A security audit of the systems on a network must be performed to determine their compliance with security policies. Which control should be used for the audit?
APR.DS
BDE.CM
CRS.MI
DID.AM
0
Question 2
NIST Framework: Identify Function
0
Question 3
NIST Framework Overview
0
Question 4
NIST Framework: Identify Function
0
Question 5
NIST Framework: Identify Function
0
That's the end of the Preview
This exam has 60 community-verified practice questions. Create a free account to access all questions, comments, and explanations.
DRAG DROP -
Rank order the relative severity of impact to an organization of each plan, where "1" signifies the most impact and "4" signifies the least impact.
Select and Place:
Concerning a risk management strategy, what should the executive level be responsible for communicating?
ARisk mitigation
BRisk profile
CRisk tolerance
DAsset risk
What process is used to identify an organization's physical, digital, and human resource, as required in their Business Impact Analysis?
ARisk Management Strategy
BRisk Assessment
CRisk Treatment
DAsset Inventory
Refer to the exhibit.
What type of item appears in the second column of the table?
ASubcategory
BInformative Reference
CFunction
DTier
Question 6
NIST Framework: Recover Function
0
Question 12
NIST Framework Overview
Question 13
NIST Framework: Respond Function
Question 14
NIST Framework: Protect Function
Question 15
NIST Framework: Detect Function
Question 16
NIST Framework: Detect Function
Question 17
NIST Framework: Identify Function
Question 18
NIST Framework: Identify Function
Question 19
NIST Framework: Respond Function
Question 20
NIST Framework: Identify Function
Question 21
NIST Framework Overview
Question 22
NIST Framework: Protect Function
Question 23
NIST Framework: Detect Function
Question 24
NIST Framework: Identify Function
Question 25
NIST Framework: Recover Function
Question 26
NIST Framework: Detect Function
Question 27
NIST Framework: Respond Function
Question 28
NIST Framework: Respond Function
Question 29
NIST Framework: Identify Function
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ad
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Which document provides an implementation plan to recover business functions and processes during and after an event?
ABusiness Continuity Plan
BDisaster Recovery Plan
CRisk Assessment Strategy
DBusiness Impact Analysis
What are the four tiers of integration within the NIST Cybersecurity Framework?
ASelective, Repeatable, Partial, and Adaptive
BPartial, Risk Informed, Repeatable, and Adaptive
CCorrective, Risk Informed, Repeatable. and Adaptive
DRisk Informed, Selective, Repeatable, and Partial
What procedure is designed to enable security personnel to detect, analyze, contain, eradicate, respond, and recover from malicious computer incidents such as a denial-of-service attack?
ADisaster Recovery Plan
BEmergency Analysis Plan
CCrisis Communication Plan
DIncident Response Plan
What determines the technical controls used to restrict access to USB devices and help prevent their use within a company?
ABlock use of the USB devices for all employees
BWritten security policy prohibiting the use of the USB devices
CAcceptable use policy in the employee HR on-boarding training
DDetect use of the USB devices and report users
What supports an organization in making risk management decisions to address their security posture in real time?
ABaseline reporting
BContinuous monitoring
CUser access reviews
DVideo surveillance
When should event analysis be performed?
AOnly when requested by an auditor
BRoutinely for all events collected on a mission critical system
COnly at the discretion of an authorized security analyst
DAfter an event is triggered by the detection system
What type of system processes information, the loss of which would have a debilitating impact to an organization?
AMission critical
BSecurity critical
CBusiness critical
DSafety critical
Which mechanism within the NIST Cybersecurity Framework describes a method to capture the current state and define the target state for understanding gaps, exposure, and prioritize changes to mitigate risk?
AFunctions
BProfiles
CTiers
DCategories
The CSF recommends that the Communication Plan for an IRP include audience, method of communication, frequency, and what other element?
AIncident category
BMessage criteria
CIncident severity
DTemplates to use
What is the main goal of a gap analysis in the Identify function?
ADetermine security controls to improve security measures
BDetermine actions required to get from the current profile state to the target profile state
CIdentify gaps between Cybersecurity Framework and Cyber Resilient Lifecycle pertaining to that function
DIdentify business process gaps to improve business efficiency
What does a security benchmark help define?
AWhether or not the organization should implement ISCM
BThe Baseline, or "as is" state
CWhich step of the DRP to execute first
DWhat parts of the Baseline are appropriate
In which function is the SDLC implemented?
ARespond
BProtect
CDetect
DRecover
Which category addresses the detection of unauthorized code in software?
APR.DS
BDE.DP
CPR.AT
DDE.CM
What database is used to record and manage assets?
AConfiguration Management Database
BAsset Inventory Management Database
CHigh Availability Mirrored Database
DPatch Management Inventory Database
The CSIRT team is following the existing recovery plans on non-production systems in a PRE-BREACH scenario. This action is being executed in which function?
AProtect
BRecover
CIdentify
DRespond
What is a consideration when performing data collection in Information Security Continuous Monitoring?
AData collection efficiency is increased through automation.
BThe more data collected, the better chances to catch an anomaly.
CCollection is used only for compliance requirements.
DData is best captured as it traverses the network.
An organization has a policy to respond "ASAP" to security incidents. The security team is having a difficult time prioritizing events because they are responding to all of them, in order of receipt.
Which part of the IRP does the team need to implement or update?
AScheduling of incident responses
B"˜Post mortem' documentation
CClassification of incidents
DContainment of incidents
Your firewall blocked several machines on your network from connecting to a malicious IP address. After reviewing the logs, the CSIRT discovers all Microsoft
Windows machines on the network have been affected based on a newly published CVE.
Based on the IRP, what should be done immediately?
AUpdate the asset inventory
BContain the breach
CEradicate the breach
DRevise the IRP
Which NIST Cybersecurity Framework function should be executed before any others?