Cyber Security Management Professional CSMP

1. What is the main goal of cybersecurity?

a) Develop secure software

Correct Incorrect Correct answer

b) Protect information and systems from unauthorized access

Correct Incorrect Correct answer

c) Control communication networks

Correct Incorrect Correct answer

d) Implement ISO standards

Correct Incorrect Correct answer

2. Which of the following is NOT considered an asset in cyberspace?

a) Information

Correct Incorrect Correct answer

b) Software

Correct Incorrect Correct answer

c) Social media platforms

Correct Incorrect Correct answer

d) Reputation

Correct Incorrect Correct answer

3. According to the material, what best defines cyberspace?

a) A controlled physical environment

Correct Incorrect Correct answer

b) A complex environment formed by the interaction of people, software, and services

Correct Incorrect Correct answer

c) A private network of hardware systems

Correct Incorrect Correct answer

d) An exclusive domain of tech companies

Correct Incorrect Correct answer

4. Who are the main stakeholders in cyberspace?

a) Only providers

Correct Incorrect Correct answer

b) Consumers, providers, and organizations

Correct Incorrect Correct answer

c) Governments only

Correct Incorrect Correct answer

d) Financial institutions

Correct Incorrect Correct answer

5. Which of the following is an example of an intangible asset?

a) Web server

Correct Incorrect Correct answer

b) Computer

Correct Incorrect Correct answer

c) Reputation

Correct Incorrect Correct answer

d) Antivirus software

Correct Incorrect Correct answer

6. Which combination of strategies is most effective to address cybersecurity risks?

a) Only technological solutions

Correct Incorrect Correct answer

b) Education, best practices, and technology

Correct Incorrect Correct answer

c) External audits only

Correct Incorrect Correct answer

d) Web content filtering

Correct Incorrect Correct answer

7. Which international standard provides guidelines for cybersecurity?

a) ISO/IEC 9001

Correct Incorrect Correct answer

b) ISO/IEC 27032

Correct Incorrect Correct answer

c) ISO 14001

Correct Incorrect Correct answer

d) ISO 22301

Correct Incorrect Correct answer

8. What is the main objective of the NICE Framework?

a) Regulate software exports

Correct Incorrect Correct answer

b) Develop a globally competitive cybersecurity workforce

Correct Incorrect Correct answer

c) Control 5G network security

Correct Incorrect Correct answer

d) Establish international cybersecurity licenses

Correct Incorrect Correct answer

9. Which organization developed the Framework for Improving Critical Infrastructure Cybersecurity?

a) ISO

Correct Incorrect Correct answer

b) NIST

Correct Incorrect Correct answer

c) ENISA

Correct Incorrect Correct answer

d) CIS

Correct Incorrect Correct answer

10. Which of the following is NOT a component of the NIST Framework?

a) Core

Correct Incorrect Correct answer

b) Implementation Tiers

Correct Incorrect Correct answer

c) Profiles

Correct Incorrect Correct answer

d) Annual Threat Report

Correct Incorrect Correct answer

11. Which European organization publishes the Threat Landscape Report?

a) ISO

Correct Incorrect Correct answer

b) ENISA

Correct Incorrect Correct answer

c) NIST

Correct Incorrect Correct answer

d) OAS

Correct Incorrect Correct answer

12. The ISO/IEC 27032 standard does NOT address:

a) Cybercrime

Correct Incorrect Correct answer

b) Information security

Correct Incorrect Correct answer

c) Network security

Correct Incorrect Correct answer

d) Cyberprotection

Correct Incorrect Correct answer

13. Which law underpins the NICE Framework?

a) Cybersecurity Enhancement Act of 2014

Correct Incorrect Correct answer

b) ISO 9001

Correct Incorrect Correct answer

c) COBIT 5

Correct Incorrect Correct answer

d) HIPAA

Correct Incorrect Correct answer

14. How many basic functions make up the NIST CSF Core?

a) 3

Correct Incorrect Correct answer

b) 4

Correct Incorrect Correct answer

c) 5

Correct Incorrect Correct answer

d) 6

Correct Incorrect Correct answer

15. The Identify function focuses on:

a) Monitoring incidents

Correct Incorrect Correct answer

b) Developing protection measures

Correct Incorrect Correct answer

c) Understanding assets, systems, and risks

Correct Incorrect Correct answer

d) Restoring critical services

Correct Incorrect Correct answer

16. Which activity belongs to the “Protect” function?

a) Conducting a gap analysis

Correct Incorrect Correct answer

b) Implementing access controls

Correct Incorrect Correct answer

c) Executing recovery plans

Correct Incorrect Correct answer

d) Monitoring anomalies

Correct Incorrect Correct answer

17. The “Detect” function aims to:

a) Define risk tolerance

Correct Incorrect Correct answer

b) Identify the occurrence of cybersecurity events

Correct Incorrect Correct answer

c) Restore operations

Correct Incorrect Correct answer

d) Establish corporate policies

Correct Incorrect Correct answer

18. Which function involves incident management and post-event communication?

a) Recover

Correct Incorrect Correct answer

b) Protect

Correct Incorrect Correct answer

c) Identify

Correct Incorrect Correct answer

d) Respond

Correct Incorrect Correct answer

19. In the Recover function, one key goal is to:

a) Gather digital evidence

Correct Incorrect Correct answer

b) Restore affected services

Correct Incorrect Correct answer

c) Evaluate vulnerabilities

Correct Incorrect Correct answer

d) Detect advanced threats

Correct Incorrect Correct answer

20. What component of the Core defines specific outcomes within each category?

a) Function

Correct Incorrect Correct answer

b) Subcategory

Correct Incorrect Correct answer

c) Implementation Tier

Correct Incorrect Correct answer

d) Informative Reference

Correct Incorrect Correct answer

21. What is the purpose of Informative References?

a) They are mandatory controls

Correct Incorrect Correct answer

b) They are examples of standards or guidelines

Correct Incorrect Correct answer

c) They are maturity indicators

Correct Incorrect Correct answer

d) They are audit metrics

Correct Incorrect Correct answer

22. How is risk management defined?

a) Elimination of all threats

Correct Incorrect Correct answer

b) The process of identifying, assessing, and responding to risk

Correct Incorrect Correct answer

c) Total risk reduction

Correct Incorrect Correct answer

d) Control automation

Correct Incorrect Correct answer

23. Which NIST document supports risk management processes?

a) SP 800-39

Correct Incorrect Correct answer

b) ISO 31001

Correct Incorrect Correct answer

c) COBIT 2019

Correct Incorrect Correct answer

d) SP 500

Correct Incorrect Correct answer

24. How many Implementation Tiers are defined in the CSF?

a) 3

Correct Incorrect Correct answer

b) 4

Correct Incorrect Correct answer

c) 5

Correct Incorrect Correct answer

d) 6

Correct Incorrect Correct answer

25. What best describes Tier 1 (Partial)?

a) Adaptive and repeatable processes

Correct Incorrect Correct answer

b) Ad hoc and reactive practices

Correct Incorrect Correct answer

c) Mature corporate policies

Correct Incorrect Correct answer

d) Fully automated controls

Correct Incorrect Correct answer

26. Tier 4 (Adaptive) organizations are characterized by:

a) Informal processes

Correct Incorrect Correct answer

b) Continuous improvement and proactive response

Correct Incorrect Correct answer

c) Centralized manual control

Correct Incorrect Correct answer

d) No external collaboration

Correct Incorrect Correct answer

27. What is a “Framework Profile”?

a) A list of corporate policies

Correct Incorrect Correct answer

b) The alignment between framework functions and business objectives

Correct Incorrect Correct answer

c) The record of security incidents

Correct Incorrect Correct answer

d) A regulatory compliance report

Correct Incorrect Correct answer

28. Comparing the Current and Target Profiles allows for what analysis?

a) Market benchmarking

Correct Incorrect Correct answer

b) Gap analysis

Correct Incorrect Correct answer

c) Legal evaluation

Correct Incorrect Correct answer

d) Financial auditing

Correct Incorrect Correct answer

29. What is the first step in establishing a cybersecurity program under the CSF?

a) Create policies

Correct Incorrect Correct answer

b) Prioritize and define scope

Correct Incorrect Correct answer

c) Conduct a risk assessment

Correct Incorrect Correct answer

d) Communicate results

Correct Incorrect Correct answer

30. What is obtained in Step 3 of the CSF process?

a) Current Profile

Correct Incorrect Correct answer

b) Risk Assessment

Correct Incorrect Correct answer

c) Target Profile

Correct Incorrect Correct answer

d) Action Plan

Correct Incorrect Correct answer

31. What is the purpose of a cybersecurity self-assessment?

a) Comply with audit requirements

Correct Incorrect Correct answer

b) Reduce technical staff

Correct Incorrect Correct answer

c) Measure the effectiveness of controls and decisions

Correct Incorrect Correct answer

d) Detect financial fraud

Correct Incorrect Correct answer

32. Which organization developed the CSET® assessment tool?

a) ENISA

Correct Incorrect Correct answer

b) DHS (Department of Homeland Security)

Correct Incorrect Correct answer

c) NIST

Correct Incorrect Correct answer

d) CERT-EU

Correct Incorrect Correct answer

33. Measuring cybersecurity program effectiveness helps:

a) Justify audits

Correct Incorrect Correct answer

b) Improve technical and strategic decision-making

Correct Incorrect Correct answer

c) Replace the NIST framework

Correct Incorrect Correct answer

d) Automate procurement

Correct Incorrect Correct answer

34. What is the goal of the privacy protection methodology in the NIST framework?

a) Strengthen digital surveillance

Correct Incorrect Correct answer

b) Minimize impacts on civil liberties

Correct Incorrect Correct answer

c) Increase data collection

Correct Incorrect Correct answer

d) Replace internal policies

Correct Incorrect Correct answer

35. Cyber Supply Chain Risk Management (SCRM) focuses on:

a) Reducing logistics costs

Correct Incorrect Correct answer

b) Identifying and mitigating risks from third parties and suppliers

Correct Incorrect Correct answer

c) Controlling inventory

Correct Incorrect Correct answer

d) Improving delivery times

Correct Incorrect Correct answer

36. Which activity belongs to cyber SCRM?

a) Training end users

Correct Incorrect Correct answer

b) Verifying suppliers’ compliance with cybersecurity requirements

Correct Incorrect Correct answer

c) Creating web content

Correct Incorrect Correct answer

d) Reviewing environmental policies

Correct Incorrect Correct answer

37. Which privacy principle should be integrated into cybersecurity programs?

a) Data minimization

Correct Incorrect Correct answer

b) Indefinite data retention

Correct Incorrect Correct answer

c) Open publication

Correct Incorrect Correct answer

d) Account blocking

Correct Incorrect Correct answer

38. A company identifies vulnerabilities in its industrial control systems (ICS). Which CSF function applies first?

a) Recover

Correct Incorrect Correct answer

b) Identify

Correct Incorrect Correct answer

c) Respond

Correct Incorrect Correct answer

d) Protect

Correct Incorrect Correct answer

39. During a ransomware attack, which CSF function restores data and services?

a) Recover

Correct Incorrect Correct answer

b) Detect

Correct Incorrect Correct answer

c) Protect

Correct Incorrect Correct answer

d) Identify

Correct Incorrect Correct answer

40. During a maturity assessment, an organization demonstrates repeatable processes, formal policies, and consistent monitoring. Which Implementation Tier is this?

a) Tier 1 – Partial

Correct Incorrect Correct answer

b) Tier 2 – Risk-Informed

Correct Incorrect Correct answer

c) Tier 3 – Repeatable

Correct Incorrect Correct answer

d) Tier 4 – Adaptive

Correct Incorrect Correct answer

Cyber Security Management Professional CSMP – (English)

Exam Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question

21. Question

22. Question

23. Question

24. Question

25. Question

26. Question

27. Question

28. Question

29. Question

30. Question

31. Question

32. Question

33. Question

34. Question

35. Question

36. Question

37. Question

38. Question

39. Question

40. Question

Verification