Explain How Governmental Directives and Regulations Guidance Publications Like NIST CSF Help Influence the Design of Defense Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A regional hospital must comply with HIPAA and has adopted the NIST CSF to guide its security program. The security team is designing a new capability to detect unauthorized access to electronic protected health information (ePHI). According to the NIST CSF core functions, which capability area does this requirement map to?

   • ADeveloping an incident response playbook for data breaches
   • BImplementing role-based access control (RBAC) on the EHR system
   • CDeploying a SIEM with alerts for anomalous access patterns to ePHI systems
   • DConducting a business impact analysis for ePHI systems
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A U.S. federal agency is required to comply with FISMA. The agency is designing its security architecture and must ensure that information systems are categorized and that security controls are implemented based on that categorization. Which defense capability design approach is most directly influenced by FISMA?

   • AImplementing a continuous monitoring program aligned with the system categorization
   • BImplementing multi-factor authentication for all users
   • CDeploying a SIEM to meet industry best practices
   • DAdopting a voluntary cybersecurity framework for risk management
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the NIST Cybersecurity Framework, which core function is primarily associated with developing and implementing safeguards to limit or contain the impact of a cybersecurity event?

   • AIdentify
   • BRespond
   • CProtect
   • DDetect
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A mid-sized company is considering adopting the NIST CSF to improve its cybersecurity risk management. The board of directors asks how the framework will help the company prioritize security investments. Which characteristic of the NIST CSF best supports this use case?

   • AIt prescribes specific technologies that must be implemented
   • BIt is a mandatory regulatory requirement for all industries
   • CIt provides a common language for communicating cybersecurity risk
   • DIt replaces the need for a formal risk management program
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of how a governmental directive or regulation can influence the design of defense capabilities?

   • AA regulation requiring encryption of personal data leads an organization to implement data encryption controls
   • BA directive that eliminates the need for security monitoring
   • CA regulation requiring a specific brand of firewall
   • DA regulation that only applies to private companies, not public sector
   Reveal Solution Discussion Select an answer first