Explain How Governmental Directives and Regulations Guidance Publications Like NIST CSF Help Influence the Design of Defense Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A multinational corporation has operations in the EU and the U.S. and must comply with GDPR and HIPAA. The security team is designing a defense architecture and has limited resources. The organization currently has a mature security program with formal processes and continuous improvement (Tier 3). Which approach best aligns with the organization's maturity and regulatory obligations?

   • AAdopt a unified security architecture that meets the most stringent requirements of both regulations
   • BImplement separate security architectures for each region to ensure compliance
   • CFocus on GDPR compliance only, as it is more recent
   • DDefer security architecture changes until regulators provide clearer guidance
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A government contractor is required to comply with FISMA and has adopted the NIST CSF. The current profile shows that the organization has implemented all mandatory FISMA controls, but the target profile includes additional CSF outcomes that are not required by FISMA. The security director must decide how to allocate resources. Which approach best balances compliance and risk management?

   • AImplement all CSF outcomes in the target profile, regardless of cost
   • BFocus exclusively on meeting FISMA requirements, as they are mandatory
   • CAbandon the NIST CSF and rely solely on FISMA compliance
   • DPrioritize CSF outcomes that address the highest risks and are not covered by FISMA controls
   Reveal Solution Discussion Select an answer first