CNDA Risk Management and Compliance 2

Question 1

What is the primary difference between a vulnerability assessment and a penetration test?

Accepted Answer

A vulnerability assessment identifies weaknesses; a pen test actively exploits them to determine real-world impact

Answer

A vulnerability assessment discovers and reports weaknesses, while a penetration test attempts to exploit them to validate actual risk and business impact.

Question 2

Under HIPAA, what category of information must healthcare organizations protect?

Accepted Answer

Protected Health Information (PHI) that identifies individuals

Answer

HIPAA protects PHI — any individually identifiable health information held or transmitted by a covered entity or its business associates.

Question 3

Which security framework uses the Cybersecurity Framework Core with five functions: Identify, Protect, Detect, Respond, and Recover?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST CSF organizes security activities into five core functions that map to the full lifecycle of managing cybersecurity risk.

Question 4

What is a 'security control baseline' as used in NIST SP 800-53?

Accepted Answer

A predefined set of security controls tailored to a system's impact level (Low, Moderate, High)

Answer

NIST SP 800-53 baselines group controls by system impact level, providing a starting point that organizations tailor to their specific environment.

Question 5

What does 'due diligence' mean in the context of cybersecurity governance?

Accepted Answer

Researching and understanding risks before implementing security controls and business decisions

Answer

Due diligence requires organizations to actively investigate and understand security risks, not merely assume that existing controls are sufficient.

CNDA - Certified Network Defense Architect Practice Test

CNDA - Certified Network Defense Architect Practice Test

CNDA Risk Management and Compliance 2