Question 1

Which of the following best describes the purpose of the Asset Management (ID.AM) category?

Options :

A : To audit and assess the efficiency of an organization-s cybersecurity measures

B : To provide financial resources for proposed cybersecurity improvements

C : To identify and manage all assets that support organizational objectives

D : To implement technical controls and defenses for digital and physical assets

Answer: C

Question 2

A company's IT department has identified an increase in phishing attacks targeting employees. To address this cybersecurity risk, what strategic action should be included in their comprehensive cybersecurity strategy?

Options :

A : Outsource all email management to a third-party provider without implementing additional security measures

B : Upgrade the physical security systems within company facilities

C : Decrease the frequency of network security audits to allocate more resources to training and other phishing defenses

D : Implement a continuous employee training program focused on recognizing and responding to phishing attempts

Answer: D

Question 3

Which of the following information security publications provides standards for cloud service providers' security measures and can be used to complement the NIST Cybersecurity Framework outcomes for cloud migrations and adoptions?

Options :

A : FedRAMP

B : PCI-DSS

C : HIPAA

D : OWASP

Answer: A

Question 4

In the context of cybersecurity investments, what does Total Cost of Ownership (TCO) encompass?

Options :

A : The price comparison between different cybersecurity vendors over time

B : The potential savings gained by preventing cybersecurity incidents over time

C : The calculation of all costs associated with a cybersecurity solution throughout its lifecycle

D : The initial purchase price of cybersecurity hardware and software only

Answer: C

Question 5

How do subcategories in the NIST Cybersecurity Framework assist organizations in managing their cybersecurity risks?

Options :

A : By mandating the types of cybersecurity training programs that must be conducted

B : By serving as independent compliance standards that organizations must follow

C : By providing a checklist of cybersecurity measures to be implemented immediately

D : By outlining specific actions to achieve the security outcomes of each framework category

Answer: D

Higher Test Marks with Free Online CRF-002 Exam Practice

Buying Options: