ACL Compliance & Regulatory Frameworks 2 — Questions and Answers
Question 1: Under HIPAA, which ACL configuration best protects electronic Protected Health Information (ePHI) at the network perimeter?
- Allow all inbound traffic and log only outbound
- Deny all traffic by default and permit only specific authorized connections to ePHI systems (Correct answer)
- Permit all internal traffic and block only known malicious IPs
- Use MAC-based filtering on switches to control ePHI access
Correct answer: Deny all traffic by default and permit only specific authorized connections to ePHI systems
HIPAA requires a 'deny all, permit by exception' ACL posture to ensure only explicitly authorized traffic can reach systems holding ePHI.
Question 2: PCI DSS Requirement 1 mandates that cardholder data environments (CDE) be protected by firewalls. Which ACL practice specifically satisfies the requirement to restrict inbound and outbound traffic?
- Allowing all RFC 1918 private IP traffic into the CDE
- Permitting only traffic with a documented business justification and blocking all other flows (Correct answer)
- Restricting only inbound traffic while permitting all outbound flows
- Using stateless ACLs to inspect all TCP sessions
Correct answer: Permitting only traffic with a documented business justification and blocking all other flows
PCI DSS Requirement 1.2 demands that ACL rules permitting traffic into or out of the CDE must be documented with a specific business need.
Question 3: NIST SP 800-53 control AC-4 addresses Information Flow Enforcement. Which ACL scenario correctly implements this control?
- Blocking ICMP while allowing all TCP and UDP
- Restricting data transfers between systems classified at different sensitivity levels using ACL policies (Correct answer)
- Requiring users to re-authenticate every 30 minutes
- Encrypting all traffic traversing the ACL device
Correct answer: Restricting data transfers between systems classified at different sensitivity levels using ACL policies
AC-4 requires organizations to enforce approved authorizations for controlling the flow of information between interconnected systems, typically implemented via ACLs.
Question 4: Under SOX IT controls, which ACL-related practice helps ensure the integrity of financial reporting systems?
- Allowing finance staff unrestricted network access for productivity
- Segregating duties by using ACLs to prevent developers from accessing production financial systems (Correct answer)
- Using host-based ACLs only on financial servers
- Permitting all internal VLAN traffic to financial databases
Correct answer: Segregating duties by using ACLs to prevent developers from accessing production financial systems
SOX requires separation of duties, and ACLs are used to enforce that developers, test teams, and finance systems are network-isolated to prevent unauthorized changes.
Question 5: GDPR Article 32 requires appropriate technical measures to protect personal data. How do ACLs contribute to GDPR compliance?
- ACLs are not relevant to GDPR since it focuses on data processing agreements
- ACLs enforce network-level access restrictions that limit who can reach systems storing EU personal data (Correct answer)
- GDPR requires only encryption, making ACLs redundant
- ACLs satisfy GDPR's breach notification requirement
Correct answer: ACLs enforce network-level access restrictions that limit who can reach systems storing EU personal data
GDPR Article 32 includes network security controls like ACLs as part of 'appropriate technical measures' to protect personal data from unauthorized access.
Question 6: A healthcare organization subject to HIPAA discovers that an ACL rule permits any host on the internal network to query their patient database server on port 1433. What is the compliance risk?
- No risk, since internal traffic is trusted under HIPAA's Safe Harbor provision
- The rule violates the Minimum Necessary standard by granting overly broad access to ePHI (Correct answer)
- The risk only applies if the database lacks at-rest encryption
- HIPAA only governs access by external parties, so internal rules are exempt
Correct answer: The rule violates the Minimum Necessary standard by granting overly broad access to ePHI
HIPAA's Minimum Necessary standard requires limiting access to ePHI to only those with a need to know, making a broad 'any internal host' rule non-compliant.
Question 7: Which compliance framework explicitly requires network segmentation enforced by ACLs or firewalls to isolate systems storing payment card data?
- FERPA
- COPPA
- PCI DSS (Correct answer)
- GLBA
Correct answer: PCI DSS
PCI DSS Requirement 1 specifically mandates network segmentation to isolate the cardholder data environment using firewalls and ACLs.
ACL Compliance & Regulatory Frameworks 2
Under HIPAA, which ACL configuration best protects electronic Protected Health Information (ePHI) at the network perimeter?