CySA+ Test Compliance Frameworks 5

Question 1

An organization subject to SOX must ensure that controls over financial reporting are audited annually. Which section of SOX specifically addresses internal control requirements?

Accepted Answer

Section 404

Answer

SOX Section 404 requires management and external auditors to report annually on the adequacy of the internal control structure over financial reporting.

Question 2

Which NIST SP 800-37 step involves authorizing the system to operate based on acceptable risk?

Accepted Answer

Authorize

Answer

The Authorize step in the RMF requires an authorizing official to make a risk-based decision to operate the system based on evaluated controls and residual risk.

Question 3

A CySA+ analyst is mapping organizational controls to the NIST CSF. An IDS alert workflow falls under which NIST CSF function?

Accepted Answer

Detect

Answer

The Detect function covers anomalies and events, continuous security monitoring, and detection processes — including IDS alert workflows.

Question 4

Under CCPA, California residents have the right to opt out of which specific business activity involving their personal information?

Accepted Answer

Selling their personal information to third parties

Answer

CCPA grants California residents the right to opt out of the sale of their personal information to third parties.

Question 5

Which NIST SP 800-53 control family directly addresses supply chain risk management?

Accepted Answer

SR — Supply Chain Risk Management

Answer

The SR control family, added in NIST SP 800-53 Rev. 5, specifically addresses supply chain risk management including supplier assessments and component integrity.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Compliance Frameworks 5