CCP NIST & ISO 27001 Compliance 3

Question 1

Which step in the NIST RMF involves determining if the controls implemented are effective?

Accepted Answer

Assess

Answer

The Assess step (Step 4) evaluates whether security and privacy controls are implemented correctly, operating as intended, and producing desired outcomes.

Question 2

ISO 27001 requires organizations to define the scope of the ISMS. Which factor must be considered when determining scope?

Accepted Answer

Internal and external issues, interested parties, and interfaces/dependencies

Answer

ISO 27001 clause 4.3 requires scope to consider internal/external issues, requirements of interested parties, and interfaces and dependencies.

Question 3

A CISO needs to select a baseline of security controls for a high-impact federal system. Which NIST resource provides the appropriate control baseline?

Accepted Answer

NIST SP 800-53B

Answer

NIST SP 800-53B provides control baselines (low, moderate, high) derived from SP 800-53 for use in federal information systems.

Question 4

In ISO 27001, a Statement of Applicability (SoA) must include which elements?

Accepted Answer

Applicable controls, justification for inclusion, and justification for exclusion of Annex A controls

Answer

The SoA required by ISO 27001 clause 6.1.3 must list all Annex A controls and explain why each is included or excluded based on the risk treatment.

Question 5

Which NIST CSF 2.0 core function was ADDED compared to CSF 1.1?

Accepted Answer

Govern

Answer

NIST CSF 2.0 added the Govern function to emphasize the role of governance, organizational context, and cybersecurity supply chain risk management.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP NIST & ISO 27001 Compliance 3