Free D-CSF-SC-01 sample questions

Correct answer: False

False. One of the most significant changes in NIST CSF 2.0 is its expanded scope. While version 1.1 was originally designed for critical infrastructure, CSF 2.0 explicitly broadens its target audience to include organizations of all sizes, sectors, and maturities, including small businesses and educational institutions.

Correct answers: The addition of the GOVERN Function as a foundational element that informs all other Functions.; The explicit inclusion of Supply Chain Risk Management (C-SCRM) as a category under the new GOVERN Function.

CSF 2.0 introduces the GOVERN Function, expanding the original five to six Functions. It also moves and expands Cybersecurity Supply Chain Risk Management (C-SCRM) into the GOVERN Function (GV.SC). The PROTECT and DETECT functions remain distinct, and Implementation Tiers remain a core component (not replaced).

Correct answer: The executive board establishes a cybersecurity risk appetite statement that directly dictates the prioritization of assets in the IDENTIFY function and the stringency of controls in the PROTECT function.

The GOVERN Function is designed to sit at the center of the framework, taking the organization's overarching Enterprise Risk Management (ERM) directives (like risk appetite and tolerance) and using them to inform and prioritize the activities in the other five Functions. Setting a board-level risk appetite that directly drives IDENTIFY and PROTECT activities perfectly exemplifies this relationship. Options involving SIEM alerts (DETECT), backups (RECOVER), or access controls (PROTECT) are operational activities, not primary GOVERN/ERM integrations.

Correct answer: Establishing and communicating the organization's risk priorities, constraints, risk tolerances, and assumptions to all stakeholders.

The Risk Management Strategy (GV.RM) category focuses on ensuring that the organization's priorities, constraints, risk tolerance, and risk assumptions are established, communicated, and used to support operational risk decisions. It is not about mandating specific technical controls (like AES-256) or purely focusing on third-party audits, but rather setting the strategic risk parameters.

Correct answer: Policy (GV.PO)

The Policy (GV.PO) category ensures that organizational cybersecurity policy is established, communicated, and maintained. The lack of formal documentation dictating rules (like access review frequency or acceptable use) points directly to a failure in establishing and maintaining policy. While roles (GV.RR) are important, the rules themselves belong in GV.PO.

Correct answer: Documenting and communicating specific cybersecurity expectations for all personnel, including executives, third-party partners, and general employees.

GV.RR requires that cybersecurity roles, responsibilities, and authorities to foster accountability, performance assessment, and continuous improvement are established and communicated. This includes everyone from the board down to general employees and third parties, not just technical IT staff.