Practice Test Geeks(ACL) Access Control Lists Practice Test
← All ACL Flashcard Decks

Compliance & Regulatory Frameworks Flashcards

7 cards from real ACL practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Compliance & Regulatory Frameworks flashcards as text

  1. Under FISMA, federal agencies must implement access controls aligned with FIPS 199 impact levels. Which ACL approach corresponds to a HIGH impact system?

    Answer: Strict deny-by-default ACLs with continuous monitoring and mandatory access control enforcement

    FIPS 199 HIGH impact systems require the most stringent access controls, including deny-by-default ACLs with continuous monitoring as specified in NIST SP 800-53.

  2. The NIST Cybersecurity Framework (CSF) 'Protect' function includes PR.AC-5 (Network Integrity). Which ACL practice directly supports this subcategory?

    Answer: Implementing network segmentation and access control lists to protect network integrity

    PR.AC-5 explicitly calls for network integrity to be protected through network segmentation and access control as primary technical controls.

  3. An auditor reviewing CIS Benchmark compliance checks router ACL configurations. Which finding would be flagged as non-compliant with CIS Controls?

    Answer: Unused permit rules that allow traffic to deprecated services still present in the ACL

    CIS Controls require organizations to remove or disable unused/unnecessary network rules, and permit rules for deprecated services represent an unnecessary attack surface.

  4. Under GLBA (Gramm-Leach-Bliley Act), financial institutions must protect customer financial data. Which ACL design supports GLBA's Safeguards Rule?

    Answer: Segmented network zones with ACLs restricting access to customer financial data to only authorized applications and staff

    GLBA's Safeguards Rule requires implementing access controls including network segmentation to protect customer financial information from unauthorized access.

  5. A company undergoes a SOC 2 Type II audit focusing on the Security trust service criteria. Which ACL-related evidence would the auditor request?

    Answer: Documented ACL change management procedures, ACL rule reviews, and logs showing unauthorized access attempts were blocked

    SOC 2 Type II audits require operational evidence over a period of time, including ACL change logs, review records, and evidence that controls functioned effectively.

  6. NERC CIP-007-6 (Systems Security Management) applies to bulk electric system assets. Which requirement does ACL implementation directly address?

    Answer: Disabling unnecessary network ports and services via ACL on cyber assets

    NERC CIP-007-6 Requirement R1 specifically requires disabling or restricting unnecessary network ports using ACLs or host-based firewalls on applicable cyber assets.

  7. ISO/IEC 27001 Annex A control A.13.1.1 (Network Controls) requires managing networks to protect systems. Which ACL governance practice best satisfies this control?

    Answer: Establishing a formal ACL rule review process with defined ownership, change approval, and periodic audits

    ISO 27001 A.13.1.1 requires formal management of network controls including documented procedures, ownership, and regular reviews of ACL configurations.