CSA Regulatory Compliance & Licensing 3 — Questions and Answers
Question 1: Which software licensing model grants the user rights to use, study, modify, and distribute the software and its source code freely?
- Proprietary license
- Freeware license
- Open-source license (Correct answer)
- Shareware license
Correct answer: Open-source license
Open-source licenses (e.g., GPL, MIT, Apache) explicitly grant users the four fundamental freedoms including use, study, modification, and redistribution.
Question 2: An organization running Red Hat Enterprise Linux wants to remain compliant. After adding 10 new servers, the administrator should primarily:
- Purchase additional subscription entitlements and attach them via Red Hat Subscription Manager (Correct answer)
- Download additional ISO files from Red Hat's website
- Migrate workloads to CentOS Stream instead
- Apply for an open-source waiver from Red Hat
Correct answer: Purchase additional subscription entitlements and attach them via Red Hat Subscription Manager
RHEL uses a subscription model; each system must be registered and attached to a valid subscription entitlement through Red Hat Subscription Manager (RHSM).
Question 3: Under PCI DSS Requirement 10, what is the minimum log retention period organizations must maintain for audit logs?
- 30 days
- 6 months
- 12 months (Correct answer)
- 3 years
Correct answer: 12 months
PCI DSS Requirement 10.7 mandates that audit log history be retained for at least 12 months, with at least 3 months immediately available for analysis.
Question 4: A company using Microsoft 365 E3 licenses discovers employees are also using Power BI Premium features. What compliance action is required?
- No action needed—Power BI Premium is included in E3
- Upgrade affected users to E5 or purchase standalone Power BI Premium licenses (Correct answer)
- Disable Power BI access company-wide immediately
- Submit a retroactive licensing waiver to Microsoft
Correct answer: Upgrade affected users to E5 or purchase standalone Power BI Premium licenses
Power BI Premium features are not included in Microsoft 365 E3; organizations must license users with E5 or dedicated Power BI Premium per-user licenses.
Question 5: The California Consumer Privacy Act (CCPA) applies to for-profit businesses that meet which threshold related to personal information?
- Process personal data of more than 500 California residents per year
- Buy, sell, or share personal information of 100,000 or more consumers or households annually (Correct answer)
- Have annual gross revenues exceeding $5 million
- Employ more than 50 California residents
Correct answer: Buy, sell, or share personal information of 100,000 or more consumers or households annually
Under CCPA (as amended by CPRA), one qualifying threshold is buying, selling, or sharing personal information of 100,000 or more consumers or households per year.
Question 6: Which NIST framework function focuses on developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?
- Identify
- Protect (Correct answer)
- Detect
- Respond
Correct answer: Protect
The 'Protect' function in the NIST Cybersecurity Framework covers access control, awareness training, data security, and protective technologies.
Question 7: An administrator is deploying VMware vSphere. The licensing model charges per physical CPU socket. A server with 2 CPUs and 32 cores total requires how many vSphere licenses?
- 1
- 2 (Correct answer)
- 4
- 32
Correct answer: 2
VMware vSphere licenses are issued per physical CPU socket, so a dual-socket server requires exactly 2 licenses regardless of core count.
CSA Regulatory Compliance & Licensing 3
Which software licensing model grants the user rights to use, study, modify, and distribute the software and its source code freely?