Security Frameworks and CIS Controls practice questions

Unauthorized software has been installed on the listed assets.

Why it fails: The exhibit identifies a failure to enable encryption, not the presence of unauthorized applications. While unauthorized software is a security concern, the JSON object specifically flags encryption status, which is a data-at-rest protection mechanism unrelated to the application control or software integrity monitoring functions of the system.

The audit script failed to scan the network assets correctly.

Why it fails: There is no indication in the provided JSON to suggest a scanning error or a connectivity issue. The output provides specific asset identifiers (WS-001, WS-004, SRV-09) and a clear status, which implies the scan performed as expected, successfully identifying assets that do not meet the hardening requirements.

The assets are missing critical OS security patches.

Why it fails: The JSON explicitly references the action of enabling full disk encryption. It does not provide information regarding patch management status or vulnerability exposure levels. While missing patches represent a different security risk, this specific audit entry is focused entirely on the configuration of encryption services on disk.

Perform a daily scan of the network to identify rogue access points.

Why it fails: Identifying rogue access points is a function of network infrastructure security and falls under the scope of CIS Control 12: Network Infrastructure Management. It is not a direct requirement of Access Control Management, which is primarily focused on user accounts, permissions, and authentication mechanisms for enterprise assets.

Ensure all workstations are running the latest antivirus signature files.

Why it fails: Antivirus management and signature updates are components of CIS Control 10: Malware Defenses. While these tasks are essential for endpoint security, they fall outside the domain of Access Control Management, which is concerned with identity, authentication, and authorization of users and service accounts to enterprise systems.

Provide security awareness training to all employees annually.

Why it fails: Security awareness training is addressed by CIS Control 14: Security Awareness and Skills Training. This control focuses on educating the workforce on potential threats and safe behaviors. It is distinct from Access Control Management, which focuses on technical enforcement of user permissions and identity verification processes within infrastructure.

NIST Privacy Framework

Why it fails: The NIST Privacy Framework is designed to manage privacy risk and focuses on data privacy, not cybersecurity defense or technical infrastructure hardening. It is a separate framework focused on organizational privacy outcomes rather than the technical mitigation of common cyber attack vectors like malware or unauthorized access.

ISO/IEC 27001

Why it fails: ISO/IEC 27001 is a standard for an Information Security Management System (ISMS). It focuses on the governance and management of security processes rather than specific technical configurations or prioritized sets of tactical actions to defend against immediate, known cyber threats. It is more about policy than technical implementation.

COBIT

Why it fails: COBIT is a framework for IT governance and management. It focuses on aligning IT goals with business goals and managing risks at an enterprise level. It is not primarily designed as a technical framework for mitigating specific cyber attack vectors through hardened configurations or security technical controls.

Updating antivirus signature files on all endpoints daily.

Why it fails: Antivirus updates are part of CIS Control 10: Malware Defenses. While necessary for endpoint security, they are not part of the vulnerability management lifecycle, which focuses on identified software flaws and configuration weaknesses. Confusing these controls can lead to inefficient security efforts and gaps in the vulnerability management program.

Maintaining an inventory of all physical hardware devices.

Why it fails: Asset inventory is the focus of CIS Control 1. While the vulnerability management team needs to know what assets exist to scan them, the act of maintaining the hardware inventory itself is a distinct control and is not considered a component of the vulnerability management process.

Conducting regular vulnerability scans on all network segments.

Why it fails: Vulnerability scanning is part of CIS Control 7 (Continuous Vulnerability Management). While it helps identify misconfigurations, it is not a required activity for establishing secure configurations. Control 4 focuses on proactive hardening and configuration management, not on scanning.

Implementing a whitelist of approved applications that are allowed to run.

Why it fails: Application whitelisting is part of CIS Control 2 (Inventory and Control of Software Assets) or Control 8 (Malware Defenses), not Control 4. While it contributes to a secure configuration, it is not one of the explicitly required activities for secure configuration management.

Enforcing automatic session locking after a period of inactivity on all user devices.

Why it fails: Automatic session locking is a good security practice, but it is not explicitly required by CIS Control 4. It falls under access control or endpoint protection. While it can be part of a secure configuration baseline, the control's primary focus is on hardening configurations, not session management.

Implement and manage a firewall on all enterprise assets.

Why it fails: While firewalls are important, CIS Control 4 does not explicitly require a firewall on all assets. Firewall management is addressed in CIS Control 9 (Email and Web Browser Protections) and Control 12 (Network Infrastructure Management). Control 4 focuses on secure configuration of the assets themselves, such as disabling unnecessary services and changing default passwords. Requiring a firewall on every asset is not a specific safeguard of Control 4.

Enforce the use of unique passwords for all enterprise assets.

Why it fails: Unique password enforcement is part of CIS Control 5 (Account Management) and Control 6 (Access Control Management). Control 4 addresses secure configuration, which may include password policies as part of system hardening, but the explicit requirement for unique passwords is found in access control controls. Therefore, it is not a specific requirement of Control 4.

Deploy endpoint detection and response (EDR) agents on all enterprise assets.

Why it fails: EDR deployment is not a requirement of CIS Control 4. EDR is related to CIS Control 10 (Malware Defenses) and Control 13 (Network Monitoring and Defense). Control 4 is about secure configuration, such as hardening operating systems and applications. While EDR can complement secure configuration, it is not explicitly mandated by this control. Organizations should look to other controls for endpoint detection requirements.

CIS Control 1: Inventory and Control of Enterprise Assets

Why it fails: This control focuses on identifying and tracking all enterprise assets to ensure visibility. While visibility is essential for security, simply knowing what devices are on the network does not inherently prevent unauthorized software or enforce secure configurations on those devices, which is the primary objective of this scenario.

CIS Control 2: Data Protection

Why it fails: Data protection focuses on encryption, data classification, and ensuring data integrity during storage and transit. While these activities are critical for regulatory compliance and preventing data loss, they do not address the technical configuration hardening of workstation operating systems or the management of authorized software applications.

CIS Control 8: Audit Log Management

Why it fails: Audit log management is vital for incident response and forensic analysis after an event has occurred. However, it is a detective control rather than a preventive configuration control. It does not proactively enforce hardening standards or prevent the installation of unauthorized software on user workstations by design.

CIS Control 1: Inventory and Control of Enterprise Assets

Why it fails: Control 1 focuses on the inventory of physical hardware devices. While essential for overall visibility, it does not explicitly track the applications installed on those devices. The 'shadow IT' issue described is specifically related to software, which requires a software-centric inventory process to effectively mitigate the risk.

CIS Control 3: Data Protection

Why it fails: Data protection focuses on the classification and security of data itself. While managing software is a prerequisite for protecting data, the primary control for visibility into installed software remains Control 2. Control 3 would not provide the necessary mechanisms to inventory and manage software applications across the environment.

CIS Control 7: Continuous Vulnerability Management

Why it fails: Vulnerability management relies on knowing what software is present, but it is not the control that establishes the inventory. Control 7 focuses on scanning for and remediating vulnerabilities within existing software. Without a solid foundation of software inventory (Control 2), vulnerability management efforts will be incomplete and ineffective.

Running a full system backup every night at 2:00 AM.

Why it fails: Running a backup is a standard operational task, but it does not verify that the data is recoverable. Without performing a test restore, the organization has no assurance that the backup files are not corrupted or that the restoration process itself will be successful when actually needed.

Storing all backup tapes in an off-site, climate-controlled facility.

Why it fails: Off-site storage is a best practice for disaster recovery and physical security, but it does not constitute a test of the recovery process. Proper storage protects the physical media, but it does not address the logical integrity of the data or the capability to restore it successfully.

Encrypting all backup media to prevent unauthorized access.

Why it fails: Encryption is an essential security requirement for protecting backup data from unauthorized disclosure, but it is not a test of the recovery process. A backup could be perfectly encrypted and stored securely, yet still fail to restore due to formatting issues, logical errors, or hardware failure.

Encryption of email traffic between mail servers.

Why it fails: DMARC does not provide encryption for email traffic. Encryption for transit is typically handled by protocols like TLS (Transport Layer Security). DMARC is an authentication mechanism designed to verify the sender's identity and detect spoofing, not to ensure confidentiality or privacy of the email content while it is moving.

Hardening web browser settings to prevent XSS attacks.

Why it fails: Web browser protections in CIS Control 9 focus on security settings like disabling insecure plug-ins and using secure configuration templates to prevent attacks such as XSS. DMARC is strictly an email authentication protocol and provides no direct protection for web browser behavior or web-based application vulnerabilities.

Scanning of inbound email attachments for malware signatures.

Why it fails: Scanning email attachments for malware is a function of an email security gateway or antivirus solution. DMARC does not inspect the content of emails or attachments. It solely validates the identity of the sender to ensure the email genuinely originated from the claimed domain owner.

Conduct a penetration test to identify vulnerabilities in the organization's external-facing infrastructure.

Why it fails: Penetration testing is a point-in-time activity that identifies technical vulnerabilities but does not provide a continuous measurement of security posture across all CIS Controls. It fails to address the need for a structured, repeatable method to assess and prioritize improvements aligned with the CIS Controls framework.

Deploy a SIEM solution to collect and correlate security events from all network devices.

Why it fails: A SIEM enhances detection and response capabilities but does not measure the effectiveness of the overall security program against the CIS Controls. It focuses on monitoring and alerting rather than providing a risk-based assessment and prioritization mechanism, which is what the CISO requires to track posture and drive improvements.

Implement the NIST Cybersecurity Framework to map current activities to the five core functions.

Why it fails: While the NIST CSF provides a common language for cybersecurity activities, it is not specifically designed to measure the effectiveness of CIS Controls implementation. The scenario requires alignment with CIS Controls and a method to prioritize improvements; NIST CSF alone does not offer the granular, control-specific assessment and prioritization that CIS RAM provides.

Require employees to complete a computer-based training module on phishing once per quarter and pass a quiz.

Why it fails: Quarterly training with a quiz is more frequent than annual but still lacks the continuous reinforcement and real-world simulation that CIS Control 14 advocates. Quizzes may test knowledge but not behavior. The control requires simulated phishing to practice recognition and reporting, which this option does not include, making it less effective at reducing actual susceptibility.

Send monthly security newsletters to all staff highlighting recent phishing trends and best practices.

Why it fails: Newsletters can raise awareness but are passive and do not provide the interactive, hands-on practice required to reduce phishing susceptibility. CIS Control 14 emphasizes simulated phishing and role-based training, not just informational communications. Without active testing and feedback, the organization cannot measure or improve employee resilience to phishing.

Conduct annual security awareness training for all employees and track completion rates.

Why it fails: Annual training alone is insufficient for reducing phishing susceptibility. CIS Control 14 requires continuous, role-based training and simulated phishing exercises to reinforce skills. Simply tracking completion does not measure effectiveness or change behavior, and it fails to address the need for ongoing reinforcement and practical application.

IG0

Why it fails: IG0 is not a recognized Implementation Group in the CIS Critical Security Controls framework. The CIS Controls define only IG1, IG2, and IG3. Choosing IG0 would indicate a misunderstanding of the framework's structure and would not provide a valid roadmap for the startup's security program.

IG2

Why it fails: IG2 is intended for organizations that manage sensitive client or enterprise data and face moderate risk. It includes all IG1 safeguards plus additional controls for access management, logging, and vulnerability management. Applying IG2 here would impose unnecessary overhead on a small startup with no sensitive data or compliance drivers.

IG3

Why it fails: IG3 targets large, mature organizations with dedicated security teams and high-value assets, such as those in critical infrastructure or regulated industries. It requires advanced controls like application whitelisting and network segmentation. This startup lacks the resources and risk profile that justify IG3 implementation.

Deploying a data loss prevention (DLP) solution to monitor outbound email containing patient data.

Why it fails: DLP helps prevent unauthorized exfiltration of data, but it does not encrypt data at rest. CIS Control 3 requires encryption of stored data, not just monitoring of data flows. DLP is a complementary control but does not fulfill the encryption safeguard.

Configuring database backup files to be stored in a separate physical location with access controls.

Why it fails: Physical separation and access controls protect backups from unauthorized access, but they do not encrypt the data. CIS Control 3 requires that data at rest be encrypted, regardless of location. Backup files containing PHI must also be encrypted to meet the safeguard.

Implementing TLS 1.2 for all web traffic to and from the electronic health record system.

Why it fails: TLS 1.2 encrypts data in transit, not at rest. While important for protecting data during transmission, it does not satisfy the requirement for encrypting stored data. CIS Control 3 distinguishes between data in transit and data at rest, and this action only covers the former.

Email and Web Browser Protections

Why it fails: Email and Web Browser Protections is CIS Control 9. It addresses common attack vectors but is not the first control. It assumes that assets are inventoried and configured securely. Implementing it without asset visibility would leave gaps in coverage.

Continuous Vulnerability Management

Why it fails: Continuous Vulnerability Management is CIS Control 7. While important, it depends on having an up-to-date asset inventory to scan. Without knowing what assets exist, vulnerability management efforts would be incomplete or misdirected. Therefore, it is not the first basic control.

Controlled Use of Administrative Privileges

Why it fails: Controlled Use of Administrative Privileges is CIS Control 5. It focuses on managing privileged accounts, which is critical but not the initial step. You must first know what systems and accounts exist before you can control privileges. Thus, it follows asset inventory.

Implementation Groups are used exclusively by small businesses, while large enterprises must implement all 18 controls regardless of risk.

Why it fails: Implementation Groups are not exclusive to small businesses. Large enterprises also use them to prioritize based on risk. The CIS Controls recommend that all organizations start with IG1 safeguards, but larger organizations with higher risk may need IG2 or IG3. The groups are not defined by organization size but by risk profile and available resources.

Implementation Groups are optional certifications that an organization can obtain to demonstrate compliance with the CIS Controls.

Why it fails: Implementation Groups are not certifications. They are guidance categories within the CIS Controls framework. While CIS offers various assessment tools, the Implementation Groups themselves are not something an organization gets certified for. They are used for internal prioritization and communication of security posture, not as a formal certification.

Implementation Groups are maturity levels that an organization must sequentially achieve, with IG1 being the lowest and IG3 the highest.

Why it fails: Implementation Groups are not maturity levels; they are categorization schemes based on risk and resources. An organization does not need to progress from IG1 to IG2 to IG3. Instead, it selects the IG that matches its profile. Treating them as sequential maturity stages misrepresents the framework and could lead to unnecessary work or misaligned priorities.

Implementing multi-factor authentication for all administrative access to servers.

Why it fails: Multi-factor authentication is a critical control, often associated with CIS Control 6, but it focuses on authentication strength, not account lifecycle. The scenario specifically asks about managing the lifecycle, which includes creation, modification, and deletion of accounts.

Deploying a privileged access management (PAM) solution to vault administrative credentials.

Why it fails: PAM solutions help manage privileged accounts, which is part of CIS Control 5, but they do not cover the full lifecycle of all user accounts. The scenario is about general user account management, not just privileged accounts. PAM is a subset and does not address inactive standard accounts.

Enforcing a password complexity policy that requires 12 characters with mixed case and symbols.

Why it fails: Password complexity is part of CIS Control 5 (Administrative Privileges) or Control 4 (Secure Configuration), but it does not address the lifecycle management of accounts. While important, it does not ensure that accounts are disabled when users leave or become inactive.

Deploying an automated asset discovery tool to scan the network for all connected devices.

Why it fails: While automated discovery is important, it is not the first step. Without a defined process and ownership, the tool may produce incomplete or unmanaged data. The CIS Control 1 requires establishing and maintaining an accurate, detailed, and up-to-date inventory. The first step is to define the scope and responsibilities, then use tools to support the process.

Implementing a configuration management database (CMDB) to store asset information.

Why it fails: A CMDB is a tool that can support the inventory, but it is not the first step. Without a policy defining scope and ownership, the CMDB may be populated with irrelevant or incomplete data. The CIS Control emphasizes the process and governance before tooling. A CMDB is useful but should follow the establishment of requirements and responsibilities.

Conducting a manual inventory of all assets in the data center.

Why it fails: Manual inventory can be error-prone and quickly outdated. While it might provide a starting point, it is not the most critical first step. The CIS Control requires an automated, accurate, and maintained inventory. Manual efforts alone cannot keep pace with changes. The first step should be to define the policy and scope, then implement automated discovery and tracking.

Implementation Group 3 (IG3) because it offers the highest level of security.

Why it fails: IG3 is for high-risk organizations with significant resources, such as large enterprises or critical infrastructure. A small marketing agency does not typically face the same threat landscape and lacks the resources to implement all 153 safeguards. Choosing IG3 would be impractical and could lead to incomplete implementation and wasted effort.

Implementation Group 2 (IG2) because it includes additional safeguards for moderate risk organizations.

Why it fails: IG2 is intended for organizations with moderate risk and more resources. A small marketing agency with limited IT staff may find IG2's 130 safeguards overwhelming and unnecessary if their risk profile is low. While they could eventually progress to IG2, starting with IG1 is more appropriate to build a foundation without overextending resources.

None of the Implementation Groups; they should develop a custom framework from scratch.

Why it fails: Developing a custom framework is unnecessary and inefficient. The CIS Controls, particularly IG1, provide a well-vetted set of safeguards that address common threats. A small agency can adopt IG1 and tailor it as needed. Creating a custom framework would require significant expertise and time, which they likely lack.

Designating a single individual as the incident response coordinator without a formal team.

Why it fails: CIS Control 17 requires establishing an incident response process that includes defining roles and responsibilities. Designating a single individual without a formal team and documented process does not meet the requirement. The control emphasizes a structured approach with clear escalation paths and team coordination. A lone coordinator lacks the necessary structure and support.

Conducting an annual tabletop exercise without updating the incident response plan based on findings.

Why it fails: Tabletop exercises are important, but they must be part of a continuous improvement cycle. CIS Control 17 requires that the incident response plan be updated based on lessons learned from exercises and actual incidents. Conducting an exercise without updating the plan misses the opportunity to improve and does not fully satisfy the control's requirements for maintaining an effective process.

Purchasing an incident response automation tool to streamline handling of security incidents.

Why it fails: While automation can enhance incident response, it is not the foundational requirement. CIS Control 17 first requires establishing a documented incident response process, including roles, responsibilities, and communication plans. Tools support the process but do not replace the need for a formalized plan. Without a defined process, automation may be misdirected or ineffective.