CCP NIST CSF & CIS Controls 3

Question 1

An organization wants to prioritize security investments based on potential business impact. Which NIST CSF concept best supports this decision?

Accepted Answer

Framework Tiers

Answer

NIST CSF Tiers (1–4) reflect the degree to which cybersecurity risk management is integrated into business decisions, helping prioritize investments.

Question 2

CIS Control 5 (Account Management) requires which of the following as a safeguard?

Accepted Answer

Disabling dormant accounts after a defined period

Answer

CIS Control 5 requires disabling or removing dormant accounts to reduce the attack surface from unused credentials.

Question 3

Which NIST CSF 'Protect' category addresses limiting access to only what is necessary for users to perform their job functions?

Accepted Answer

Identity Management and Access Control

Answer

The 'Identity Management and Access Control' category enforces least privilege and ensures access is limited to what is necessary for job functions.

Question 4

A security analyst discovers a zero-day vulnerability actively exploited in the wild. Under which NIST CSF function should the organization's immediate response activities fall?

Accepted Answer

Respond

Answer

Active exploitation of a vulnerability triggers the 'Respond' function, which covers executing response plans and mitigating the incident.

Question 5

CIS Control 8 (Audit Log Management) is most directly aligned with which NIST CSF function?

Accepted Answer

Detect

Answer

Audit Log Management supports the 'Detect' function by ensuring that logs are collected, retained, and reviewed to identify anomalous activity.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP NIST CSF & CIS Controls 3