CDP Risk Management & Compliance 3 — Questions and Answers
Question 1: Which compliance framework is specifically designed to protect cardholder data in payment systems?
- HIPAA
- PCI DSS (Correct answer)
- FedRAMP
- ISO 27001
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) defines security requirements for organizations that store, process, or transmit cardholder data.
Question 2: In DevSecOps pipelines, 'compliance as code' primarily enables which capability?
- Manual review of audit logs by compliance officers
- Automated enforcement of regulatory requirements within CI/CD workflows (Correct answer)
- Encryption of all pipeline artifacts at rest
- Dynamic generation of penetration test reports
Correct answer: Automated enforcement of regulatory requirements within CI/CD workflows
Compliance as code automates the checking and enforcement of regulatory and policy requirements directly within CI/CD pipelines, enabling continuous compliance validation.
Question 3: A security team uses threat modeling to identify that an attacker could intercept API tokens in transit. Which STRIDE category does this threat belong to?
- Spoofing
- Tampering
- Information Disclosure (Correct answer)
- Elevation of Privilege
Correct answer: Information Disclosure
Interception of API tokens in transit constitutes Information Disclosure, as sensitive data is exposed to unauthorized parties.
Question 4: Which control type is a firewall that blocks malicious traffic before it reaches an application?
- Corrective control
- Detective control
- Preventive control (Correct answer)
- Compensating control
Correct answer: Preventive control
A firewall is a preventive control because it stops threats before they can cause harm, rather than detecting or correcting after the fact.
Question 5: Under HIPAA Security Rule, which safeguard category addresses workstation use policies and physical access to servers?
- Administrative safeguards
- Physical safeguards (Correct answer)
- Technical safeguards
- Organizational requirements
Correct answer: Physical safeguards
HIPAA Physical Safeguards govern physical access to electronic information systems and the facilities housing them, including workstation use and device controls.
Question 6: What is the primary purpose of a Business Impact Analysis (BIA) in a risk management program?
- To identify which employees have privileged access rights
- To determine the financial and operational consequences of disruptions to critical functions (Correct answer)
- To map network topology for vulnerability scanning
- To generate pen test schedules for compliance audits
Correct answer: To determine the financial and operational consequences of disruptions to critical functions
A BIA quantifies the impact of disruptions to critical business processes, establishing recovery priorities and objectives like RTO and RPO.
Question 7: Which risk treatment strategy involves purchasing cyber liability insurance to offset potential financial losses?
- Risk avoidance
- Risk mitigation
- Risk transfer (Correct answer)
- Risk acceptance
Correct answer: Risk transfer
Risk transfer shifts the financial consequences of a risk to a third party, such as an insurance provider, without eliminating the underlying risk.
CDP Risk Management & Compliance 3
Which compliance framework is specifically designed to protect cardholder data in payment systems?