Free PECB NIST Cybersecurity Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB NIST Cybersecurity Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A team discovers that an attacker altered a customer record without authorization. Which information security objective was directly compromised by that alteration?

   1. A.Confidentiality
   2. B.IntegrityCorrect answer: B
   3. C.Availability
   4. D.Accountability

   Explanation: NIST defines data integrity as "The property that data has not been altered in an unauthorized manner." The unauthorized modification therefore compromises integrity.

   Reference: An Introduction to Information Security — Section 1.4, Integrity, page 3

2. 2An organization handles cybersecurity risk irregularly and case by case, and its risk strategy is managed in an ad hoc manner. Which CSF Tier most closely describes this practice?

   1. A.Tier 1: PartialCorrect answer: A
   2. B.Tier 2: Risk Informed
   3. C.Tier 3: Repeatable
   4. D.Tier 4: Adaptive

   Explanation: The notional Tier 1 illustration says: "Application of the organizational cybersecurity risk strategy is managed in an ad hoc manner." The scenario matches that description.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Appendix B, Table 2, Tier 1, page 24

3. 3An assessment identifies an unpatched software flaw that an attacker could exploit. What term describes the flaw itself?

   1. A.Threat event
   2. B.Threat source
   3. C.VulnerabilityCorrect answer: C
   4. D.Security control

   Explanation: NIST states that "A vulnerability is a weakness in a system, system security procedure, internal controls, or implementation that could be exploited by a threat source." The unpatched flaw is that weakness.

   Reference: An Introduction to Information Security — Chapter 4, page 20

4. 4A team has documented its Current and Target CSF Profiles and needs to identify the differences between them before planning improvements. Which analysis should the team perform?

   1. A.A gap analysisCorrect answer: A
   2. B.A business impact analysis
   3. C.A root cause analysis
   4. D.A vulnerability analysis

   Explanation: NIST advises teams to "Conduct a gap analysis to identify and analyze the differences between the Current and Target Profiles, and develop a prioritized action plan". The two profiles provide the comparison for improvement planning.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, CSF Profiles, step 4, page 7

5. 5An organization combines physical barriers, administrative procedures, and technical safeguards to reduce the chance of a successful attack. Which security principle does this illustrate?

   1. A.Least privilege
   2. B.Defense-in-depthCorrect answer: B
   3. C.Separation of duties
   4. D.Least common mechanism

   Explanation: NIST describes defense-in-depth as protecting systems "by implementing multi-layered security countermeasures." The combined physical, administrative, and technical measures are layers.

   Reference: An Introduction to Information Security — Section 2.6, pages 9–10

6. 6An organization uses a cloud provider to host one of its systems. Under NIST's introductory guidance, who is ultimately responsible for determining the organization's acceptable level of risk for that system?

   1. A.The organization's managementCorrect answer: A
   2. B.The cloud provider's management
   3. C.The system's control assessors
   4. D.The system's technical architects

   Explanation: NIST says: "Management personnel are ultimately responsible for determining the level of acceptable risk for a specific system and the organization as a whole". Outsourcing hosting does not transfer that organizational decision to the provider.

   Reference: An Introduction to Information Security — Section 2.2, Information security is an integral element of sound management, page 8

7. 7A cybersecurity team wants to document which CSF Core outcomes it is currently achieving and how far it has achieved them. Which CSF artifact should it use?

   1. A.Target Profile
   2. B.Community Profile
   3. C.Current ProfileCorrect answer: C
   4. D.Implementation Example

   Explanation: NIST states: "A Current Profile specifies the Core outcomes that an organization is currently achieving" and characterizes the extent to which outcomes are achieved. This matches the team's purpose.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, CSF Profiles, page 6

8. 8A risk analyst is estimating the risk associated with a possible cybersecurity event. Which two factors does NIST normally combine in its definition of risk?

   1. A.Likelihood and adverse impactCorrect answer: A
   2. B.Asset value and recovery time
   3. C.Control cost and implementation time
   4. D.Threat capability and attacker intent

   Explanation: NIST states: "risk is a function of the likelihood of a threat event’s occurrence and potential adverse impact should the event occur." These are the two factors to consider in the estimate.

   Reference: Guide for Conducting Risk Assessments — Section 2.3, Risk, page 12

9. 9Two systems encrypt a file using a secret-key algorithm. Which key must be used to decrypt that file?

   1. A.The same secret key used to encrypt itCorrect answer: A
   2. B.A different secret key shared by the systems
   3. C.The recipient's corresponding public key
   4. D.The recipient's corresponding private key

   Explanation: NIST explains: "The same key must be used to decrypt the data." With secret-key encryption, the decryption key is the same key used for encryption.

   Reference: An Introduction to Information Security — Section 9.1.1, Data Encryption, page 52

10. 10A security team has implemented safeguards for an identified threat, but some risk still remains. What is the term for that remaining risk?

    1. A.Residual riskCorrect answer: A
    2. B.Inherent risk
    3. C.Risk appetite
    4. D.Risk tolerance

    Explanation: The NIST glossary defines residual risk as the "Portion of risk remaining after security measures have been applied." That is the risk left after safeguards are in place.

    Reference: Guide for Conducting Risk Assessments — Appendix B, Glossary, Residual Risk, page B-9