CySA+ Test Compliance Frameworks 4

Question 1

Which NIST CSF v2.0 function was newly added compared to the original five functions?

Accepted Answer

Govern

Answer

NIST CSF v2.0 added the Govern function to address cybersecurity risk governance, strategy, and supply chain risk management at the organizational level.

Question 2

A security analyst is reviewing a third-party vendor's SOC 2 Type II report. The report covers availability and confidentiality criteria. What are these criteria formally called?

Accepted Answer

Trust Service Criteria (TSC)

Answer

AICPA defines the five Trust Service Criteria (security, availability, processing integrity, confidentiality, privacy) used in SOC 2 engagements.

Question 3

Under GDPR, which legal basis allows processing of personal data when the data subject has given clear consent for a specific purpose?

Accepted Answer

Consent

Answer

Consent under GDPR Article 6(1)(a) must be freely given, specific, informed, and unambiguous for each processing purpose.

Question 4

Which NIST SP 800-61 phase occurs immediately after detecting and analyzing a potential incident?

Accepted Answer

Containment, Eradication, and Recovery

Answer

NIST SP 800-61 defines four phases; Containment, Eradication, and Recovery follow the Detection and Analysis phase.

Question 5

A financial institution must comply with the Gramm-Leach-Bliley Act (GLBA). Which safeguard rule element requires designation of a qualified individual to oversee the information security program?

Accepted Answer

Qualified Individual designation

Answer

The FTC Safeguards Rule under GLBA requires financial institutions to designate a qualified individual responsible for overseeing and implementing the information security program.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Compliance Frameworks 4