I85PREP
⌘ K
NIST Cybersecurity Lead Implementer study materials
NIST Cybersecurity Lead Implementer study resources

NIST Cybersecurity Lead Implementer practice questions

One question at a time. Build your NIST Cybersecurity Lead Implementer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity (NIST frameworks)

Under the NIST Cybersecurity Framework 2.0, which function was newly added to explicitly address governance and organizational context?

  1. PROTECT
  2. RECOVER
  3. IDENTIFY
  4. GOVERN Correct answer.

Explanation

NIST CSF 2.0 introduced the GOVERN function to cover cybersecurity risk management strategy, roles, policy, and supply chain oversight at the organizational level. IDENTIFY, PROTECT, and RECOVER existed in CSF 1.1 and remain, but none of them addresses governance as a standalone function.

Question 2Cybersecurity (NIST frameworks)

In the CSF 2.0 structure, what is the correct hierarchy of components from broadest to most specific?

  1. Profile, Function, Category, Subcategory
  2. Function, Category, Subcategory, Implementation Example Correct answer.
  3. Category, Function, Subcategory, Informative Reference
  4. Function, Subcategory, Category, Profile

Explanation

CSF 2.0 organizes outcomes as Functions, then Categories within each Function, then Subcategories, with Implementation Examples and Informative References as supporting detail. Profiles and Tiers are separate organizational concepts, not levels of the outcome hierarchy.

Question 3Cybersecurity (NIST frameworks)

A Lead Implementer is using CSF 2.0 Organizational Profiles. What is the primary purpose of comparing a Current Profile with a Target Profile?

  1. To replace the need for a risk assessment
  2. To certify the organization against a mandatory federal standard
  3. To generate a list of technical vulnerabilities in the network
  4. To identify and prioritize gaps between present and desired cybersecurity outcomes Correct answer.

Explanation

Organizational Profiles describe current and target states, and comparing them reveals gaps that inform prioritization and action planning. The CSF is voluntary guidance, not a certification scheme, and Profiles do not substitute for risk assessment or vulnerability scanning.

Question 4Cybersecurity (NIST frameworks)

Which CSF 2.0 Implementation Tier describes an organization with risk-informed, repeatable processes and a formal risk management strategy that is broadly communicated?

  1. Tier 2: Risk Informed
  2. Tier 4: Adaptive
  3. Tier 1: Partial
  4. Tier 3: Repeatable Correct answer.

Explanation

Tier 3 (Repeatable) reflects formally approved, consistently applied, and communicated risk management processes. Tier 2 is informal and not organization-wide, and Tier 4 adds continuous improvement and adaptation to changing threats.

Question 5Cybersecurity (NIST frameworks)

Which NIST publication is the primary source for the CSF 2.0 framework itself and its implementation guidance?

  1. NIST CSF 2.0 (NIST CSWP 29) Correct answer.
  2. NIST SP 800-53
  3. NIST SP 800-37
  4. NIST SP 800-171

Explanation

The CSF 2.0 is published as NIST CSWP 29, which defines the Functions, Categories, Subcategories, Tiers, and Profiles. SP 800-53 and SP 800-171 are control catalogs, and SP 800-37 is the Risk Management Framework process document.

Question 6Cybersecurity (NIST frameworks)

The CSF 2.0 GOVERN function includes a category on Supply Chain Risk Management. Which outcome most directly aligns with that category?

  1. Deploying endpoint detection and response tooling
  2. Encrypting all data at rest across the enterprise
  3. Testing backup restoration procedures quarterly
  4. Establishing and maintaining supply chain risk management processes and supplier agreements Correct answer.

Explanation

The Supply Chain Risk Management category (GV.SC) addresses processes, supplier requirements, and contractual agreements for managing third-party risk. Encryption, backup testing, and endpoint detection are technical safeguards that map to PROTECT or RECOVER outcomes, not to supply chain governance.

Question 7Cybersecurity (NIST frameworks)

An organization wants to use the CSF as a communication tool with executives. Which element best conveys overall maturity and rigor of cybersecurity risk management in business terms?

  1. The Implementation Tiers Correct answer.
  2. The number of controls in SP 800-53
  3. The Informative References cited
  4. The list of Subcategories the organization has implemented

Explanation

Tiers describe the degree to which cybersecurity risk management is formalized, integrated, and communicated, which translates well for executive audiences. Subcategory lists and control counts are granular and do not express organizational maturity.

Question 8Cybersecurity (NIST frameworks)

Under the NIST Risk Management Framework (SP 800-37), which step immediately follows 'Categorize' in the RMF process?

  1. Select controls Correct answer.
  2. Authorize system
  3. Assess controls
  4. Monitor controls

Explanation

The RMF sequence is Categorize, Select, Implement, Assess, Authorize, and Monitor. Selecting the control baseline directly follows categorization, with implementation and assessment occurring later.

Question 9Cybersecurity (NIST frameworks)

A system is categorized as moderate impact. Which NIST baseline most appropriately provides the initial control set for a federal information system?

  1. The SP 800-53 moderate baseline Correct answer.
  2. The CSF Tier 2 profile
  3. The SP 800-53 low baseline
  4. The SP 800-171 full set of requirements

Explanation

SP 800-53 provides impact-based control baselines (low, moderate, high), and the moderate baseline matches a moderate categorization. SP 800-171 is a separate requirement set for protecting CUI, and CSF Tiers are not control baselines.

Question 10Cybersecurity (NIST frameworks)

When tailoring a control baseline under RMF, which activity is an example of scoping guidance?

  1. Adding compensating controls without documentation
  2. Removing controls that are not applicable to the technology or environment Correct answer.
  3. Reducing the categorization of the system
  4. Skipping the security assessment step

Explanation

Tailoring includes scoping guidance that removes or adjusts controls not applicable to the system's technology or environment, with rationale documented. Changing categorization or skipping assessment is not tailoring and would undermine the process.

Question 11Cybersecurity (NIST frameworks)

Which statement best distinguishes an authorization to operate (ATO) from continuous monitoring under RMF?

  1. An ATO is a point-in-time risk acceptance decision, while continuous monitoring sustains awareness after authorization Correct answer.
  2. An ATO is issued by the system owner without any assessment
  3. An ATO replaces continuous monitoring entirely
  4. Continuous monitoring is performed only before categorization

Explanation

The authorizing official grants an ATO based on assessment results and accepted residual risk; continuous monitoring then maintains ongoing awareness of control effectiveness and changes. The ATO does not substitute for monitoring, and it follows assessment rather than bypassing it.

Question 12Cybersecurity (NIST frameworks)

An organization must protect controlled unclassified information in a contractor's system. Which NIST publication primarily defines the security requirements for that environment?

  1. NIST SP 800-145
  2. NIST SP 800-30
  3. NIST SP 800-171 Correct answer.
  4. NIST SP 800-61

Explanation

SP 800-171 specifies requirements for protecting CUI in nonfederal systems and organizations. SP 800-145 defines cloud computing characteristics, SP 800-61 covers incident handling, and SP 800-30 covers risk assessment.

Question 13Cybersecurity (NIST frameworks)

Which of the following is a CSF 2.0 IDENTIFY category outcome?

  1. Platform Security
  2. Incident Management
  3. Asset Management Correct answer.
  4. Identity Management and Access Control

Explanation

Asset Management (ID.AM) belongs to the IDENTIFY function, covering inventories of assets, data, and their relationships. Access control, platform security, and incident management map to PROTECT, PROTECT, and RESPOND respectively.

Question 14Cybersecurity (NIST frameworks)

A Lead Implementer is prioritizing CSF actions after gap analysis. Which approach best reflects risk-informed prioritization?

  1. Prioritize only the cheapest actions first
  2. Implement every Subcategory simultaneously regardless of risk
  3. Defer all GOVERN actions until technical controls are complete
  4. Rank gaps by potential impact and likelihood, then sequence actions by risk reduction and cost Correct answer.

Explanation

Risk-informed prioritization weighs impact, likelihood, and cost-effectiveness so that actions reducing the most significant risk are sequenced first. Implementing everything at once or choosing purely by cost ignores risk, and GOVERN actions underpin the whole program.

Question 15Cybersecurity (NIST frameworks)

Which CSF 2.0 function contains the 'Incident Management' and 'Incident Analysis' categories?

  1. RECOVER
  2. RESPOND Correct answer.
  3. PROTECT
  4. DETECT

Explanation

The RESPOND function includes Incident Management, Incident Analysis, Incident Response Reporting and Communication, and Incident Mitigation. RECOVER handles restoration, DETECT covers monitoring and adverse event analysis, and PROTECT covers safeguards.

Question 16Cybersecurity (NIST frameworks)

An organization is defining a Target Profile. Which input is most essential to ensure the profile is meaningful?

  1. The number of employees in the IT department
  2. A vendor's product feature list
  3. The organization's marketing plan
  4. The organization's risk assessment and business objectives Correct answer.

Explanation

Target Profiles should reflect the organization's mission, risk tolerance, and business objectives so that desired outcomes address real risk. Vendor feature lists and staffing counts are not drivers of desired cybersecurity outcomes.

Question 17Cybersecurity (NIST frameworks)

Which statement accurately describes the relationship between CSF Subcategories and SP 800-53 controls?

  1. SP 800-53 controls are derived solely from CSF Tiers
  2. CSF Subcategories are mandatory federal requirements
  3. Subcategories are identical to SP 800-53 controls and replace them
  4. Subcategories describe outcomes, and Informative References map them to control catalogs such as SP 800-53 Correct answer.

Explanation

CSF Subcategories express desired outcomes and use Informative References to point to standards and control catalogs like SP 800-53 for implementation detail. The CSF does not replace control catalogs, and its outcomes are voluntary guidance rather than mandatory requirements.

Question 18Cybersecurity (NIST frameworks)

During continuous monitoring, which metric best indicates whether a PROTECT access control outcome remains effective?

  1. Percentage of accounts reviewed and deprovisioned within the defined time threshold Correct answer.
  2. Number of firewall rules configured
  3. Total count of security policies written
  4. Frequency of team meetings

Explanation

Effectiveness metrics measure whether the control achieves its outcome, such as timely account review and deprovisioning. Raw counts of rules or policies indicate activity volume, not whether access control is working as intended.

Question 19Cybersecurity (NIST frameworks)

Which NIST publication provides guidance on integrating cybersecurity into enterprise risk management and is a common reference for the GOVERN function?

  1. NIST IR 8286 Correct answer.
  2. NIST SP 800-88
  3. NIST SP 800-115
  4. NIST SP 800-63B

Explanation

NIST IR 8286 addresses integrating cybersecurity and enterprise risk management, supporting governance and risk strategy outcomes. SP 800-63B covers digital identity authentication, SP 800-115 covers security testing, and SP 800-88 covers media sanitization.

Question 20Cybersecurity (NIST frameworks)

A small business with limited resources wants a lightweight path to align with CSF 2.0. Which approach is most appropriate?

  1. Skip Profiles and Tiers entirely
  2. Adopt the full SP 800-53 high baseline immediately
  3. Use the CSF Small Business Quick-Start Guide to focus on priority outcomes Correct answer.
  4. Implement only the RECOVER function

Explanation

NIST publishes a CSF 2.0 Small Business Quick-Start Guide that helps resource-constrained organizations focus on priority outcomes and build incrementally. Adopting a high baseline wholesale or skipping Profiles and Tiers ignores proportionality and risk context.

Question 21Cybersecurity (NIST frameworks)

Which action best demonstrates that an organization has reached Tier 4 (Adaptive) in CSF terms?

  1. Performing ad hoc incident response
  2. Documenting a risk management policy for the first time
  3. Continuously improving cybersecurity practices based on lessons learned and predictive threat indicators Correct answer.
  4. Conducting a one-time gap assessment

Explanation

Tier 4 reflects adaptive, continuously improving practices that incorporate lessons learned and predictive indicators of emerging threats. First-time documentation, ad hoc response, and one-time assessments indicate lower tiers.

Question 22Cybersecurity (NIST frameworks)

Which CSF 2.0 function contains categories addressing 'Continuous Monitoring' and 'Adverse Event Analysis'?

  1. DETECT Correct answer.
  2. IDENTIFY
  3. GOVERN
  4. RECOVER

Explanation

DETECT includes Continuous Monitoring and Adverse Event Analysis, which focus on finding and analyzing anomalies and potential incidents. IDENTIFY concerns asset and risk understanding, GOVERN concerns strategy and oversight, and RECOVER concerns restoration.

Question 23Cybersecurity (NIST frameworks)

An organization is mapping its incident response plan to CSF 2.0. Which pairing correctly matches a category to its function?

  1. Incident Management maps to PROTECT
  2. Incident Mitigation maps to RECOVER
  3. Incident Response Reporting and Communication maps to RESPOND Correct answer.
  4. Incident Analysis maps to DETECT

Explanation

Incident Response Reporting and Communication (RS.CO) is a RESPOND category covering internal and external communication during incidents. Mitigation and Management are RESPOND categories, and Incident Analysis belongs to DETECT.

Question 24Cybersecurity (NIST frameworks)

Which consideration is most important when selecting Informative References for CSF Subcategories in a regulated environment?

  1. Choosing references that reflect applicable legal, regulatory, and contractual obligations Correct answer.
  2. Selecting only references the organization already meets
  3. Using the largest possible number of references
  4. Avoiding any reference to control catalogs

Explanation

Informative References should reflect the standards and obligations that actually apply, including legal, regulatory, and contractual requirements. Choosing only already-met references or maximizing quantity does not produce a meaningful mapping.

Question 25Cybersecurity (NIST frameworks)

Which outcome most directly belongs to the CSF 2.0 GOVERN function's 'Roles, Responsibilities, and Authorities' category?

  1. Establishing and communicating cybersecurity roles and responsibilities across the organization Correct answer.
  2. Scanning networks for vulnerabilities
  3. Restoring systems after an outage
  4. Encrypting data in transit

Explanation

The Roles, Responsibilities, and Authorities category (GV.RR) ensures cybersecurity accountability is defined and communicated organization-wide. Encryption, restoration, and scanning are technical or operational activities mapped to other functions.

Question 26Cybersecurity (NIST frameworks)

In CSF 2.0, which function is newly added relative to CSF 1.1 and explicitly addresses governance, supply chain, and enterprise risk management at the organizational level?

  1. RECOVER
  2. IDENTIFY
  3. GOVERN Correct answer.
  4. PROTECT

Explanation

CSF 2.0 introduced the GOVERN function to make cybersecurity governance an explicit, organization-wide concern spanning risk strategy, roles, policy, and supply chain. The other functions existed in CSF 1.1 and focus on asset understanding, safeguards, and restoration respectively.

Question 27Cybersecurity (NIST frameworks)

Under the NIST RMF, what is the principal purpose of the 'Select' step?

  1. Categorize the system by impact level
  2. Authorize the system to operate based on residual risk
  3. Choose an initial control set from a baseline and tailor it to the system Correct answer.
  4. Continuously assess control effectiveness after deployment

Explanation

The Select step takes the baseline corresponding to the system's categorization and applies tailoring (scoping, parameter setting, supplemental controls) to produce the system's control set. Categorization precedes it, authorization follows assessment, and continuous monitoring comes later.

Question 28Cybersecurity (NIST frameworks)

A federal information system stores data whose unauthorized disclosure would cause serious damage to organizational assets. Which FIPS 199 impact level applies to the confidentiality objective?

  1. High
  2. Low
  3. Not applicable
  4. Moderate Correct answer.

Explanation

FIPS 199 defines moderate impact as serious adverse effect on organizational operations, assets, or individuals. Low is limited effect and high is severe or catastrophic effect, so serious damage maps to moderate.

Question 29Cybersecurity (NIST frameworks)

Which NIST publication is the primary source for security and privacy control catalog and assessment procedures used in RMF control selection?

  1. NIST SP 800-61
  2. NIST SP 800-145
  3. NIST SP 800-30
  4. NIST SP 800-53 Correct answer.

Explanation

SP 800-53 provides the security and privacy control catalog and, with SP 800-53A, the assessment procedures used when selecting and assessing controls. The other publications address risk assessment, incident handling, and cloud definitions.

Question 30Cybersecurity (NIST frameworks)

An organization wants to express its current cybersecurity posture against CSF 2.0 outcomes. Which artifact represents that current state?

  1. Community Profile
  2. Informative Reference
  3. Current Profile Correct answer.
  4. Target Profile

Explanation

The Current Profile describes outcomes currently achieved, while the Target Profile describes desired outcomes. Comparing the two drives gap analysis and prioritization.

Question 31Cybersecurity (NIST frameworks)

Which activity is the core of the RMF 'Assess' step?

  1. Destroying media at system decommissioning
  2. Evaluating controls against assessment procedures to determine effectiveness Correct answer.
  3. Applying scoping guidance to remove inherited controls
  4. Registering the system with the authorizing official

Explanation

The Assess step develops and executes an assessment plan using SP 800-53A procedures to determine whether controls are implemented correctly and operating as intended. The results feed the authorization decision.

Question 32Cybersecurity (NIST frameworks)

Which NIST SP 800-53 control family addresses awareness and training so users can perform cybersecurity duties?

  1. AT Correct answer.
  2. AC
  3. RA
  4. AU

Explanation

The AT family covers awareness and training, including literacy training and role-based training. AC covers access control, AU covers audit and accountability, and RA covers risk assessment.

Question 33Cybersecurity (NIST frameworks)

What does the RMF 'Prepare' step accomplish before the traditional process begins?

  1. It categorizes the system and selects the baseline
  2. It authorizes the system to operate
  3. It establishes context, priorities, and readiness so subsequent steps run efficiently Correct answer.
  4. It monitors controls in production

Explanation

SP 800-37 Revision 2 added Prepare as the initial step to establish the risk management context, assign roles, and ensure organizational readiness. Categorization, selection, authorization, and monitoring occur in later steps.

Question 34Cybersecurity (NIST frameworks)

A Lead Implementer is aligning a CSF 2.0 Target Profile with a mandatory regulatory framework. What should guide the selection of Informative References?

  1. References that are most widely cited in vendor marketing material
  2. References that are easiest to implement regardless of regulatory fit
  3. References chosen to minimize the number of subcategories addressed
  4. References that demonstrably satisfy both the CSF subcategory outcome and the regulatory obligation Correct answer.

Explanation

Informative References should be selected because they map to the subcategory outcome and satisfy applicable obligations, so one mapping serves both purposes. Popularity, ease, or minimal coverage do not demonstrate compliance.

Question 35Cybersecurity (NIST frameworks)

During a gap analysis against CSF 2.0, which finding most clearly indicates a governance gap rather than a technical control gap?

  1. Privileged accounts share a common administrative password
  2. Backups have not been tested for restoration in six months
  3. No assigned owner exists for cybersecurity risk decisions across business units Correct answer.
  4. Endpoint antivirus signatures are 30 days out of date

Explanation

A governance gap concerns unclear accountability, decision rights, and risk ownership, which maps to GOVERN categories. Outdated signatures, untested backups, and shared credentials are operational safeguard deficiencies.

Question 36Cybersecurity (NIST frameworks)

An organization uses CSF 2.0 subcategories as the organizing structure for its control assessment. Which statement best describes how subcategories relate to SP 800-53 controls?

  1. Each subcategory maps to exactly one SP 800-53 control
  2. Subcategories state outcomes, and controls are one means of achieving them Correct answer.
  3. Subcategories replace the need for any control catalog
  4. Subcategories are a mandatory subset of SP 800-53 controls

Explanation

CSF subcategories describe desired outcomes and are technology- and vendor-neutral, while SP 800-53 controls are implementation mechanisms that can satisfy those outcomes. The mapping is many-to-many, not one-to-one, and controls are not mandatory under the CSF itself.

Question 37Cybersecurity (NIST frameworks)

A system owner proposes accepting a risk rather than remediating it. Under RMF, who holds authority to accept that residual risk for the system?

  1. The control assessor
  2. The vendor supplying the system
  3. The system administrator
  4. The authorizing official Correct answer.

Explanation

The authorizing official is accountable for accepting residual risk and issuing the authorization decision. Administrators implement, assessors evaluate, and vendors supply, but none holds risk acceptance authority.

Question 38Cybersecurity (NIST frameworks)

Which practice best demonstrates continuous monitoring of a PROTECT access control outcome?

  1. Completing annual security awareness training for all staff
  2. Documenting the access control baseline during initial authorization
  3. Publishing the access control policy on the intranet
  4. Reviewing authentication logs and access recertification results on a defined cadence Correct answer.

Explanation

Continuous monitoring requires ongoing measurement of whether the control remains effective, which log review and periodic recertification provide. Training, policy publication, and baseline documentation are one-time or indirect activities.

Question 39Cybersecurity (NIST frameworks)

An organization wants a repeatable method to score the likelihood and impact of identified risks to prioritize CSF actions. Which NIST resource directly supports this?

  1. SP 800-30 risk assessment guidance Correct answer.
  2. SP 800-88 media sanitization guidance
  3. SP 800-161 supply chain risk guidance
  4. SP 800-125 virtualization security guidance

Explanation

SP 800-30 provides a structured process for assessing risk, including determining likelihood and impact, which supports prioritization. The other publications address sanitization, virtualization, and supply chain risk respectively.

Question 40Cybersecurity (NIST frameworks)

A contractor handles controlled unclassified information for a federal agency. Which NIST publication specifies the security requirements the contractor must implement?

  1. SP 800-92
  2. SP 800-171 Correct answer.
  3. SP 800-137
  4. SP 800-63

Explanation

SP 800-171 defines the security requirements for protecting controlled unclassified information in nonfederal systems and organizations. The others cover digital identity, log management, and continuous monitoring respectively.

Question 41Cybersecurity (NIST frameworks)

A Lead Implementer must decide which CSF 2.0 subcategories to address first after a gap analysis. Which prioritization approach is most defensible?

  1. Defer all GOVERN gaps until technical controls are complete
  2. Prioritize subcategories that are easiest and cheapest to close
  3. Address all gaps in the order they appear in the CSF document
  4. Rank gaps by the risk they pose to critical services and prioritize the highest exposures Correct answer.

Explanation

CSF implementation is risk-informed, so gaps are prioritized by their potential impact on critical services and organizational objectives. Sequential document order, ease, and deferring governance ignore risk.

Question 42Cybersecurity (NIST frameworks)

Which statement best describes the purpose of a Community Profile in CSF 2.0?

  1. It records an organization's achieved outcomes after assessment
  2. It replaces the need for a Target Profile
  3. It provides a baseline of outcomes for a sector or use case that organizations can tailor Correct answer.
  4. It lists the controls inherited from a cloud provider

Explanation

A Community Profile establishes a common set of CSF outcomes for a sector, technology, or use case, which organizations then tailor into their own Target Profile. It is not an organization-specific current-state record and does not replace a Target Profile.

Question 43Cybersecurity (NIST frameworks)

An organization claims CSF Tier 4 (Adaptive) maturity. Which behavior best supports that claim?

  1. It manages risk informally and reactively
  2. It continuously improves by learning from incidents and proactively adapting controls to changing risk Correct answer.
  3. It applies a formal, documented process but does not review it for improvement
  4. It shares threat intelligence with peers but does not change its own controls

Explanation

Tier 4 reflects an adaptive organization that learns from experience, shares information, and continuously improves its cybersecurity practices in response to changing risk. Formal but static processes indicate Tier 3, and informal reactive behavior indicates Tier 1.

Question 44Cybersecurity (NIST frameworks)

Which CSF 2.0 function contains the categories for 'Incident Management' and 'Incident Response Reporting and Communication'?

  1. DETECT
  2. RECOVER
  3. GOVERN
  4. RESPOND Correct answer.

Explanation

The RESPOND function covers incident management, analysis, mitigation, and reporting and communication. DETECT focuses on finding and analyzing adverse events, RECOVER on restoration, and GOVERN on organizational governance.

Question 45Cybersecurity (NIST frameworks)

A Lead Implementer is defining control implementation statements for a moderate-impact system. Which action reflects appropriate tailoring?

  1. Deferring all tailoring until after authorization
  2. Adopting every supplemental control regardless of relevance
  3. Removing the control baseline entirely to reduce cost
  4. Setting organization-defined parameters to values that reflect the system's mission and risk Correct answer.

Explanation

Tailoring includes scoping and setting organization-defined parameters to values appropriate to the system's mission and risk while documenting and justifying decisions. Removing the baseline, indiscriminately adding controls, or deferring tailoring until after authorization defeats the process.

Question 46Cybersecurity (NIST frameworks)

An organization must decide whether a security control failure is a compliance issue or a risk management issue. Which reasoning best reflects NIST RMF principles?

  1. Risk considerations are irrelevant if the control is documented in the SSP
  2. Any control failure is automatically a compliance violation requiring system shutdown
  3. Compliance with the control catalog guarantees acceptable risk
  4. Control failures are evaluated by their effect on mission and risk, with compliance as one input Correct answer.

Explanation

RMF is risk-based: control assessment results inform an authorization decision that weighs mission impact and residual risk, with compliance as one consideration. Automatic shutdown, ignoring risk, or equating catalog compliance with acceptable risk misapplies the framework.

Question 47Cybersecurity (NIST frameworks)

A cloud service provider inherits some controls from the underlying infrastructure. How should the system owner treat inherited controls during assessment?

  1. Assess only controls the provider operates and ignore customer-side controls
  2. Assume all inherited controls are effective without evidence
  3. Remove inherited controls from the SSP to simplify assessment
  4. Verify and document the inheritance, then assess the controls the provider is responsible for Correct answer.

Explanation

Inherited controls must be documented with evidence of the provider's responsibility, and the system owner remains accountable for assessing controls on its side. Assuming effectiveness, removing documentation, or ignoring customer-side controls creates unassessed risk.

Question 48Cybersecurity (NIST frameworks)

A Lead Implementer is choosing metrics to report CSF 2.0 progress to executives. Which set of measures best supports risk-informed decisions?

  1. Number of employees who completed onboarding
  2. Total pages in the system security plan
  3. Trends in risk exposure for critical services and coverage of prioritized subcategories Correct answer.
  4. Counts of policies published and meetings held

Explanation

Executive reporting should show how risk to critical services is changing and how much of the prioritized outcome set is covered, enabling risk-informed decisions. Activity counts and document volume measure effort, not risk reduction.

Question 49Cybersecurity (NIST frameworks)

An organization identifies a new critical dependency on a fourth-party service provider. Which CSF 2.0 area most directly addresses managing this risk?

  1. GOVERN supply chain risk management outcomes Correct answer.
  2. RECOVER incident recovery outcomes
  3. DETECT continuous monitoring outcomes
  4. PROTECT awareness and training outcomes

Explanation

Supply chain risk management, including dependencies on suppliers and their providers, is addressed in the GOVERN function under supply chain risk management categories. Detection, recovery, and training address different concerns.

Question 50Cybersecurity (NIST frameworks)

An organization wants to integrate CSF 2.0 with its enterprise risk register. Which approach best achieves that integration?

  1. Replace the risk register with the CSF Current Profile
  2. Map cybersecurity risks in the register to relevant CSF subcategories and track treatment status Correct answer.
  3. Report only technical vulnerabilities to the risk committee
  4. Maintain the CSF profile as a separate document disconnected from the register

Explanation

Integration requires linking cybersecurity risks to CSF outcomes and tracking treatment within the enterprise risk process so leadership sees a unified risk picture. Keeping them separate, reporting only vulnerabilities, or replacing the register loses enterprise context.