NIST SP 800-53 provides security controls for federal information systems to protect them from cyber threats.

Which NIST publication provides guidelines for federal information system security?

The NIST Cybersecurity Framework is designed to guide organizations in improving their cybersecurity posture by managing risks, especially in critical infrastructure.

To provide a guide for implementing ISO 27001

To iimprove cybersecurity risk management for critical infrastructure

To specify requirements for IT governance

What is the main objective of the NIST Cybersecurity Framework?

The 'Detect' function in the NIST Cybersecurity Framework is focused on identifying cybersecurity incidents and events.

In the NIST Cybersecurity Framework, what does the 'Detect' function focus on?

NIST SP 800-37 outlines the Risk Management Framework (RMF) used by federal agencies to manage cybersecurity risks.

Which NIST publication outlines a process for managing cybersecurity risk using the Risk Management Framework (RMF)?

NIST SP 800-57 provides guidance on cryptographic standards and key management processes.

Which NIST publication is used for managing cryptographic standards and guidelines?

ISO/IEC 27001:2013 focuses on creating and maintaining an Information Security Management System (ISMS) to ensure the security of information.

 Information security management systems (ISMS)

ISO/IEC 27001:2013 is primarily concerned with:

ISO 27001 certification requires an organization to have a fully established and functioning ISMS to manage information security risks.

An Information Security Management System (ISMS)

What is a key element required for ISO 27001 certification?

Annex A of ISO 27001 provides a comprehensive list of security controls that an organization can adopt to address identified risks.

To outline organizational governance models

To list security controls for mitigating identified risks

To specify compliance with external standards

What is the purpose of 'Annex A' in ISO 27001?

Clause 6 in ISO 27001 outlines the requirements for planning, establishing, and maintaining the ISMS.

PDCA is a continuous improvement cycle used in ISO 27001 to manage and improve the ISMS.

What does PDCA stand for in ISO 27001?

GDPR stands for the General Data Protection Regulation, a regulation aimed at protecting the personal data of EU citizens.

What does GDPR stand for?

The primary goal of the GDPR is to protect the privacy and personal data of individuals in the EU.

To allow organizations to collect data freely

To create a global standard for cybersecurity

What is the primary objective of the GDPR?

Data encryption is an important security measure but not one of the core principles of GDPR. The principles focus on lawful, fair, and transparent data processing.

Which of the following is NOT a principle of GDPR?

Under GDPR, how long do organizations have to notify the authorities of a data breach?

Racial or ethnic origin is classified as "special category data" under GDPR, which requires stricter processing and protection.

Which of the following is considered "special category data" under GDPR?

Risk management is a core component of the GRC framework, focusing on identifying, assessing, and mitigating risks within an organization.

Which of the following is a key component of the GRC framework?

Governance in the GRC framework refers to ensuring that processes, controls, and policies align with the organization's objectives and regulatory requirements.

The process of managing risks across the organization

The collection and reporting of financial data

The strategic alignment of processes, controls, and policies

Which of the following best describes Governance in GRC?

The primary objective of risk management in the GRC framework is to assess and mitigate risks to achieve business objectives and reduce negative impacts.

To manage and mitigate organizational risks

To ensure compliance with industry standards

Which of the following is the main objective of Risk Management within GRC?

Risk appetite refers to the amount of risk an organization is willing to tolerate or accept in pursuit of its objectives.

The number of risks a company is legally allowed to take

The level of risk an organization is willing to accept to achieve its objec

The process of identifying potential risks

In GRC, what does the term "risk appetite" refer to?

COBIT (Control Objectives for Information and Related Technologies) is a widely recognized framework used for IT governance, risk management, and compliance.