Security frameworks overview (NIST, ISO 27001) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

📋 Factual

intermediate

Core focus of NIST Cybersecurity Framework

What is the primary focus of the NIST Cybersecurity Framework?

A Providing guidelines to manage and reduce cybersecurity risk

B Establishing financial penalties for data breaches

C Defining physical security controls for data centers

D Certifying organizations for international security compliance

💡 Hint

Think about what NIST helps organizations do regarding cybersecurity risks.

The NIST Cybersecurity Framework is designed to help organizations identify, protect, detect, respond to, and recover from cybersecurity risks.

🧠 Conceptual

intermediate

ISO 27001 certification purpose

What is the main purpose of ISO 27001 certification for an organization?

A To ensure the organization uses specific encryption algorithms

B To demonstrate that the organization has implemented an effective information security management system

C To guarantee the organization will never experience a data breach

D To comply with government-mandated cybersecurity laws

💡 Hint

ISO 27001 focuses on management systems rather than specific technologies.

ISO 27001 certification shows that an organization has a systematic approach to managing sensitive information securely.

🔍 Analysis

advanced

Comparing NIST and ISO 27001 frameworks

Which statement best describes a key difference between the NIST Cybersecurity Framework and ISO 27001?

A ISO 27001 focuses only on physical security, while NIST covers all cybersecurity aspects

B NIST requires formal certification, whereas ISO 27001 is only a set of recommendations

C Both frameworks are identical in scope and application globally

D NIST is a voluntary guideline primarily used in the US, while ISO 27001 is an international standard requiring formal certification

💡 Hint

Consider the geographic use and certification requirements of each framework.

NIST is a voluntary framework widely used in the US, while ISO 27001 is an international standard that organizations can get formally certified against.

❓ Reasoning

advanced

Applying NIST Framework functions

An organization wants to improve its ability to detect cybersecurity incidents quickly. Which NIST Framework function should it focus on?

A Protect

B Identify

C Detect

D Recover

💡 Hint

Think about which function is about finding incidents early.

The 'Detect' function in the NIST Framework focuses on timely discovery of cybersecurity events.

❓ Comparison

expert

Scope of ISO 27001 controls

Which of the following best describes the scope of controls in ISO 27001?

A A comprehensive set of controls covering organizational, technical, and physical security measures

B Only technical controls related to network security

C Controls focused solely on employee password policies

D Only physical controls for data center access

💡 Hint

ISO 27001 covers many types of controls, not just one category.

ISO 27001 includes a broad set of controls addressing organizational policies, technical safeguards, and physical security.