CDP Risk Management & Compliance 3

Question 1

Which compliance framework is specifically designed to protect cardholder data in payment systems?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) defines security requirements for organizations that store, process, or transmit cardholder data.

Question 2

In DevSecOps pipelines, 'compliance as code' primarily enables which capability?

Accepted Answer

Automated enforcement of regulatory requirements within CI/CD workflows

Answer

Compliance as code automates the checking and enforcement of regulatory and policy requirements directly within CI/CD pipelines, enabling continuous compliance validation.

Question 3

A security team uses threat modeling to identify that an attacker could intercept API tokens in transit. Which STRIDE category does this threat belong to?

Accepted Answer

Information Disclosure

Answer

Interception of API tokens in transit constitutes Information Disclosure, as sensitive data is exposed to unauthorized parties.

Question 4

Which control type is a firewall that blocks malicious traffic before it reaches an application?

Accepted Answer

Preventive control

Answer

A firewall is a preventive control because it stops threats before they can cause harm, rather than detecting or correcting after the fact.

Question 5

Under HIPAA Security Rule, which safeguard category addresses workstation use policies and physical access to servers?

Accepted Answer

Physical safeguards

Answer

HIPAA Physical Safeguards govern physical access to electronic information systems and the facilities housing them, including workstation use and device controls.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Risk Management & Compliance 3