CySA+ Test Compliance Frameworks 2

Question 1

Which NIST CSF function focuses on developing organizational understanding to manage cybersecurity risk to systems, people, assets, and data?

Accepted Answer

Identify

Answer

The Identify function establishes the foundation for an effective cybersecurity program by building organizational understanding of risk context.

Question 2

Under GDPR, what is the maximum timeframe for notifying a supervisory authority after discovering a personal data breach?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 3

A healthcare organization uses a third-party billing company that accesses PHI. What agreement must be in place under HIPAA?

Accepted Answer

Business Associate Agreement (BAA)

Answer

HIPAA requires a Business Associate Agreement with any third party that creates, receives, maintains, or transmits PHI on behalf of a covered entity.

Question 4

Which PCI DSS requirement mandates that cardholder data environments be separated from other network segments?

Accepted Answer

Requirement 1 — Install and maintain network security controls

Answer

PCI DSS Requirement 1 covers network security controls including firewall configuration and network segmentation to isolate the cardholder data environment.

Question 5

SOC 2 Type II reports differ from SOC 2 Type I reports primarily because Type II reports evaluate:

Accepted Answer

Controls over a period of time, not just a point in time

Answer

SOC 2 Type II assesses the operating effectiveness of controls over a defined period (typically 6–12 months), while Type I only evaluates design at a single point in time.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Compliance Frameworks 2