CRISC Information Technology and Security Practice Question
Which of the following is a primary goal of the 'Protect' function in the NIST Cybersecurity Framework?
⚠ Common exam trap
CRISC often tests the distinction between the five CSF functions, especially Protect vs. Detect vs. Respond, by using similar phrasing ('develop and implement appropriate activities to...') for each.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Develop and implement appropriate safeguards to ensure delivery of critical services
The NIST Cybersecurity Framework's Protect function (PR) is defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. It covers areas like access control, awareness training, data security, and protective technology — all aimed at limiting or containing the impact of a potential cybersecurity event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Develop and implement appropriate activities to identify the occurrence of a cybersecurity event
Why it's wrong here
Identifying the occurrence of a cybersecurity event belongs to the Detect function, not Protect. Protect covers safeguards such as access control, awareness training and data security that limit or contain the impact of an event; it is tempting because both functions support incident response.
- ✓
Develop and implement appropriate safeguards to ensure delivery of critical services
Why this is correct
The Protect function covers safeguards that limit or contain the impact of a cybersecurity event, directly supporting delivery of critical services. It spans identity management, access control, awareness training, data security and protective technology, matching the goal of implementing appropriate safeguards.
- ✗
Develop and implement appropriate activities to take action regarding a detected cybersecurity event
Why it's wrong here
Taking action on a detected event is the 'Respond' function, covering response planning, communications, analysis and mitigation. Protect concerns limiting or containing the impact of a potential event through safeguards. It tempts because responding feels protective, but it is correct only when the stem asks about incident handling after detection.
- ✗
Develop and implement appropriate activities to maintain plans for resilience
Why it's wrong here
Maintaining resilience plans belongs to the NIST CSF 'Recover' function, which restores capabilities impaired by an incident. Protect instead covers safeguards such as access control, awareness training and data security. It tempts because resilience planning sounds protective, yet it is the correct answer only when the question asks about recovery activities.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.