Free D-CSF-SC-23 sample questions

Correct answer: To describe the desired cybersecurity outcomes and risk management goals for the new initiative.

The Target Profile in the NIST Cybersecurity Framework is used to describe the desired cybersecurity outcomes an organization aims to achieve. It aligns cybersecurity activities with business requirements, risk tolerances, and resources. It serves as a roadmap for improvement, contrasting with the Current Profile which documents the existing state.

Correct answers: Programmable Logic Controllers (PLCs); Data flows between the enterprise network and the operational technology (OT) network

PLCs are fundamental components of Industrial Control Systems that control manufacturing processes. Their compromise could lead to significant physical and operational disruption, making them critical assets to inventory and protect.

The NIST CSF defines assets to include data flows. In an ICS environment, the communication pathways between the IT and OT networks are critical choke points and potential attack vectors. Inventorying and understanding these flows is essential for risk management.

Correct answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is an access control model where permissions are assigned to roles, and users are then assigned to those roles based on their job functions and responsibilities. This method is highly effective for enforcing the principle of least privilege in a structured way.

Correct answer: DE.AE-2: Event data are aggregated and correlated from multiple sources.

This scenario perfectly illustrates DE.AE-2 (Anomalies and Events: Analysis). The analyst is not just looking at one data source but is aggregating (collecting) and correlating (linking) data from two distinct sources—internal firewall logs and an external threat intelligence feed—to detect a malicious event.

Correct answer: The impact on critical patient care and life-sustaining systems.

In a healthcare environment, the primary consideration for any action, including incident containment, must be patient safety and the continuity of care. While evidence preservation and cost are important, they are secondary to ensuring that life-sustaining systems remain operational. The chosen containment strategy must balance stopping the attacker's activity with minimizing disruption to critical hospital functions.

Correct answer: Disaster Recovery Plan (DRP)

A Disaster Recovery Plan (DRP) is a technical, documented process focused on restoring IT systems and infrastructure after a disaster. It contains the specific procedures for recovery, such as failing over to a secondary region or restoring from backups. This is distinct from a Business Continuity Plan (BCP), which is broader and focuses on keeping business functions running during a disruption.

Correct answer: False

This statement is false. The NIST CSF Implementation Tiers (1-Partial, 2-Risk Informed, 3-Repeatable, 4-Adaptive) are not maturity levels. They describe the rigor of an organization's risk management practices. An organization selects a target Tier based on its business needs, risk tolerance, and threat environment; there is no requirement to progress sequentially, and a higher Tier is not always better or necessary.

Correct answer: Recovery Point Objective (RPO)

The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time (e.g., 15 minutes of data, 4 hours of data). It dictates the required frequency of backups or replication. In contrast, the Recovery Time Objective (RTO) defines how quickly a system must be restored after an outage.

Correct answer: Data Loss Prevention (DLP)

Data Loss Prevention (DLP) solutions are specifically designed to enforce policies that prevent sensitive data from leaving an organization's control. They work by inspecting data in use, in motion, and at rest for content that matches predefined patterns (e.g., credit card numbers, social security numbers) and blocking or alerting on unauthorized transfer attempts.

Correct answer: A Security Information and Event Management (SIEM) system

A Security Information and Event Management (SIEM) system is the core technology for addressing this problem. Its primary functions are to collect (aggregate) log and event data from diverse sources, normalize it into a common format, and apply correlation rules to identify patterns indicative of a security threat. This reduces alert fatigue by consolidating many low-level events into a single, actionable incident.