ACL Compliance & Regulatory Frameworks 3

Question 1

Under FISMA, federal agencies must implement access controls aligned with FIPS 199 impact levels. Which ACL approach corresponds to a HIGH impact system?

Accepted Answer

Strict deny-by-default ACLs with continuous monitoring and mandatory access control enforcement

Answer

FIPS 199 HIGH impact systems require the most stringent access controls, including deny-by-default ACLs with continuous monitoring as specified in NIST SP 800-53.

Question 2

The NIST Cybersecurity Framework (CSF) 'Protect' function includes PR.AC-5 (Network Integrity). Which ACL practice directly supports this subcategory?

Accepted Answer

Implementing network segmentation and access control lists to protect network integrity

Answer

PR.AC-5 explicitly calls for network integrity to be protected through network segmentation and access control as primary technical controls.

Question 3

An auditor reviewing CIS Benchmark compliance checks router ACL configurations. Which finding would be flagged as non-compliant with CIS Controls?

Accepted Answer

Unused permit rules that allow traffic to deprecated services still present in the ACL

Answer

CIS Controls require organizations to remove or disable unused/unnecessary network rules, and permit rules for deprecated services represent an unnecessary attack surface.

Question 4

Under GLBA (Gramm-Leach-Bliley Act), financial institutions must protect customer financial data. Which ACL design supports GLBA's Safeguards Rule?

Accepted Answer

Segmented network zones with ACLs restricting access to customer financial data to only authorized applications and staff

Answer

GLBA's Safeguards Rule requires implementing access controls including network segmentation to protect customer financial information from unauthorized access.

Question 5

A company undergoes a SOC 2 Type II audit focusing on the Security trust service criteria. Which ACL-related evidence would the auditor request?

Accepted Answer

Documented ACL change management procedures, ACL rule reviews, and logs showing unauthorized access attempts were blocked

Answer

SOC 2 Type II audits require operational evidence over a period of time, including ACL change logs, review records, and evidence that controls functioned effectively.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Compliance & Regulatory Frameworks 3