Question 1

Which of the following information security publications provides standards for cloud service providers' security measures and can be used to complement the NIST Cybersecurity Framework outcomes for cloud migrations and adoptions?

Options :

A : FedRAMP

B : PCI-DSS

C : HIPAA

D : OWASP

Answer: A

Question 2

How do subcategories in the NIST Cybersecurity Framework assist organizations in managing their cybersecurity risks?

Options :

A : By mandating the types of cybersecurity training programs that must be conducted

B : By serving as independent compliance standards that organizations must follow

C : By providing a checklist of cybersecurity measures to be implemented immediately

D : By outlining specific actions to achieve the security outcomes of each framework category

Answer: D

Question 3

A technology company utilizes advanced encryption methods to secure data in transit and at rest to ensure that sensitive customer information is protected from unauthorized access and breaches. Which of the following subcategories in the NIST Cybersecurity Framework best supports this scenario for effectively managing the organization's security?

Options :

A : DE.CM-02

B : RS.CO-1

C : PR.DS-02

D : ID.IM-02

Answer: C

Question 4

A company's IT department has identified an increase in phishing attacks targeting employees. To address this cybersecurity risk, what strategic action should be included in their comprehensive cybersecurity strategy?

Options :

A : Outsource all email management to a third-party provider without implementing additional security measures

B : Upgrade the physical security systems within company facilities

C : Decrease the frequency of network security audits to allocate more resources to training and other phishing defenses

D : Implement a continuous employee training program focused on recognizing and responding to phishing attempts

Answer: D

Question 5

A startup is currently managing cybersecurity issues on an incident-by-incident basis without any predefined strategy. Most decisions are made spontaneously without consulting any established guidelines or standards. What tier best describes their cybersecurity implementation?

Options :

A : Tier 3 (Repeatable)

B : Tier 4 (Adaptive)

C : Tier 1 (Partial)

D : Tier 2 (Risk Informed)

Answer: C