CCP Governance, Compliance & Ethical Hacking 2

Question 1

Which framework provides a set of voluntary cybersecurity standards and best practices developed by NIST primarily for critical infrastructure protection?

Accepted Answer

NIST CSF

Answer

The NIST Cybersecurity Framework (CSF) was developed to help critical infrastructure organizations manage cybersecurity risk using five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 2

During a penetration test, a tester discovers a zero-day vulnerability in a client's production system. What is the MOST appropriate immediate action?

Accepted Answer

Document and immediately report it to the client's security team

Answer

Responsible disclosure requires immediately notifying the client's security team so they can assess risk and decide on remediation, staying within the rules of engagement.

Question 3

Which compliance regulation specifically mandates security controls for organizations that process, store, or transmit cardholder data?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) is the compliance framework specifically governing cardholder data protection for any entity that handles payment card information.

Question 4

A company's security policy states that all employees must complete annual security awareness training. Which governance element does this BEST represent?

Accepted Answer

Security policy

Answer

A security policy is a high-level document that mandates what must be done (such as annual training), while standards and procedures define how to implement those mandates.

Question 5

In ethical hacking, what does the term 'rules of engagement' define?

Accepted Answer

The specific boundaries, scope, and constraints agreed upon before testing begins

Answer

Rules of engagement formally define the scope, allowed techniques, testing windows, and communication protocols that a penetration tester must follow during an engagement.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Governance, Compliance & Ethical Hacking 2