ACL Compliance & Regulatory Frameworks 2

Question 1

Under HIPAA, which ACL configuration best protects electronic Protected Health Information (ePHI) at the network perimeter?

Accepted Answer

Deny all traffic by default and permit only specific authorized connections to ePHI systems

Answer

HIPAA requires a 'deny all, permit by exception' ACL posture to ensure only explicitly authorized traffic can reach systems holding ePHI.

Question 2

PCI DSS Requirement 1 mandates that cardholder data environments (CDE) be protected by firewalls. Which ACL practice specifically satisfies the requirement to restrict inbound and outbound traffic?

Accepted Answer

Permitting only traffic with a documented business justification and blocking all other flows

Answer

PCI DSS Requirement 1.2 demands that ACL rules permitting traffic into or out of the CDE must be documented with a specific business need.

Question 3

NIST SP 800-53 control AC-4 addresses Information Flow Enforcement. Which ACL scenario correctly implements this control?

Accepted Answer

Restricting data transfers between systems classified at different sensitivity levels using ACL policies

Answer

AC-4 requires organizations to enforce approved authorizations for controlling the flow of information between interconnected systems, typically implemented via ACLs.

Question 4

Under SOX IT controls, which ACL-related practice helps ensure the integrity of financial reporting systems?

Accepted Answer

Segregating duties by using ACLs to prevent developers from accessing production financial systems

Answer

SOX requires separation of duties, and ACLs are used to enforce that developers, test teams, and finance systems are network-isolated to prevent unauthorized changes.

Question 5

GDPR Article 32 requires appropriate technical measures to protect personal data. How do ACLs contribute to GDPR compliance?

Accepted Answer

ACLs enforce network-level access restrictions that limit who can reach systems storing EU personal data

Answer

GDPR Article 32 includes network security controls like ACLs as part of 'appropriate technical measures' to protect personal data from unauthorized access.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Compliance & Regulatory Frameworks 2