EDI Security and Compliance 3 — Questions and Answers
Question 1: Which access control model is best suited for restricting EDI system access based on job function?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns permissions based on job roles, making it ideal for EDI environments where access should be limited by business function.
Question 2: What does an EDI audit trail primarily provide?
- Real-time encryption of messages
- A chronological record of all EDI transactions and system activities (Correct answer)
- Automatic error correction in X12 segments
- Translation between EDI and XML formats
Correct answer: A chronological record of all EDI transactions and system activities
An EDI audit trail records transaction events chronologically, enabling compliance verification, dispute resolution, and fraud detection.
Question 3: Which technique involves testing an EDI system by sending malformed or unexpected data to find security vulnerabilities?
- Penetration testing
- Fuzz testing (Correct answer)
- Load testing
- Regression testing
Correct answer: Fuzz testing
Fuzz testing sends invalid, unexpected, or random data to an EDI system to uncover parsing errors or security flaws.
Question 4: In EDI, what is the purpose of a functional acknowledgment (997/999)?
- To encrypt the original transaction set
- To confirm receipt and syntactical acceptance of an EDI transaction (Correct answer)
- To authorize payment between trading partners
- To update trading partner agreement terms
Correct answer: To confirm receipt and syntactical acceptance of an EDI transaction
The 997/999 functional acknowledgment confirms that an EDI transaction was received and passed syntax validation, supporting compliance tracking.
Question 5: What security measure should be applied to EDI data stored in databases to protect it from unauthorized access?
- Data masking and encryption at rest (Correct answer)
- Compression only
- Storing in plain text with access logs
- Applying ZIP password protection
Correct answer: Data masking and encryption at rest
Encrypting EDI data at rest and masking sensitive fields protects stored information even if storage media is compromised.
Question 6: Which regulation requires retailers and their suppliers to comply with specific EDI transaction standards for food traceability?
- GDPR
- FDA Food Safety Modernization Act (FSMA) (Correct answer)
- SOX
- CCPA
Correct answer: FDA Food Safety Modernization Act (FSMA)
The FDA's FSMA requires supply chain traceability, and EDI compliance with relevant transaction sets supports the electronic record-keeping mandates.
Question 7: What is the primary security concern with using FTP (unencrypted) as an EDI transport protocol?
- FTP cannot handle large EDI files
- FTP transmits data in plaintext, exposing it to interception (Correct answer)
- FTP does not support X12 format
- FTP requires a VAN intermediary
Correct answer: FTP transmits data in plaintext, exposing it to interception
Standard FTP transmits data without encryption, making EDI payloads vulnerable to man-in-the-middle attacks and eavesdropping.
EDI Security and Compliance 3
Which access control model is best suited for restricting EDI system access based on job function?