurity Framework (CSF)?

   • ATo certify organizations as compliant with a single global standard
   • BTo provide a set of mandatory legal requirements for all organizations
   • CTo define a specific technology stack that all organizations must use
   • DTo offer a risk-based approach for improving cybersecurity across critical infrastructure and other sectors
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security architect is evaluating the NIST CSF and ISO 27001 to determine which to use for a new security program. The organization needs a framework that is flexible and can be adapted to its specific risk profile, but it also wants a framework that can be certified. Which conclusion is most accurate?

   • AUse neither framework because they are incompatible
   • BUse only ISO 27001 because it is more flexible than the NIST CSF
   • CUse the NIST CSF for risk management and ISO 27001 for certification
   • DUse only the NIST CSF because it is certifiable
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which recognized body publishes the ISO/IEC 27001 standard for information security management systems?

   • ACenter for Internet Security (CIS)
   • BInternational Organization for Standardization (ISO)
   • CInternational Electrotechnical Commission (IEC)
   • DNational Institute of Standards and Technology (NIST)
   Reveal Solution Discussion Select an answer first