CSC Security Controls & Compliance Implementation 3

Question 1

A healthcare organization must ensure that a business associate handles PHI according to HIPAA requirements. What document formalizes this obligation?

Accepted Answer

Business Associate Agreement (BAA)

Answer

A Business Associate Agreement (BAA) is required by HIPAA when a covered entity shares PHI with a third-party business associate, specifying permissible uses and required safeguards.

Question 2

In the context of the NIST Risk Management Framework (RMF), what happens during the 'Authorize' step?

Accepted Answer

A senior official accepts residual risk and grants an Authorization to Operate (ATO)

Answer

During the Authorize step, an Authorizing Official reviews the security authorization package and formally accepts residual risk by granting or denying an ATO.

Question 3

Which of the following BEST describes the scope of GDPR applicability?

Accepted Answer

It applies to any organization that processes personal data of EU residents, regardless of where the organization is located

Answer

GDPR has extraterritorial reach and applies to any organization worldwide that processes personal data of individuals located in the EU, regardless of the organization's location.

Question 4

A security team uses a vulnerability scanner and discovers a critical vulnerability in a web application. According to common compliance frameworks, what is the typical required remediation timeframe for critical vulnerabilities?

Accepted Answer

Within 30 days

Answer

Most compliance frameworks, including PCI DSS, require critical vulnerabilities to be remediated within 30 days of discovery.

Question 5

What is the primary purpose of configuration baselines in compliance programs?

Accepted Answer

To establish a known secure state against which systems are measured and deviations detected

Answer

Configuration baselines define the approved secure configuration state, enabling organizations to detect and respond to unauthorized or non-compliant configuration changes.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Security Controls & Compliance Implementation 3