Industry Best Practices, Guidance, Frameworks, and Standards CCOA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is building a security program from scratch and wants to use a framework that helps it prioritize a set of foundational security actions. The team wants a practical, prioritized list of controls to implement first. Which framework is most suitable for this purpose?

   • AMITRE ATT&CK
   • BNIST CSF
   • CCIS Controls
   • DISO 27001
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which standard is most directly applicable to an organization that handles personal data of individuals in the European Union?

   • AGeneral Data Protection Regulation (GDPR)
   • BNIST Cybersecurity Framework
   • CISO/IEC 27001
   • DPayment Card Industry Data Security Standard (PCI DSS)
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A cloud service provider wants to assure its customers that its data centers are physically secure and its operations are independently audited. Which standard or framework is most appropriate for this assurance?

   • ACIS Controls
   • BOWASP Top 10
   • CNIST CSF
   • DSOC 2
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security manager is choosing between two frameworks to guide the organization's security program. The organization needs to demonstrate compliance to a regulator and also wants a practical set of controls to implement. The manager must decide which framework to use as the primary driver. Which approach is most effective?

   • AUse only the NIST CSF and ignore other frameworks
   • BUse ISO 27001 as the primary framework and map CIS Controls to its Annex A controls
   • CUse only the CIS Controls and ignore formal standards
   • DUse only ISO 27001 and do not implement any specific technical controls
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is establishing a vulnerability management program. The security lead wants to adopt a best practice that is widely recognized and prioritized by industry guidance. Which approach should the lead recommend?

   • ADefer all patching until the next scheduled maintenance window
   • BPrioritize remediation based on the Common Vulnerability Scoring System (CVSS) and asset criticality
   • CFocus only on vulnerabilities that have public exploits
   • DPatch all vulnerabilities as soon as they are discovered, regardless of severity
   Reveal Solution Discussion Select an answer first