CSC Regulatory Compliance & Legal Aspects 3

Question 1

Which NIST publication provides the primary framework for federal agencies to manage information security risk under FISMA?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37 describes the Risk Management Framework (RMF) process that federal agencies use to authorize and continuously monitor systems under FISMA.

Question 2

Under GDPR Article 83, what is the maximum fine for the most serious violations (Tier 2)?

Accepted Answer

€20 million or 4% of global annual turnover

Answer

GDPR Tier 2 violations carry fines up to €20 million or 4% of the undertaking's total worldwide annual turnover, whichever is higher.

Question 3

A healthcare organization's business associate suffers a breach affecting 600 patients. Which entity must notify HHS and the affected individuals under the HIPAA Breach Notification Rule?

Accepted Answer

The covered entity

Answer

Under the HIPAA Breach Notification Rule, the covered entity is responsible for notifying individuals and HHS, though the business associate must notify the covered entity promptly.

Question 4

The 'right to be forgotten' under GDPR is formally known as which article right?

Accepted Answer

Right to erasure (Article 17)

Answer

GDPR Article 17 establishes the right to erasure, commonly called the 'right to be forgotten,' allowing individuals to request deletion of their personal data under certain conditions.

Question 5

Which compliance framework is specifically designed for cloud service providers handling US federal government data at the FedRAMP Moderate baseline?

Accepted Answer

FedRAMP Moderate ATO

Answer

FedRAMP Moderate Authorization to Operate (ATO) is the specific authorization cloud providers must obtain to host federal agency data classified at the moderate impact level.

(CSC) Certified Security Consultant Practice Test

(CSC) Certified Security Consultant Practice Test

CSC Regulatory Compliance & Legal Aspects 3