D-CSF-SC-23 Sample Questions & Answers

A Disaster Recovery Plan (DRP) is a technical, documented process focused on restoring IT systems and infrastructure after a disaster. It contains the specific procedures for recovery, such as failing over to a secondary region or restoring from backups. This is distinct from a Business Continuity Plan (BCP), which is broader and focuses on keeping business functions running during a disruption.

This statement is false. The NIST CSF Implementation Tiers (1-Partial, 2-Risk Informed, 3-Repeatable, 4-Adaptive) are not maturity levels. They describe the rigor of an organization's risk management practices. An organization selects a target Tier based on its business needs, risk tolerance, and threat environment; there is no requirement to progress sequentially, and a higher Tier is not always better or necessary.

The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time (e.g., 15 minutes of data, 4 hours of data). It dictates the required frequency of backups or replication. In contrast, the Recovery Time Objective (RTO) defines how quickly a system must be restored after an outage.

Data Loss Prevention (DLP) solutions are specifically designed to enforce policies that prevent sensitive data from leaving an organization's control. They work by inspecting data in use, in motion, and at rest for content that matches predefined patterns (e.g., credit card numbers, social security numbers) and blocking or alerting on unauthorized transfer attempts.

A Security Information and Event Management (SIEM) system is the core technology for addressing this problem. Its primary functions are to collect (aggregate) log and event data from diverse sources, normalize it into a common format, and apply correlation rules to identify patterns indicative of a security threat. This reduces alert fatigue by consolidating many low-level events into a single, actionable incident.

The primary purpose of an After Action Review, as outlined in RS.IM-2 (Response processes are improved), is to learn from the incident to prevent recurrence. This is achieved by conducting a thorough root cause analysis to determine not just what happened, but why it was possible. The output should be a set of tracked, actionable recommendations to improve policies, procedures, and technologies.

The Communications Plan is a critical component of both the BCP and IRP. It outlines the procedures for communicating with all relevant stakeholders (internal and external) during and after an incident. This includes who to contact, what information to share, when to share it, and the methods of communication, thereby preventing confusion and misinformation.

The Framework Core is the central part of the NIST CSF that provides the catalog of cybersecurity outcomes and activities. It is structured hierarchically with Functions (Identify, Protect, etc.) at the top, followed by Categories, Subcategories, and Informative References to other standards like ISO 27001 and COBIT.

The NIST CSF emphasizes a risk-based approach. Simply using the CVSS score is insufficient as a critical vulnerability on a non-critical asset may be a lower priority than a medium vulnerability on a mission-critical system. The most effective approach is to combine vulnerability data (threat/likelihood) with asset data (criticality/impact) to understand the actual business risk and prioritize remediation accordingly.

A one-size-fits-all approach is ineffective. Role-based training ensures content is relevant. For example, developers need training on secure coding, while finance staff need training on business email compromise.

Phishing simulations provide practical, hands-on experience in identifying malicious emails. They are a highly effective tool for measuring program effectiveness and improving user resilience against a common attack vector.

To justify the program and demonstrate improvement, it's essential to track metrics. These can include training completion rates, quiz scores, and, most importantly, behavioral metrics like phishing simulation click rates and user reporting rates.