200-201 Security Concepts Practice Question
An organization wants to implement a security framework that includes functions such as Identify, Protect, Detect, Respond, and Recover. Which framework aligns with this structure?
⚠ Common exam trap
Test-takers frequently confuse a security framework with a regulation or standard; candidates may pick HIPAA or PCI DSS because they are well-known in security, but only the NIST CSF explicitly defines the five functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NIST Cybersecurity Framework
The NIST Cybersecurity Framework (CSF) is explicitly organized around five core functions: Identify, Protect, Detect, Respond, and Recover. This structure provides a common language for managing cybersecurity risk and is widely adopted across industries. The framework's functions cover the full lifecycle of cybersecurity activities, from understanding assets and risks to recovering from incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NIST Cybersecurity Framework
Why this is correct
The NIST Cybersecurity Framework is structured around the five core functions: Identify, Protect, Detect, Respond, and Recover. No other framework in the stem's list uses this exact function set, so it directly matches the required structure.
- ✗
HIPAA Security Rule
Why it's wrong here
The HIPAA Security Rule mandates administrative, physical and technical safeguards for electronic protected health information; it does not organise controls into the five CSF functions. It is tempting because it is a mandatory US healthcare framework, and would be correct when the objective is protecting ePHI rather than adopting a general CSF.
- ✗
PCI DSS
Why it's wrong here
PCI DSS prescribes twelve requirements for protecting cardholder data; it contains no Identify, Protect, Detect, Respond, Recover functions, so it cannot satisfy this stem. It is tempting as a widely adopted security standard, and would be correct when the scope is securing payment card data for compliance rather than adopting a CSF.
- ✗
ISO 27001
Why it's wrong here
ISO 27001 specifies an ISMS of management clauses and Annex A controls; it does not define the five NIST Cybersecurity Framework functions, so it fails this requirement. It is tempting because it is a recognised certifiable security standard, and would be correct when the goal is formal certification of an information security management system.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.