CSL CSL Legal, Regulatory & Ethical Frameworks 2

Question 1

What does the NIST Cybersecurity Framework's 'Govern' function (added in CSF 2.0) primarily address?

Accepted Answer

Organizational context, risk management strategy, and cybersecurity oversight

Answer

The new Govern function in NIST CSF 2.0 focuses on establishing context, risk management strategy, roles and responsibilities, and oversight of cybersecurity programs.

Question 2

Under PCI DSS, what is a Qualified Security Assessor (QSA) responsible for?

Accepted Answer

Conducting formal PCI DSS compliance assessments for merchants and service providers

Answer

QSAs are certified by the PCI Security Standards Council to conduct formal PCI DSS assessments and issue Reports on Compliance (ROC) for Level 1 merchants and service providers.

Question 3

What is the primary purpose of a Bug Bounty program from a legal and ethical perspective?

Accepted Answer

To create a legal, authorized channel for external researchers to report vulnerabilities

Answer

Bug bounty programs establish clear legal authorization and safe harbor provisions that allow external researchers to test defined systems and report findings without fear of prosecution.

Question 4

Which ethical obligation does a cybersecurity professional have when discovering evidence of a crime during an authorized security assessment?

Accepted Answer

Immediately stop the assessment and report findings to designated legal counsel or law enforcement

Answer

Discovering evidence of a crime requires stopping the assessment to preserve evidence integrity and notifying appropriate legal authorities through proper channels.

Question 5

What is the significance of a 'safe harbor' provision in a vulnerability disclosure policy?

Accepted Answer

It grants legal protection to researchers who follow the policy's guidelines when reporting vulnerabilities

Answer

Safe harbor provisions assure security researchers that they will not face legal action if they discover and responsibly disclose vulnerabilities while following the policy's defined rules.

(CSL) Cybersecurity Leadership Certification Practice Test

(CSL) Cybersecurity Leadership Certification Practice Test

CSL CSL Legal, Regulatory & Ethical Frameworks 2