Free PECB Certified NIST Cybersecurity Lead Implementer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified NIST Cybersecurity Lead Implementer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An organization discovers that a flawed access-control configuration could be exploited by an external actor. How does NIST SP 800-12 characterize the configuration flaw?

   1. A.A vulnerabilityCorrect answer: A
   2. B.A threat source
   3. C.A threat event
   4. D.A security control

   Explanation: NIST defines a vulnerability as "a weakness in a system, system security procedure, internal controls, or implementation that could be exploited by a threat source." The flaw is a weakness that could be exploited, rather than the actor or resulting event.

   Reference: An Introduction to Information Security — Section 4, page 20

2. 2A cybersecurity lead is documenting the CSF outcomes an organization has selected and prioritized for its future risk management objectives. Which CSF artifact describes those outcomes?

   1. A.A Current Profile
   2. B.A Target ProfileCorrect answer: B
   3. C.A Community Profile
   4. D.A CSF Tier

   Explanation: NIST states, "A Target Profile specifies the desired outcomes that an organization has selected and prioritized for achieving its cybersecurity risk management objectives." A Current Profile instead describes current achievement.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, page 6

3. 3An administrator configures accounts so users and their processes receive only authorized access needed for their assigned tasks. Which security principle is being implemented?

   1. A.Least privilegeCorrect answer: A
   2. B.Least functionality
   3. C.Separation of duties
   4. D.Fail-safe defaults

   Explanation: NIST AC-6 describes least privilege as "allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks." The configuration constrains access to that need.

   Reference: Security and Privacy Controls for Information Systems and Organizations — Control AC-6, page 36

4. 4An intrusion detection system compares observed network behavior against a profile of normal activity and alerts on substantial deviations. Which detection methodology is it using?

   1. A.Signature-based detection
   2. B.Anomaly-based detectionCorrect answer: B
   3. C.Stateful protocol analysis
   4. D.Reputation-based detection

   Explanation: NIST defines anomaly-based detection as "the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations." The system uses a behavioral profile for that comparison.

   Reference: Guide to Intrusion Detection and Prevention Systems — Section 2.3.2, page 2-4

5. 5A response team isolates an infected endpoint to stop the incident from spreading to other systems. Which incident response activity is the team performing?

   1. A.ContainmentCorrect answer: A
   2. B.Eradication
   3. C.Recovery
   4. D.Post-incident analysis

   Explanation: NIST states, "Containment refers to preventing the expansion of an incident." It gives transferring a compromised endpoint to an isolated remediation network as an example.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — CSF Community Profile, RS.MI-01, page 32

6. 6A security architect combines administrative procedures, technical defenses, and physical barriers to reduce the chance of a successful attack. Which security principle is being applied?

   1. A.Separation of duties
   2. B.Defense-in-depthCorrect answer: B
   3. C.Least privilege
   4. D.Separation of functions

   Explanation: NIST describes "defense-in-depth" as a principle that protects systems "by implementing multi-layered security countermeasures." The architect combines different kinds of defenses in layers.

   Reference: An Introduction to Information Security — Section 2.6, page 9

7. 7A company has documented its present and desired cybersecurity posture in CSF Organizational Profiles. Which comparison does NIST recommend to identify gaps for an action plan?

   1. A.Compare its Current Profile with its Target ProfileCorrect answer: A
   2. B.Compare its Current Profile with its Community Profile
   3. C.Compare its Target Profile with its Community Profile
   4. D.Compare its Community Profile with its CSF Tiers

   Explanation: NIST advises organizations to "Conduct a gap analysis to identify and analyze the differences between the Current and Target Profiles" and create a prioritized action plan. A Community Profile may inform a target but does not replace the organization's target in that comparison.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, page 7

8. 8A team implements NIST control enhancement CP-9(1) and tests stored backup information. Which properties does this enhancement seek to verify?

   1. A.Media reliability and information integrityCorrect answer: A
   2. B.Media confidentiality and information availability
   3. C.Media provenance and information classification
   4. D.Media authorization and information retention

   Explanation: CP-9(1) calls for testing backup information "to verify media reliability and information integrity." The frequency is defined by the organization.

   Reference: Security and Privacy Controls for Information Systems and Organizations — Control CP-9(1), page 126

9. 9After an intrusion detector establishes an initial profile from clean traffic, an attacker slowly increases malicious activity. The detector keeps adjusting its normal baseline and eventually incorporates that activity. Which detection model has this specific susceptibility?

   1. A.A dynamic anomaly-detection profileCorrect answer: A
   2. B.A static anomaly-detection profile
   3. C.A fixed signature-detection rule
   4. D.A stateful protocol-analysis model

   Explanation: NIST states, "If the rate of change is sufficiently slow, the IDPS might think the malicious activity is normal behavior and include it in its profile." A dynamic profile adjusts as events are observed; a static profile does not change until regenerated.

   Reference: Guide to Intrusion Detection and Prevention Systems — Section 2.3.2, pages 2-4–2-5

10. 10After containment, responders discover that a configuration file starts a malicious service automatically whenever a host reboots. Which action directly removes that persistence mechanism?

    1. A.Remove the service from the startup configurationCorrect answer: A
    2. B.Stop the service's currently running process
    3. C.Block the service's outgoing network connections
    4. D.Record the service's startup configuration

    Explanation: NIST recommends eliminating "persistence mechanisms and entry points" after containment. It also explains that "configuration files could list the services to be started automatically after system boot". Removing the malicious entry prevents that configured startup; stopping the process, blocking its connections, or recording the entry does not remove it.

    Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — CSF Community Profile, RS.MI-02, page 33