TCK-CSF20 Practice Test

TCK-CSF20 practice test: what's covered

• Govern
• Identify
• Protect
• Detect
• Respond
• Recover

Free TCK-CSF20 sample questions

1. During a strategy workshop, your CISO asks how CSF 2.0 differs structurally from CSF 1.1. Which change is the single most significant addition in version 2.0?

   • A. A brand-new GOVERN Function was added as a sixth Function, elevating cybersecurity to an enterprise-risk and oversight responsibility
   • B. The DETECT Function was removed and merged entirely into the RESPOND Function for streamlined operations
   • C. Implementation Tiers were eliminated because they overlapped with the maturity scoring in Profiles
   • D. Informative References were dropped so the framework no longer maps to NIST SP 800-53 or ISO 27001
   Show answer

   Correct: A. CSF 2.0's headline change is GOVERN, the sixth Function that wraps organizational context, risk strategy, roles, policy, oversight, and supply chain. The other choices are incorrect because DETECT remains a distinct Function, Tiers were retained and even broadened, and Informative References were expanded rather than removed.

2. A new analyst is mapping the GOVERN Function and asks which Categories actually belong under it in CSF 2.0. Which Categories are GOVERN Categories? (Choose THREE)

   • A. Organizational Context (GV.OC), describing mission, stakeholders, and legal or regulatory requirements
   • B. Risk Management Strategy (GV.RM), establishing risk appetite, tolerance, and priorities
   • C. Cybersecurity Supply Chain Risk Management (GV.SC), governing third-party and software supply risk
   • D. Continuous Monitoring (DE.CM), watching networks and systems for anomalous activity
   • E. Recovery Plan Execution (RC.RP), restoring systems and services after an incident
   Show answer

   Correct: A and B and C. GV.OC, GV.RM, and GV.SC are three of the six GOVERN Categories, alongside Roles and Responsibilities (GV.RR), Policy (GV.PO), and Oversight (GV.OV). DE.CM is incorrect because it sits under DETECT, and RC.RP is incorrect because it belongs to the RECOVER Function, not GOVERN.

3. A practitioner reads the Subcategory "ID.AM-01: Inventories of hardware managed by the organization are maintained." Where does this statement sit in the Framework Core hierarchy?

   • A. It is a Function, the highest level that organizes cybersecurity outcomes
   • B. It is a Subcategory, an outcome-level statement that further divides a Category
   • C. It is an Implementation Tier, describing the rigor of risk management practices
   • D. It is an Informative Reference, pointing to a specific external control standard
   Show answer

   Correct: B. The Core nests Functions to Categories to Subcategories, and ID.AM-01 is a Subcategory under the Asset Management Category. It is not a Function because those are the six top-level groupings, not a Tier because Tiers describe practice rigor, and not an Informative Reference because those map outward to standards like SP 800-53.

4. A vendor claims CSF 2.0 prescribes exactly which firewall rules and encryption algorithms you must deploy. How should a practitioner correctly characterize the framework's nature?

   • A. The framework is prescriptive, dictating specific technologies and configuration values for each control
   • B. The framework is outcome-focused, describing what should be achieved while leaving how to detailed control catalogs
   • C. The framework applies only to U.S. federal agencies and cannot be used by private companies
   • D. The framework replaces ISO 27001 and CIS Controls, which become obsolete once it is adopted
   Show answer

   Correct: B. CSF 2.0 states desired outcomes and relies on Informative References for implementation detail, so it is a what framework, not a how one. It is not prescriptive, not limited to federal agencies since 2.0 broadens audience to all organizations, and it complements rather than replaces ISO 27001 or CIS Controls.

5. A small business owner with no security team feels overwhelmed adopting CSF 2.0. Which CSF 2.0 resource was specifically introduced to give tailored, audience-friendly entry points like this one?

   • A. Quick-Start Guides aimed at specific audiences such as small businesses and enterprise risk managers
   • B. Mandatory federal audit checklists that every adopting organization must legally complete
   • C. A certification examination administered directly by NIST to license framework practitioners
   • D. A proprietary scanning tool sold by NIST that scores controls automatically
   Show answer

   Correct: A. CSF 2.0 added Quick-Start Guides (QSGs) for groups like small businesses, beginners, and supply-chain managers to make adoption approachable. The others are incorrect because CSF imposes no mandatory audit checklist, NIST does not run a practitioner license exam, and NIST sells no proprietary scoring tool for the framework.

Last updated: 2026-10-19

TCK-CSF20 practice test FAQ