Security Frameworks and Governance CISA Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A security manager wants to evaluate whether a new security awareness program is effective. Which combination of metrics would provide the most comprehensive assessment?

   • ANumber of security policies updated and posters displayed
   • BNumber of training sessions held and budget spent
   • CPhishing simulation click rate and number of reported incidents
   • DTraining completion rate and employee satisfaction score
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is required to comply with a new regulation that mandates specific security controls. The company already follows the NIST Cybersecurity Framework. The compliance team wants to avoid duplicating efforts and create a single set of controls that satisfies both the regulation and the framework. What is the most efficient approach?

   • AMap the existing NIST CSF controls to the regulatory requirements and fill any gaps
   • BMaintain two completely separate and independent compliance programs
   • CWait for the regulator to provide a specific mapping
   • DImplement the regulatory controls and abandon the NIST CSF
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A government contractor must implement a set of security controls to protect controlled unclassified information (CUI) in its IT systems. The contract specifies compliance with a framework that is mandatory for federal agencies and their contractors. Which framework is the contractor most likely required to follow?

   • AISO/IEC 27001
   • BCIS Controls
   • CNIST SP 800-171
   • DCOBIT
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security manager is designing a security awareness program for a company with a highly diverse workforce, including remote workers, office staff, and executives. The program must be effective across all groups while respecting the fact that executives have very limited time. Which strategy best addresses these competing constraints?

   • AProvide a short, high-level module for executives and more detailed, role-specific modules for other staff
   • BProvide the same training to everyone but make it optional for executives
   • CExempt executives from all security training
   • DRequire all employees, including executives, to complete the same lengthy training module
   Reveal Solution Discussion Select an answer first