Question bank
NIST Cybersecurity Framework Foundation
40 NIST Cybersecurity Framework Foundation questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Applying the Framework and Exam Preparation
4 questions in this domain
- Question 1Single Choice
What is the very first step in the NIST CSF implementation methodology?
- APrioritize and ScopeCorrect answer
- BCreate a Current Profile
- CConduct a Risk Assessment
- DImplement an Action Plan
Why this is the answer
The methodology begins with Prioritize and Scope, where the organization identifies business objectives and defines the boundaries of the implementation. This step ensures alignment with senior leadership's risk appetite.
- Question 2Multiple Select
Which two steps are part of the NIST CSF seven‑step implementation methodology? (Select two.)
- APrioritize and ScopeCorrect answer
- BOrientCorrect answer
- CCreate a Risk Register
- DConduct a Compliance Audit
Why this is the answer
The methodology consists of seven steps: Prioritize and Scope, Orient, Create a Current Profile, Conduct a Risk Assessment, Create a Target Profile, Determine/Analyze/Prioritize Gaps, and Implement an Action Plan. Creating a risk register and conducting a compliance audit are not standalone steps in the CSF implementation process.
- Question 3Interactive
Read the scenario in the code block below. Then select the Implementation Tier that best describes the organization.
- ATier 1 – PartialCorrect answer
- BTier 2 – Risk Informed
- CTier 3 – Repeatable
- DTier 4 – Adaptive
Why this is the answer
The organization has no formal cybersecurity process and reacts only when an incident occurs. This reactive, ad‑hoc approach matches Tier 1 (Partial).
- Question 4Single Choice
What is the primary purpose of a Current Profile in the NIST CSF?
- AIt documents the organization’s existing cybersecurity outcomes.Correct answer
- BIt defines the desired future state of cybersecurity.
- CIt establishes the organization’s risk appetite.
- DIt serves as a compliance checklist for regulations.
Why this is the answer
The Current Profile answers 'Where are we now?' by mapping current practices to the Framework Core outcomes. It is a snapshot of what is currently implemented, not the desired state (Target Profile) nor risk appetite.
Framework Core - Identify Function
8 questions in this domain
- Question 5Single Choice
According to the NIST CSF, what is the foundational prerequisite before implementing any cybersecurity controls?
- AEstablishing a complete and accurate asset inventoryCorrect answer
- BDeploying a firewall at the network perimeter
- CConducting a vulnerability scan on all systems
- DInstalling endpoint protection software on all workstations
Why this is the answer
Asset Management (ID.AM) is the foundational discipline under the Identify function. Without knowing what assets exist, their classification, and ownership, no other cybersecurity activity (Protect, Detect, Respond) can be effectively performed. The framework emphasizes that you cannot protect what you do not know.
- Question 6Multiple Select
Which of the following are key components of Asset Management (ID.AM) as defined in the NIST CSF? (Select two answers)
- AAsset InventoryCorrect answer
- BAsset OwnershipCorrect answer
- CThreat Identification
- DVulnerability Scanning
Why this is the answer
Asset Management (ID.AM) encompasses asset inventory, classification, and ownership. Threat Identification belongs to Risk Assessment (ID.RA), and vulnerability scanning is part of the Protect or Detect functions, not a core ID.AM component.
- Question 7Interactive
Review the following CSV excerpt representing an asset inventory. According to NIST CSF Asset Management (ID.AM), which assets are missing an assigned owner? (Select all that apply)
- AServer1
- BServer2Correct answer
- CDatabase
- DContractor JohnCorrect answer
Why this is the answer
Asset ownership is a requirement under ID.AM. In the inventory, Server2 and Contractor John have no owner listed, making them non-compliant. Server1 and Database already have designated owners.
- Question 8Single Choice
Which Business Environment (ID.BE) subcategory requires an organization to define its role and dependencies within the supply chain?
- AID.BE-1Correct answer
- BID.BE-2
- CID.BE-3
- DID.BE-4
Why this is the answer
ID.BE-1 is defined as 'Organizational role in supply chain'. ID.BE-2 refers to critical infrastructure place, ID.BE-3 deals with mission objectives, and ID.BE-4 covers dependencies and critical functions. Only ID.BE-1 explicitly addresses supply chain role.
- Question 9Multiple Select
Which of the following activities belong to the Governance (ID.GV) category of the NIST CSF Identify function? (Select two answers)
- AApproving the cybersecurity policyCorrect answer
- BInstalling network firewalls
- CIdentifying legal and regulatory requirementsCorrect answer
- DConducting penetration tests
Why this is the answer
ID.GV includes policy approval (board-level governance) and identification of legal/regulatory requirements. Installing firewalls is a Protect function activity, and penetration testing belongs to Risk Assessment (ID.RA) or Detect, not Governance.
- Question 10Interactive
Examine the following list of activities. Based on the NIST CSF, which one is NOT part of Risk Assessment (ID.RA)?
- AThreat Identification
- BVulnerability Analysis
- CControl ImplementationCorrect answer
- DImpact Analysis
Why this is the answer
Risk Assessment (ID.RA) involves threat identification, vulnerability analysis, and impact analysis. Control implementation belongs to the Protect function (PR) and is not part of ID.RA.
- Question 11Single Choice
In the NIST CSF, what is the primary difference between risk appetite and risk tolerance?
- ARisk appetite is broad and strategic; risk tolerance is specific and often quantitativeCorrect answer
- BRisk appetite is set by the CISO; risk tolerance is set by the board
- CRisk appetite is measured in dollars; risk tolerance is measured in hours
- DThere is no difference; the terms are interchangeable
Why this is the answer
Risk appetite is a high-level, strategic statement of willingness to accept risk, typically set by senior leadership. Risk tolerance is the specific, measurable threshold applied to individual risks and is derived from the appetite. The NIST emphasizes this distinction in ID.RM.
- Question 12Multiple Select
Which of the following are recognized subcategories of Supply Chain Risk Management (ID.SC) in the NIST CSF? (Select two answers)
- AID.SC-1: Cyber Supply Chain Risk Management ProgramCorrect answer
- BID.SC-2: Third-party Dependencies IdentificationCorrect answer
- CID.AM-1: Asset Inventory
- DID.RA-3: Threat Identification
Why this is the answer
ID.SC-1 and ID.SC-2 are specific subcategories of Supply Chain Risk Management. ID.AM-1 belongs to Asset Management, and ID.RA-3 belongs to Risk Assessment, not to ID.SC.
Framework Core - Protect, Detect, and Respond Functions
14 questions in this domain
- Question 13Single Choice
Which NIST CSF Protect category ensures that only authorized users, devices, and processes are granted access to assets and data?
- APR.ACCorrect answer
- BPR.AT
- CPR.DS
- DPR.IP
Why this is the answer
PR.AC (Access Control) manages identities, credentials, and physical access to ensure only authorized users and devices can access assets.
- Question 14Multiple Select
Which two categories are part of the NIST CSF Detect Function? (Select two)
- ADE.AECorrect answer
- BDE.CMCorrect answer
- CRS.RP
- DPR.AC
Why this is the answer
DE.AE (Anomalies and Events) and DE.CM (Continuous Monitoring) are the two categories of the Detect Function. RS.RP is Respond, PR.AC is Protect.
- Question 15Interactive
Based on the incident response timeline, which Respond category does the action at 10:55 belong to?
- ARS.RP
- BRS.CO
- CRS.AN
- DRS.MICorrect answer
Why this is the answer
Isolating a host is a mitigation action (RS.MI) to contain the incident.
- Question 16Single Choice
Which Protect subcategory focuses on protecting data at rest?
- APR.DS-1Correct answer
- BPR.DS-2
- CPR.AC-3
- DPR.PT-3
Why this is the answer
PR.DS-1 specifically addresses protection of data at rest, such as full-disk encryption.
- Question 17Multiple Select
Which two are key elements of the Respond Function? (Select two)
- ARS.RPCorrect answer
- BRS.IMCorrect answer
- CDE.AE
- DPR.MA
Why this is the answer
RS.RP (Response Planning) and RS.IM (Improvements) are categories of the Respond Function. DE.AE is Detect, PR.MA is Protect.
- Question 18Interactive
Refer to the firewall rule snippet. Which Protect subcategory does this configuration support?
- APR.PT-3Correct answer
- BPR.PT-1
- CPR.AC-4
- DPR.DS-2
Why this is the answer
The rule blocks all but essential ports, implementing least functionality (PR.PT-3).
- Question 19Single Choice
What is the primary purpose of the Detect Function?
- APrevent incidents from occurring
- BIdentify incidents in a timely mannerCorrect answer
- CRestore normal operations after an incident
- DDevelop response plans
Why this is the answer
The Detect Function is designed to identify the occurrence of a cybersecurity event in a timely manner.
- Question 20Multiple Select
Which two categories are part of the Protect Function? (Select two)
- APR.ATCorrect answer
- BPR.IPCorrect answer
- CRS.AN
- DDE.CM
Why this is the answer
PR.AT (Awareness and Training) and PR.IP (Information Protection Processes) are categories of the Protect Function. RS.AN is Respond, DE.CM is Detect.
- Question 21Interactive
The code block shows a log entry. Which Detect subcategory is most directly relevant to this activity?
- ADE.CM-1Correct answer
- BDE.CM-3
- CDE.AE-1
- DDE.DP-1
Why this is the answer
The log captures network traffic from an external IP, which aligns with network monitoring (DE.CM-1).
- Question 22Single Choice
Which Respond category involves executing the incident response plan during an incident?
- ARS.RPCorrect answer
- BRS.CO
- CRS.MI
- DRS.IM
Why this is the answer
RS.RP (Response Planning) mandates that the organization executes its response plan during and after an incident.
- Question 23Multiple Select
Which two are examples of Protective Technology (PR.PT) activities? (Select two)
- ADeploying firewallsCorrect answer
- BConfiguring audit/log recordsCorrect answer
- CConducting phishing simulations
- DEstablishing baselines for network behavior
Why this is the answer
Firewalls and audit/log records are examples of protective technology. Phishing simulations relate to PR.AT, baselines relate to DE.AE.
- Question 24Interactive
The code block describes a response action. Which Respond category does this belong to?
- ARS.IMCorrect answer
- BRS.RP
- CRS.AN
- DRS.MI
Why this is the answer
Updating detection rules based on lessons learned is an improvement activity (RS.IM).
- Question 25Single Choice
In the context of SOC alignment with NIST CSF, which Function is primarily supported by continuous monitoring?
- AProtect
- BDetectCorrect answer
- CRespond
- DRecover
Why this is the answer
Continuous monitoring is a core activity of the Detect Function (DE.CM) in the SOC.
- Question 26Multiple Select
Which two are common traps when studying the Protect Function? (Select two)
- AConfusing awareness training with risk assessmentCorrect answer
- BAssociating backup planning only with RecoverCorrect answer
- CTreating all users the same in training
- DAssuming data security only covers encryption
Why this is the answer
Two common traps: confusing PR.AT with ID.RA, and thinking backup planning (PR.IP-4) belongs only to Recover. The other options are also traps but not both listed; the correct two are these based on the document.
Framework Core - Recover Function and Overall Framework Governance
8 questions in this domain
- Question 27Single Choice
According to the NIST CSF, what is the primary purpose of the Recover Function?
- AContain and eradicate threats
- BRestore capabilities or services impaired by an incidentCorrect answer
- CDetect anomalies in network traffic
- DIdentify assets and risks
Why this is the answer
The Recover Function focuses on restoring normal operations after a cybersecurity incident, distinct from the Respond Function which handles containment and eradication.
- Question 28Multiple Select
Which of the following are categories within the Recover Function? (Select two)
- ARecovery Planning (RC.RP)Correct answer
- BIncident Response (RS.RP)
- CImprovements (RC.IM)Correct answer
- DDetection Processes (DE.DP)
Why this is the answer
The Recover Function has three categories: Recovery Planning, Improvements, and Communications. Incident Response is part of Respond, Detection is part of Detect.
- Question 29Interactive
The IT team executes a script to restore the customer database from a backup. After restoration, they verify integrity. According to the CSF, which step is missing to fully satisfy the Recover Function?
- AActivate the incident response plan
- BConduct a post-incident review and capture lessons learnedCorrect answer
- CIsolate the affected network segment
- DNotify law enforcement
Why this is the answer
The Recover Function includes Improvements (RC.IM) which require capturing lessons learned and updating plans. Technical restoration alone is insufficient.
- Question 30Single Choice
What do the NIST CSF Implementation Tiers primarily describe?
- AThe maturity of an organization's security controls
- BThe degree to which risk management processes are integrated and adaptiveCorrect answer
- CThe number of cybersecurity incidents handled
- DThe budget allocated to cybersecurity
Why this is the answer
Tiers describe the rigor of risk management processes from Partial (ad hoc) to Adaptive (continuous improvement), not control maturity or incident count.
- Question 31Multiple Select
Which statements about Current and Target Profiles are correct? (Select two)
- AThe Current Profile represents the desired cybersecurity state
- BThe Target Profile is based on business requirements and risk appetiteCorrect answer
- CProfiles are static and should not be changed after approval
- DGap analysis compares Current and Target ProfilesCorrect answer
Why this is the answer
The Current Profile is the as-is state; the Target Profile is the to-be state driven by business needs. Profiles are dynamic and updated regularly.
- Question 32Interactive
The code below outlines a self-assessment process. According to the CSF, what critical step must occur before creating the Target Profile?
- AConduct a vulnerability scan
- BObtain executive approval and input from stakeholdersCorrect answer
- CDevelop a disaster recovery plan
- DPurchase new security tools
Why this is the answer
The Target Profile requires alignment with business strategy and risk appetite, necessitating stakeholder input and senior leadership approval.
- Question 33Single Choice
When communicating cybersecurity posture to the board of directors, which format is most appropriate?
- ADetailed vulnerability reports
- BRisk heat maps and key performance indicatorsCorrect answer
- CRaw system logs
- DPassword policy documents
Why this is the answer
The board needs high-level, business-oriented summaries like risk heat maps and KPIs, not technical details or raw data.
- Question 34Multiple Select
Which of the following are true about Business Continuity and Disaster Recovery integration with the Recover Function? (Select two)
- ABusiness continuity focuses solely on IT system restoration
- BRecovery plans must be tested and aligned with business continuity objectivesCorrect answer
- CGovernance requires senior leadership to define recovery prioritiesCorrect answer
- DDisaster recovery is the same as business continuity
Why this is the answer
Recovery plans align with BC objectives and are tested. Governance (ID.GV) requires leadership to set RTOs/RPOs. BC is broader than IT, DR is a subset.
Introduction to the NIST Cybersecurity Framework
6 questions in this domain
- Question 35Single Choice
Which Executive Order led to the creation of the NIST Cybersecurity Framework?
- AExecutive Order 13636Correct answer
- BExecutive Order 13800
- CExecutive Order 14028
- DExecutive Order 13231
Why this is the answer
Executive Order 13636, issued in 2013, directed NIST to develop a voluntary risk-based cybersecurity framework for critical infrastructure.
- Question 36Multiple Select
Which of the following are benefits of adopting the NIST Cybersecurity Framework?
- AEstablishing a common language for cybersecurity risk managementCorrect answer
- BGuaranteeing compliance with all regulations
- CEnabling risk-based prioritization of security investmentsCorrect answer
- DEliminating all cybersecurity risks
Why this is the answer
The NIST CSF provides a common language, supports risk-based prioritization, and promotes continuous improvement. It does not guarantee compliance or eliminate all risks.
- Question 37Interactive
Based on the subcategory identifier shown, which Framework function does it belong to?
- AIdentifyCorrect answer
- BProtect
- CDetect
- DRespond
Why this is the answer
ID.AM-1 is under the Identify function, specifically the Asset Management category.
- Question 38Single Choice
In which version of the NIST Cybersecurity Framework was the 'Govern' function introduced?
- ACSF 1.0
- BCSF 1.1
- CCSF 2.0Correct answer
- DCSF 1.2
Why this is the answer
The Govern function was added in CSF 2.0, released in 2024, to emphasize governance and enterprise risk management.
- Question 39Multiple Select
Which of the following are valid Implementation Tiers defined by the NIST Cybersecurity Framework?
- APartialCorrect answer
- BRisk-InformedCorrect answer
- CRepeatableCorrect answer
- DAdaptiveCorrect answer
Why this is the answer
The four Implementation Tiers are Partial (Tier 1), Risk-Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4).
- Question 40Interactive
How many distinct Framework functions are represented by the subcategory identifiers in the code block?
- A2Correct answer
- B1
- C3
- D4
Why this is the answer
PR.AC-1 and PR.DS-1 are under the Protect function (PR), while DE.AE-1 is under Detect (DE). Therefore, two functions are represented.
Frequently asked questions
Everything about the NIST Cybersecurity Framework Foundation question bank and how to use it.