Compliance and Auditing IT Compliance and Security 1

Question 1

Which PCI DSS requirement mandates the use of a firewall to protect cardholder data?

Accepted Answer

Requirement 1

Answer

Requirement 3

Answer

Requirement 6

Answer

Requirement 10

Question 2

Under HIPAA Security Rule, what is a 'covered entity' required to conduct periodically?

Accepted Answer

Risk analysis of ePHI

Answer

External penetration tests

Answer

Employee background checks

Answer

Annual financial audits

Question 3

What is 'data at rest' encryption in the context of IT security compliance?

Accepted Answer

Encrypting data that is stored on devices, databases, or backup media

Answer

Encrypting data while it is being transmitted over a network

Answer

Encrypting data before it is entered into a system

Answer

Encrypting temporary data in system memory

Question 4

Which security concept involves verifying a user's identity through multiple verification factors?

Accepted Answer

Multi-factor authentication (MFA)

Answer

Single sign-on (SSO)

Answer

Role-based access control

Answer

Privileged access management

Question 5

What is a 'penetration test' in the context of IT security compliance?

Accepted Answer

An authorized simulated attack to identify exploitable vulnerabilities

Answer

Testing employee password strength

Answer

A review of firewall configuration rules

Answer

An assessment of physical security measures

Question 6

What does 'data classification' mean in an IT compliance program?

Accepted Answer

Categorizing data based on its sensitivity level to apply appropriate security controls

Answer

Sorting files alphabetically on a server

Answer

Classifying IT assets by their age

Answer

Grouping employees by their data access needs