Explain How Governmental Directives and Regulations Guidance Publications Like NIST CSF Help Influence the Design of Defense Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of the NIST Cybersecurity Framework (CSF)?

   • ATo offer voluntary guidance that helps organizations understand, communicate, and manage cybersecurity risk
   • BTo certify organizations as compliant with federal cybersecurity laws
   • CTo provide a mandatory set of security controls that all U.S. federal agencies must implement
   • DTo replace all existing cybersecurity standards and regulations with a single global framework
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm uses the NIST CSF to assess its cybersecurity posture. The current profile shows that the organization has strong endpoint protection but lacks centralized logging and monitoring. The target profile requires centralized logging to meet regulatory expectations. Which action best aligns with using NIST CSF profiles to inform defense capability design?

   • AReplace the endpoint protection solution with a new vendor
   • BPrioritize the deployment of a SIEM solution to address the gap between current and target profiles
   • CConduct a new risk assessment to redefine the target profile
   • DIncrease the budget for endpoint protection training
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization is implementing the NIST CSF and wants to ensure it can quickly identify and respond to security incidents. Which two CSF core functions should the organization focus on?

   • ARespond and Recover
   • BProtect and Recover
   • CDetect and Respond
   • DIdentify and Protect
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large financial institution is subject to GDPR and is adopting the NIST CSF. The security team has limited budget and must choose between two initiatives: (1) implementing a data loss prevention (DLP) solution to protect personal data, or (2) developing a formal incident response plan to meet GDPR breach notification requirements. The organization's current NIST CSF tier is Partial. Which initiative should be prioritized to best align with GDPR obligations and improve CSF maturity?

   • ADevelop the incident response plan first, as GDPR requires breach notification within 72 hours
   • BImplement the DLP solution first, as it directly protects personal data
   • CImplement both simultaneously, as they are equally important
   • DDefer both initiatives until the next fiscal year
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is considering adopting the NIST CSF, but the board is concerned about the effort required. The CISO explains that the framework is voluntary and can be tailored. Which statement best describes how the NIST CSF can be tailored to the organization's needs?

   • AThe framework must be implemented in its entirety to be effective
   • BOrganizations can select relevant categories and subcategories based on their risk profile
   • CThe framework is only applicable to critical infrastructure sectors
   • DThe framework mandates specific technologies and tools
   Reveal Solution Discussion Select an answer first