SecurityX Risk Frameworks Quiz: NIST, ISO & Governance

Submit

3. The NIST CSF 'Recover' function focuses on restoring normal operations after a security incident. True or False?

True

False

4. Which governance element ensures that security policies are enforced and monitored across the organization?

Compliance program

Risk tolerance

Threat modeling

Vulnerability scanning

5. True or False: NIST CSF and ISO 27001 cannot be used together in an organization.

True

False

Submit

7. A Business Continuity Plan (BCP) is most closely aligned with which NIST CSF function?

Identify

Protect

Recover

Detect

8. ISO 27001 controls are organized into how many main control categories?

5

8

14

22

9. The NIST 'Respond' function includes incident management activities. True or False?

True

False

10. What is the main difference between risk mitigation and risk acceptance?

Mitigation reduces risk; acceptance acknowledges and tolerates it

Acceptance is mandatory; mitigation is optional

They are identical terms

Mitigation only applies to ISO standards

11. Which NIST Cybersecurity Framework function focuses on identifying organizational assets and vulnerabilities?

Identify

Protect

Detect

Respond

12. Which NIST CSF function involves activities such as monitoring and logging to detect security incidents?

Identify

Protect

Detect

Recover

13. True or False: ISO 27001 requires organizations to perform annual risk assessments.

True

False

Submit

15. The NIST CSF 'Protect' function includes which of the following activities?

Access control and data security

Threat hunting and forensics

Incident communication

Recovery planning only

16. What is the primary purpose of a Risk Assessment in a security governance framework?

Identify, analyze, and prioritize organizational risks

Eliminate all security threats

Reduce IT budgets

Ensure employee satisfaction

17. Which of the following is a core principle of ISO 27001 certification?

Continuous improvement and management review

Single-point security assessment

Elimination of all risks

Compliance with U.S. federal law only

18. True or False: The NIST Cybersecurity Framework is mandatory for all U.S. organizations.

True

False

Submit

20. ISO 27001 is primarily used for establishing an Information Security Management System (ISMS). What does the '27001' designation refer to?

Year of publication

Specific control number

Standard number in the ISO 27000 series

Risk assessment methodology

SecurityX Risk Quiz: Can You Master NIST, ISO & Governance?

1. In governance frameworks, Risk Appetite refers to the level of ____ an organization is willing to accept.

2.

What first name or nickname would you like us to use?

2. In Risk Frameworks (SecurityX), a control is considered ____-effective when it consistently achieves its intended security objective.

3. The NIST CSF 'Recover' function focuses on restoring normal operations after a security incident. True or False?

4. Which governance element ensures that security policies are enforced and monitored across the organization?

5. True or False: NIST CSF and ISO 27001 cannot be used together in an organization.

6. Risk ____ is the process of determining which risks require immediate action and resource allocation.

7. A Business Continuity Plan (BCP) is most closely aligned with which NIST CSF function?

8. ISO 27001 controls are organized into how many main control categories?

9. The NIST 'Respond' function includes incident management activities. True or False?

10. What is the main difference between risk mitigation and risk acceptance?

11. Which NIST Cybersecurity Framework function focuses on identifying organizational assets and vulnerabilities?

12. Which NIST CSF function involves activities such as monitoring and logging to detect security incidents?

13. True or False: ISO 27001 requires organizations to perform annual risk assessments.

14. A formal document that outlines an organization's commitment to information security is called a Security ____.

15. The NIST CSF 'Protect' function includes which of the following activities?

16. What is the primary purpose of a Risk Assessment in a security governance framework?

17. Which of the following is a core principle of ISO 27001 certification?

18. True or False: The NIST Cybersecurity Framework is mandatory for all U.S. organizations.

19. In risk management, the likelihood of a threat occurring multiplied by the impact of that threat equals the ____.

20. ISO 27001 is primarily used for establishing an Information Security Management System (ISMS). What does the '27001' designation refer to?