I85PREP
⌘ K
NIST Cybersecurity Foundation study materials
NIST Cybersecurity Foundation study resources

NIST Cybersecurity Foundation practice questions

One question at a time. Build your NIST Cybersecurity Foundation understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1NIST Cybersecurity Framework fundamentals

In the NIST Cybersecurity Framework, what is the role of the Framework Core?

  1. It is a list of mandatory technical controls drawn directly from NIST SP 800-53.
  2. It is a maturity scoring questionnaire that organizations must submit to NIST for certification.
  3. It is a governance charter that assigns legal liability for breaches to executives.
  4. It sets out a taxonomy of cybersecurity outcomes organized by Functions, Categories, Subcategories and Informative References. Correct answer.

Explanation

The Framework Core is the taxonomy of desired cybersecurity outcomes, arranged by Functions, then Categories and Subcategories, with Informative References pointing to standards and guidance. It is descriptive rather than a mandatory control catalog or a certification instrument.

Question 2NIST Cybersecurity Framework fundamentals

Which pairing correctly matches a Framework Function with its purpose?

  1. DETECT: develop and implement appropriate safeguards to ensure delivery of critical services.
  2. PROTECT: restore any capabilities or services impaired by a cybersecurity incident.
  3. IDENTIFY: develop organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities. Correct answer.
  4. RECOVER: analyze data to discover and characterize anomalous activity.

Explanation

IDENTIFY is about building organizational understanding of cybersecurity risk across systems, people, assets, data and capabilities. The other Functions have distinct purposes: PROTECT safeguards delivery, DETECT finds and analyzes events, and RECOVER restores capabilities.

Question 3NIST Cybersecurity Framework fundamentals

What does the Framework Implementation Tier describe?

  1. The contractual obligations an organization owes to its software vendors.
  2. The set of regulatory penalties applied when Subcategories are unmet.
  3. The degree to which an organization's cybersecurity risk management practices exhibit the characteristics defined in the Framework. Correct answer.
  4. The chronological order in which the five Functions must be executed during an incident.

Explanation

Tiers characterize how rigorous and informed an organization's cybersecurity risk management is, ranging from Partial through Adaptive. They express maturity of practice, not vendor obligations, incident sequencing, or penalties.

Question 4NIST Cybersecurity Framework fundamentals

What is the purpose of a Framework Profile?

  1. It records the exact configuration baseline of every server in the estate.
  2. It documents the results of a penetration test for auditors.
  3. It replaces the Framework Core with a vendor-specific control set.
  4. It describes the alignment of an organization's cybersecurity outcomes with its business needs, risk tolerance and resources. Correct answer.

Explanation

A Profile represents the alignment of Functions, Categories and Subcategories with business requirements, risk tolerance and resources, and can be used to describe current and target states. It is not a configuration baseline or a test report.

Question 5NIST Cybersecurity Framework fundamentals

Which statement best characterizes the NIST Cybersecurity Framework's relationship to other standards?

  1. It prohibits the use of sector-specific frameworks alongside its Functions.
  2. It requires adoption of NIST SP 800-53 in full before a Profile can be created.
  3. It is designed to be complementary, using Informative References to point to standards, guidelines and practices. Correct answer.
  4. It supersedes and invalidates ISO/IEC 27001 for organizations that adopt it.

Explanation

The Framework is intended to be complementary to existing standards and best practices, and its Informative References map Subcategories to those sources. Adoption does not invalidate other frameworks or mandate a specific control catalog.

Question 6NIST Cybersecurity Framework fundamentals

Which Framework Function was added in the Framework's evolution to address unauthorized access and use of systems and data?

  1. IDENTIFY
  2. PROTECT
  3. GOVERN Correct answer.
  4. RECOVER

Explanation

GOVERN was introduced to emphasize organizational context, risk management strategy, supply chain risk, roles and oversight. The original five Functions (IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER) remain and are complemented by GOVERN.

Question 7NIST Cybersecurity Framework fundamentals

An organization wants to express where it stands today versus where it intends to be on cybersecurity outcomes. Which Framework construct should it use?

  1. Subcategory and Category
  2. Framework Core and Informative References
  3. Current Profile and Target Profile Correct answer.
  4. Implementation Tier 1 and Tier 4

Explanation

Current and Target Profiles are the standard way to describe present outcomes and desired outcomes, enabling gap analysis and prioritization. Tiers describe maturity characteristics, while Core elements are the taxonomy itself.

Question 8NIST Cybersecurity Framework fundamentals

A hospital uses the Framework to prioritize improvements but must also satisfy a healthcare-specific regulatory framework. What is the most appropriate approach?

  1. Map the regulatory requirements to Framework Subcategories and use Informative References to document the linkage. Correct answer.
  2. Adopt only the PROTECT Function since regulation focuses on safeguards.
  3. Create a new custom Function to hold the regulatory requirements.
  4. Abandon the Framework because a sector framework already exists.

Explanation

The Framework is designed to be complementary; organizations commonly map sector or regulatory requirements to Subcategories and record the sources as Informative References. This preserves a single outcome taxonomy while satisfying external obligations.

Question 9NIST Cybersecurity Framework fundamentals

Which activity best demonstrates the IDENTIFY Function in practice?

  1. Restoring systems from backups after ransomware encryption.
  2. Maintaining an inventory of assets and documenting the organization's risk management strategy. Correct answer.
  3. Deploying endpoint detection and response tooling across servers.
  4. Running a tabletop exercise to test the incident response plan.

Explanation

IDENTIFY covers understanding the business context and the resources that support critical functions, including asset inventories and risk management strategy. Tooling deployment, exercises and restoration belong to other Functions.

Question 10NIST Cybersecurity Framework fundamentals

An organization's leadership wants a repeatable way to discuss how formal and adaptable its cybersecurity risk practices are, without claiming compliance. Which construct fits best?

  1. Implementation Tiers Correct answer.
  2. Informative References
  3. Target Profile
  4. Framework Core Subcategories

Explanation

Implementation Tiers provide a qualitative way to describe how risk management practices exhibit Framework characteristics, from informal and reactive to adaptive. They support discussion of rigor and integration with organizational risk decisions rather than compliance claims.

Question 11NIST Cybersecurity Framework fundamentals

Which statement about the Framework's Informative References is accurate?

  1. They are the numeric identifiers assigned to Categories within a Function.
  2. They are the maturity levels used to score Tier achievement.
  3. They are legally binding citations that create audit obligations.
  4. They are mappings that show which standards, guidelines or practices illustrate each Subcategory. Correct answer.

Explanation

Informative References are the section of the Core that identifies relevant standards, guidelines and practices for each Subcategory, helping organizations operationalize outcomes. They are informative, not binding, and are not identifiers or tier scores.

Question 12NIST Cybersecurity Framework fundamentals

A small business cannot implement every Subcategory at once. What does the Framework suggest for prioritization?

  1. Implement only those Subcategories that appear in Informative References.
  2. Wait until a Tier 4 assessment is complete before implementing anything.
  3. Use a risk-informed Target Profile to select outcomes based on business needs, risk tolerance and resources. Correct answer.
  4. Implement Subcategories strictly in alphabetical order of their identifiers.

Explanation

The Framework encourages prioritization through Profiles, selecting outcomes that reflect business needs, risk tolerance and available resources. Ordering by identifier, restricting to referenced items, or waiting for maturity are not part of the guidance.

Question 13NIST Cybersecurity Framework fundamentals

Which Framework Function encompasses anomaly and event detection together with continuous monitoring of networks and systems?

  1. RESPOND
  2. DETECT Correct answer.
  3. GOVERN
  4. PROTECT

Explanation

DETECT covers developing and implementing activities to identify the occurrence of a cybersecurity event, including continuous monitoring and anomaly analysis. PROTECT applies safeguards, RESPOND acts on detected incidents, and GOVERN sets organizational context.

Question 14NIST Cybersecurity Framework fundamentals

During an incident, a team executes its response plan, communicates with stakeholders and applies containment measures. Which Framework Function is being performed?

  1. RESPOND Correct answer.
  2. RECOVER
  3. IDENTIFY
  4. DETECT

Explanation

RESPOND covers the activities to take action regarding a detected cybersecurity incident, including response planning, communications, analysis, mitigation and improvements. RECOVER concerns restoration, DETECT concerns discovery, and IDENTIFY concerns understanding.

Question 15NIST Cybersecurity Framework fundamentals

How do Categories and Subcategories relate within the Framework Core?

  1. Categories group related cybersecurity outcomes within a Function, and Subcategories divide each Category into specific outcomes. Correct answer.
  2. Subcategories are maturity scores, while Categories are the Functions they belong to.
  3. Categories and Subcategories are interchangeable labels for the same outcome set.
  4. Subcategories group Functions, and Categories divide Subcategories into specific outcomes.

Explanation

The Core is hierarchical: Functions contain Categories, which group related outcomes, and each Category is divided into Subcategories that state specific technical and management outcomes. They are not interchangeable, and neither is a maturity score.

Question 16NIST Cybersecurity Framework fundamentals

An organization has documented policies and risk strategy but applies them inconsistently and without organization-wide awareness. Which Tier description is most consistent with the Framework's tier characteristics?

  1. Tier 4 (Adaptive)
  2. Tier 2 (Risk Informed)
  3. Tier 3 (Repeatable)
  4. Tier 1 (Partial) Correct answer.

Explanation

Tier 1 (Partial) describes informal, ad hoc practices with limited awareness and no organization-wide approach. Higher Tiers reflect approved and formally communicated practices, repeatable application, and finally adaptive learning from experience.

Question 17NIST Cybersecurity Framework fundamentals

Which statement about the Framework's applicability to an organization's supply chain is most accurate?

  1. The Framework includes outcomes addressing supply chain risk management, and GOVERN emphasizes related roles and oversight. Correct answer.
  2. The Framework excludes supply chain concerns because they belong only to procurement.
  3. Supply chain partners must be certified against the Framework before contracts are signed.
  4. Supply chain risk is addressed only within the RECOVER Function.

Explanation

The Framework includes supply chain risk management outcomes, and the GOVERN Function emphasizes organizational context, roles and oversight for supply chain risk. It does not exclude the topic, restrict it to RECOVER, or impose certification.

Question 18NIST Cybersecurity Framework fundamentals

A team argues that because it achieved a high Implementation Tier, its Target Profile is complete. Which critique is most consistent with the Framework?

  1. The argument is invalid because Profiles are only created after an incident.
  2. The argument is valid because Tiers and Profiles are two names for the same assessment.
  3. Tiers and Profiles are distinct constructs; a Tier describes practice characteristics while a Profile describes aligned outcomes. Correct answer.
  4. The argument is valid only if the organization used Informative References.

Explanation

Tiers and Profiles answer different questions: Tiers describe the characteristics of risk management practice, while Profiles describe the outcomes an organization has selected and achieved. High maturity in practice does not by itself define or complete a Target Profile.

Question 19NIST Cybersecurity Framework fundamentals

Which of the following is the best example of an outcome expressed at the Subcategory level?

  1. A statement that asset inventories are maintained and leveraged to inform risk decisions. Correct answer.
  2. A statement that the organization has a GOVERN Function.
  3. A statement that the organization reached Tier 3.
  4. A statement that the organization adopted a specific vendor's SIEM product.

Explanation

Subcategories state specific outcomes, such as maintaining and using asset inventories to inform risk decisions. Functions and Tiers are higher-level constructs, and product selection is an implementation choice rather than a Framework outcome.

Question 20NIST Cybersecurity Framework fundamentals

What is the primary benefit of developing a Target Profile before selecting security tools?

  1. It automatically assigns Implementation Tiers to each department.
  2. It removes the need to reference any external standards.
  3. It guarantees that no security incidents will occur after implementation.
  4. It defines the desired outcomes and gaps so tool selection can be justified against business needs and risk. Correct answer.

Explanation

A Target Profile states desired outcomes informed by business needs and risk tolerance, enabling gap analysis that guides and justifies investment decisions. It does not eliminate incidents, replace standards, or assign Tiers automatically.

Question 21NIST Cybersecurity Framework fundamentals

Which statement about the Framework's use by critical infrastructure sectors is accurate?

  1. It applies only to federal agencies and excludes private operators.
  2. It prescribes a single control baseline identical for every sector.
  3. It was developed for voluntary use and offers a common language adaptable across sectors. Correct answer.
  4. It mandates reporting of all incidents to a central authority.

Explanation

The Framework was designed for voluntary adoption and provides a common taxonomy that sectors can tailor through Profiles. It does not mandate incident reporting, exclude private operators, or impose a single baseline.

Question 22NIST Cybersecurity Framework fundamentals

How does the GOVERN Function relate to the other Functions?

  1. It provides organizational context, strategy and oversight that inform how the other Functions are performed. Correct answer.
  2. It is executed only after RECOVER is complete.
  3. It replaces the IDENTIFY Function entirely.
  4. It applies solely to third-party suppliers.

Explanation

GOVERN establishes and monitors the organizational context, risk management strategy, roles, policy and oversight that shape the performance of all other Functions. It complements rather than replaces IDENTIFY and is not sequential or supplier-only.

Question 23NIST Cybersecurity Framework fundamentals

An organization maps each Subcategory in its Target Profile to the specific internal policy or standard that satisfies it. Which part of the Framework structure is it using?

  1. Informative References Correct answer.
  2. Implementation Tiers
  3. Current Profile
  4. Framework Functions

Explanation

Informative References link Subcategories to standards, guidelines and practices that illustrate how outcomes can be achieved. Mapping internal policies to Subcategories follows this pattern rather than using Tiers, Functions or a Current Profile.

Question 24NIST Cybersecurity Framework fundamentals

Which statement best explains why the Framework is described as outcome-based rather than prescriptive?

  1. It states what cybersecurity outcomes should be achieved while leaving how to achieve them to the organization. Correct answer.
  2. It lists a fixed set of products that must be purchased to achieve each Function.
  3. It requires a specific organizational reporting structure for cybersecurity.
  4. It mandates identical Subcategory wording in every sector's regulation.

Explanation

The Framework focuses on outcomes and leaves implementation choices, technologies and processes to the organization, guided by its risk tolerance and resources. It does not prescribe products, reporting structures or identical regulatory wording.

Question 25NIST Cybersecurity Framework fundamentals

A risk team wants to demonstrate continuous improvement in its cybersecurity program using Framework constructs. Which approach best fits?

  1. Report only the number of Subcategories listed in the Core.
  2. Freeze the Current Profile permanently once it matches the Target Profile.
  3. Replace the Target Profile with the Core after each assessment.
  4. Compare Current and Target Profiles periodically and adjust practices, documenting changes in Tiers as rigor increases. Correct answer.

Explanation

Continuous improvement is supported by repeatedly comparing Current and Target Profiles, closing gaps and reassessing practice characteristics as reflected in Tiers. Freezing profiles or counting Core entries does not demonstrate improvement.

Question 26NIST Cybersecurity Framework fundamentals

The NIST Cybersecurity Framework was originally issued under which authority, which shaped its voluntary, critical-infrastructure focus?

  1. The Federal Information Security Modernization Act for federal agencies
  2. The Health Insurance Portability and Accountability Act privacy rule
  3. The Sarbanes-Oxley Act's internal control provisions
  4. Executive Order 13636 on improving critical infrastructure cybersecurity Correct answer.

Explanation

The Framework grew out of Executive Order 13636, which directed NIST to work with stakeholders to develop a voluntary framework to reduce cyber risk to critical infrastructure. That origin explains why the Framework is voluntary and infrastructure-oriented rather than a mandatory federal audit standard. FISMA, SOX, and HIPAA are separate legal regimes with their own scopes.

Question 27NIST Cybersecurity Framework fundamentals

Which three components make up the structure of the NIST Cybersecurity Framework as originally published?

  1. The Risk Register, the Control Catalog, and the Audit Log
  2. The Policy Layer, the Procedure Layer, and the Evidence Layer
  3. The Framework Core, the Implementation Tiers, and the Profiles Correct answer.
  4. The Maturity Model, the Scorecard, and the Roadmap

Explanation

The Framework is organized into three parts: the Core (Functions, Categories, Subcategories, and Informative References), the Implementation Tiers, and the Profiles. These parts are designed to be used together to describe outcomes, gauge rigor of risk management, and express current and target states. The other groupings are invented and do not appear in the Framework.

Question 28NIST Cybersecurity Framework fundamentals

Within the Framework Core, what does a Subcategory represent?

  1. A specific outcome tied to a Category that supports achievement of the Function Correct answer.
  2. A vendor product that must be purchased to meet the Function
  3. A staffing level required to operate a security operations center
  4. A legal penalty assigned for failing to meet a Category

Explanation

Subcategories break Categories into specific, actionable outcomes that together support the parent Function. They are the most granular level of the Core and are often used to compare current and target states. They describe outcomes, not products, penalties, or staffing quotas.

Question 29NIST Cybersecurity Framework fundamentals

How many Functions does the current Framework Core define, and which one was added to address governance and supply chain risk?

  1. Six Functions, with ASSESS added to the original five
  2. Five Functions, with GOVERN added to the original four Correct answer.
  3. Three Functions, with MONITOR added to the original two
  4. Four Functions, with PROTECT added to the original three

Explanation

The original Core defined five Functions, and the current version added GOVERN, yielding six: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER. GOVERN addresses organizational context, risk strategy, roles, policy, and supply chain risk management. The other counts and names do not match the published Core.

Question 30NIST Cybersecurity Framework fundamentals

An organization wants to describe the cybersecurity outcomes it has currently achieved across all Functions. Which Framework construct should it build?

  1. A Current Profile Correct answer.
  2. An Implementation Tier
  3. A Target Profile
  4. An Informative Reference

Explanation

A Current Profile records the outcomes an organization is achieving today, Function by Function and Category by Category. It is the baseline against which a Target Profile is compared to reveal gaps. Tiers describe rigor of risk management, and Informative References point to external standards.

Question 31NIST Cybersecurity Framework fundamentals

What do the Framework Implementation Tiers primarily describe?

  1. The count of incidents handled in the previous fiscal year
  2. The number of security tools deployed per business unit
  3. The degree to which cybersecurity risk management is formalized and integrated with organizational risk decisions Correct answer.
  4. The percentage of Subcategories that have been fully automated

Explanation

Tiers characterize how rigorous and organization-wide an entity's cybersecurity risk management is, ranging from informal and ad hoc to adaptive and continuously improved. They are about process maturity and integration with risk decisions, not tool counts or incident statistics. Tier selection reflects organizational context and risk appetite.

Question 32NIST Cybersecurity Framework fundamentals

Which statement best captures the intended audience of the NIST Cybersecurity Framework?

  1. Organizations of any size or sector that manage cybersecurity risk, with emphasis on critical infrastructure Correct answer.
  2. Only vendors selling security products to critical infrastructure
  3. Only publicly traded companies with an audit committee
  4. Only federal agencies subject to FISMA reporting

Explanation

The Framework was developed for critical infrastructure but is explicitly usable by organizations of all sizes and sectors, including small businesses and nonprofits. It is voluntary and adaptable to different risk contexts. It is not restricted to federal agencies, public companies, or vendors.

Question 33NIST Cybersecurity Framework fundamentals

In the Framework Core, what is the role of Informative References?

  1. They list the penalties an organization faces for noncompliance
  2. They map Core outcomes to specific sections of standards, guidelines, and practices that can help achieve them Correct answer.
  3. They replace the need for a Current Profile
  4. They define the mandatory order in which Functions must be implemented

Explanation

Informative References are illustrative mappings from Categories and Subcategories to widely used standards, guidelines, and practices. They help organizations see how existing requirements and controls relate to Framework outcomes. They are not prescriptive mandates, penalties, or a required sequencing.

Question 34NIST Cybersecurity Framework fundamentals

A manufacturer wants to use the Framework to structure a conversation with its board about how cybersecurity risk is governed. Which Function should anchor that discussion?

  1. PROTECT
  2. RECOVER
  3. DETECT
  4. GOVERN Correct answer.

Explanation

GOVERN addresses organizational context, risk management strategy, roles and responsibilities, policy, and oversight, which is exactly the material a board needs. DETECT, RECOVER, and PROTECT describe operational outcomes that follow from governance decisions. Anchoring the board conversation in GOVERN keeps the focus on risk direction and accountability.

Question 35NIST Cybersecurity Framework fundamentals

An organization compares its Current Profile with its Target Profile and finds several Subcategories with no implemented outcome. What is the most appropriate next step in Framework terms?

  1. Treat the gaps as Tiers and raise each Tier by one level
  2. Delete the unmet Subcategories from the Core to simplify reporting
  3. Declare the Target Profile invalid and lower it to match the Current Profile
  4. Prioritize the gaps using risk analysis and sequence remediation actions accordingly Correct answer.

Explanation

Gap analysis between Current and Target Profiles is meant to feed risk-informed prioritization, since resources are finite and not every gap carries equal risk. The organization then sequences actions and may adjust the Target Profile as context changes. Lowering the target, reinterpreting gaps as Tiers, or editing the Core are not valid responses.

Question 36NIST Cybersecurity Framework fundamentals

A firm wants to use the Framework to manage third-party risk because several critical services are outsourced. Which approach aligns with Framework guidance?

  1. Require every supplier to achieve the same Implementation Tier as the firm
  2. Rely solely on the suppliers' self-attestations without defining expected outcomes
  3. Exclude suppliers from the Framework scope because the firm does not control their systems
  4. Include supply chain risk management outcomes in the Target Profile and flow requirements to suppliers through contracts Correct answer.

Explanation

The Framework addresses supply chain risk within GOVERN and related Categories, encouraging organizations to set expectations for suppliers and reflect them in agreements. Requirements should be risk-based and expressed as outcomes rather than a blanket Tier mandate. Excluding suppliers or relying only on self-attestation leaves a major risk unmanaged.

Question 37NIST Cybersecurity Framework fundamentals

A security team implements a new endpoint detection tool but has not defined what outcomes it should produce or how alerts feed response. Which critique is most consistent with Framework thinking?

  1. Tool selection should precede any consideration of risk or outcomes
  2. Tool adoption should follow from defined outcomes in the Target Profile and be linked to DETECT and RESPOND activities Correct answer.
  3. The tool is sufficient on its own because DETECT is a self-contained Function
  4. Endpoint tools belong only to IDENTIFY and cannot support DETECT

Explanation

The Framework is outcome-based, so technology choices should be justified by the outcomes an organization has prioritized in its Target Profile. Detection tooling only creates value when its alerts connect to response processes. Deploying tools before defining outcomes risks spending without addressing prioritized risk.

Question 38NIST Cybersecurity Framework fundamentals

An organization wants to measure whether its cybersecurity program is improving over time using Framework constructs. Which practice best supports that goal?

  1. Report the number of Informative References cited in policies
  2. Recalculate the number of Functions in the Core annually
  3. Periodically reassess the Current Profile against the Target Profile and track closure of prioritized gaps Correct answer.
  4. Count the total number of Subcategories in the Core each quarter

Explanation

Reassessment of the Current Profile against the Target Profile shows movement on prioritized outcomes and supports continuous improvement. The Core's Subcategory count and Function count are fixed reference facts and do not measure progress. Counting references measures documentation, not risk reduction.

Question 39NIST Cybersecurity Framework fundamentals

Why does the Framework describe itself as a risk-based, voluntary approach rather than a compliance checklist?

  1. It lets organizations select and prioritize outcomes according to their own risk, without mandating specific controls Correct answer.
  2. It substitutes for sector regulators in enforcing cybersecurity rules
  3. It prescribes a fixed set of technical controls that must be configured identically
  4. It requires every organization to implement all Subcategories to the same depth

Explanation

The Framework provides a common language of outcomes while leaving control selection and prioritization to the organization's risk decisions. That flexibility is why it is voluntary and adaptable across sectors. It does not enforce regulations, require uniform depth, or prescribe identical technical configurations.

Question 40NIST Cybersecurity Framework fundamentals

A company already certified against a widely used information security management standard wants to avoid duplicating work when adopting the Framework. What does the Framework offer for this situation?

  1. Informative References that map Core outcomes to that standard's clauses and controls Correct answer.
  2. An automatic Tier upgrade for holding any external certification
  3. A requirement to abandon the existing standard before using the Framework
  4. A guarantee that certification satisfies every Subcategory

Explanation

Informative References show how Framework outcomes relate to other standards, helping organizations reuse existing work and identify remaining gaps. The Framework is intended to complement, not replace, existing standards and certifications. Holding a certification does not automatically satisfy all Subcategories or raise a Tier.

Question 41NIST Cybersecurity Framework fundamentals

Which scenario best illustrates the PROTECT Function in operation?

  1. Enforcing least-privilege access and patching systems to reduce the likelihood of compromise Correct answer.
  2. Reviewing threat intelligence feeds to spot suspicious activity
  3. Restoring data from backups after ransomware encrypts a file server
  4. Revising the risk appetite statement with executive leadership

Explanation

PROTECT covers safeguards that limit or contain the impact of a potential event, such as identity management, access control, training, and maintenance. Spotting suspicious activity is DETECT, restoring data is RECOVER, and setting risk appetite is GOVERN. Distinguishing these helps assign outcomes to the right Function.

Question 42NIST Cybersecurity Framework fundamentals

An analyst notices unusual outbound traffic and opens a case that triggers an investigation. Which Framework Function do these activities fall under?

  1. DETECT Correct answer.
  2. GOVERN
  3. PROTECT
  4. IDENTIFY

Explanation

DETECT covers monitoring, anomaly and event detection, and understanding the effectiveness of detection activities. Recognizing unusual traffic and initiating investigation are detection outcomes. IDENTIFY concerns understanding assets and risk, PROTECT concerns safeguards, and GOVERN concerns oversight and strategy.

Question 43NIST Cybersecurity Framework fundamentals

After a disruptive event, a team restores services, validates backups, and conducts a lessons-learned review. Which Function is most directly represented?

  1. DETECT
  2. RESPOND
  3. RECOVER Correct answer.
  4. IDENTIFY

Explanation

RECOVER covers restoration of capabilities and services impaired by an incident, including improvement activities such as lessons learned. RESPOND covers executing the response plan and containment, which precedes recovery. DETECT and IDENTIFY concern finding events and understanding risk context, respectively.

Question 44NIST Cybersecurity Framework fundamentals

A risk manager argues that because the organization reached Tier 4 for one business unit, the whole enterprise is adaptive. Which critique is most accurate?

  1. Tiers apply only to the GOVERN Function and cannot be assigned to units
  2. Tiers are selected per organizational context and may differ across units, so a single unit's Tier does not characterize the enterprise Correct answer.
  3. Tier levels are assigned by NIST after an external assessment
  4. Tier 4 can only be claimed after all Subcategories are implemented

Explanation

The Framework notes that Tier selection reflects an organization's context and that different parts of an organization may operate at different Tiers. A high Tier in one unit does not automatically describe the enterprise. NIST does not certify or assign Tiers, and Tiers are not contingent on implementing every Subcategory.

Question 45NIST Cybersecurity Framework fundamentals

A team is drafting its first Target Profile but has not yet completed a risk assessment. What is the most defensible approach?

  1. Wait until every Subcategory can be fully implemented before creating a Target Profile
  2. Use available risk information and business objectives, then refine the Target Profile as the risk assessment matures Correct answer.
  3. Copy another organization's Target Profile verbatim to save time
  4. Set the Target Profile equal to the Current Profile so no gaps appear

Explanation

Target Profiles can be built iteratively and refined as risk understanding improves, which keeps planning moving. Copying another organization's profile ignores differences in context and risk appetite. Setting the target equal to the current state defeats the purpose of identifying improvement priorities.

Question 46NIST Cybersecurity Framework fundamentals

How does the Framework Core relate to Profiles?

  1. The Core supplies the catalog of Functions, Categories, and Subcategories that Profiles then select and prioritize Correct answer.
  2. Profiles and the Core are independent and share no common elements
  3. The Core is derived from Profiles submitted by sector organizations
  4. Profiles define new Functions that are added to the Core once approved

Explanation

The Core provides the common set of outcomes, and Profiles express which of those outcomes an organization currently achieves or targets. Profiles are built by selecting and prioritizing Core elements according to business needs and risk. The Core is not derived from Profiles, and the two are directly linked.

Question 47NIST Cybersecurity Framework fundamentals

An organization claims it has 'implemented the Framework' because it completed a single Current Profile exercise. Which critique best reflects the Framework's intent?

  1. Adoption is a repeatable cycle of profiling, gap prioritization, action, and reassessment rather than a one-time deliverable Correct answer.
  2. The Framework is implemented only when Informative References are removed
  3. A single Current Profile is sufficient because the Framework is a certification
  4. Completion requires implementing every Subcategory to Tier 4

Explanation

The Framework is meant to be used continuously: profiles are revisited, priorities adjusted, and progress reassessed as risk and business context change. A one-time exercise does not constitute ongoing risk management. The Framework is not a certification, does not require Tier 4 everywhere, and does not involve removing Informative References.

Question 48NIST Cybersecurity Framework fundamentals

Two business units report different Current Profiles for the same Function. Which interpretation is most consistent with the Framework?

  1. Profiles can vary by unit or system, and differences should inform enterprise-level prioritization and resource decisions Correct answer.
  2. The Core must be revised so both units produce identical results
  3. One unit must be reporting incorrectly because a Current Profile is enterprise-wide by definition
  4. Differences indicate the Framework cannot be applied to multi-unit organizations

Explanation

Profiles may be developed at organization, mission, or process level, so variation across units is expected and informative. Leadership can aggregate these views to prioritize investments and set enterprise targets. The Framework is designed for complex organizations rather than requiring identical results everywhere.

Question 49NIST Cybersecurity Framework fundamentals

A regulator mandates that a utility align with the Framework. How does that mandate affect the Framework's voluntary nature?

  1. The Framework becomes a NIST-enforced standard with NIST conducting audits
  2. The Framework itself remains voluntary guidance; the obligation arises from the regulator's rule, not from NIST Correct answer.
  3. The Framework's Functions are replaced by the regulator's control catalog
  4. The utility is exempt from building a Current Profile

Explanation

The Framework is published as voluntary guidance, and any binding obligation comes from the adopting authority, such as a regulator or contract. NIST does not audit or enforce Framework use. A mandate does not alter the Core's content or remove the value of profiling.

Question 50NIST Cybersecurity Framework fundamentals

An organization wants to express the outcome 'backups of critical data are maintained, tested, and protected' within the Framework. Where does this outcome most naturally belong?

  1. DETECT, because it concerns continuous monitoring only
  2. PROTECT, because protective safeguards include maintaining and testing data backups Correct answer.
  3. GOVERN, because it concerns written policy only
  4. IDENTIFY, because it concerns asset inventory only

Explanation

Maintaining, testing, and protecting backups is a protective safeguard that limits impact from disruptive events, placing it in PROTECT. GOVERN sets policy direction but does not itself perform backup operations. IDENTIFY and DETECT address asset understanding and monitoring rather than backup maintenance.