Question 1

Which of the following best describes the purpose of the Identity Management, Authentication, and Access Control (PR.AA) category in the NIST Cybersecurity Framework?

Options :

A : To monitor network traffic and detect unauthorized access

B : To control access through identity verification and permissions management

C : To secure physical entry points in information and data systems

D : To conduct cybersecurity training for all organizational administrators and employees

Answer: B

Question 2

A software company identifies a significant risk of source code leaks due to inadequate version control and employee access management. What key elements should be included in their risk management plan to address this issue effectively?

Options :

A : Increase general cybersecurity awareness training, especially social engineering attacks, for all employees.

B : Outsource source code development to external contractors to reduce internal risks

C : Implement robust version control systems and restrict access to sensitive information based on roles and responsibilities

D : Conduct a public relations campaign to reassure stakeholders about data security and emphasize cybersecurity training

Answer: C

Question 3

An aeronautical engineering firm works primarily with the Department of Defense and relies heavily upon semiconductors that are manufactured outside the United States. They are concerned about the risk or attack surface associated with foreign made semiconductors. Which of the following subcategories in the NIST Cybersecurity Framework covers the firm’s concern?

Options :

A : Asset Management

B : Risk Assessment

C : Data Security

D : Cybersecurity Supply Chain Risk Management

Answer: D

Question 4

Which of the following best describes the purpose of the Asset Management (ID.AM) category?

Options :

A : To audit and assess the efficiency of an organization-s cybersecurity measures

B : To provide financial resources for proposed cybersecurity improvements

C : To identify and manage all assets that support organizational objectives

D : To implement technical controls and defenses for digital and physical assets

Answer: C

Question 5

A financial services firm has established and documented cybersecurity policies and procedures that are consistently implemented across all branches. They conduct regular training sessions and audits to ensure that these practices are maintained and effective. What tier best describes their cybersecurity implementation?

Options :

A : Tier 1 (Partial)

B : Tier 2 (Risk Informed)

C : Tier 3 (Repeatable)

D : Tier 4 (Adaptive)

Answer: C

Confidently Practice Online with Free CRF-002 Exam Cram

Buying Options: