CSS CSS Compliance & Regulatory Frameworks

Question 1

Which US federal law mandates security controls for federal government information systems and requires FISMA compliance?

Accepted Answer

Federal Information Security Modernization Act (FISMA)

Answer

Sarbanes-Oxley Act (SOX)

Answer

Gramm-Leach-Bliley Act (GLBA)

Answer

Computer Fraud and Abuse Act (CFAA)

Question 2

What does the NIST Cybersecurity Framework (CSF) core consist of?

Accepted Answer

Identify, Protect, Detect, Respond, Recover functions

Answer

Plan, Do, Check, Act cycle

Answer

Prepare, Prevent, Detect, Respond, Recover phases

Answer

Confidentiality, Integrity, Availability triad

Question 3

Which regulation governs the protection of personal health information (PHI) in the United States?

Accepted Answer

HIPAA (Health Insurance Portability and Accountability Act)

Answer

PCI DSS

Answer

FERPA

Answer

GLBA

Question 4

What is the purpose of a System and Organization Controls (SOC 2) audit?

Accepted Answer

Evaluates a service organization's controls for security, availability, processing integrity, confidentiality, and privacy

Answer

Certifies that products meet hardware safety standards

Answer

Audits financial statements for accuracy

Answer

Verifies network penetration testing results

Question 5

Which framework provides a comprehensive set of controls for information security management and is the basis for ISO/IEC 27001 certification?

Accepted Answer

ISO/IEC 27002 (Code of Practice for Information Security Controls)

Answer

COBIT

Answer

ITIL v4

Answer

NIST SP 800-53

Question 6

What does data residency compliance require organizations to ensure?

Accepted Answer

Personal data is stored and processed within specified geographic boundaries mandated by law

Answer

Data is encrypted at rest regardless of location

Answer

Data is replicated to multiple global regions for availability

Answer

All data is kept on-premises and never moved to the cloud