GRC Compliance Standards & Regulatory Requirements 3

Question 1

Which compliance framework is specifically designed to secure controlled unclassified information (CUI) in non-federal systems and organizations?

Accepted Answer

NIST SP 800-171

Answer

NIST SP 800-171 provides security requirements for protecting CUI in nonfederal information systems, often required by defense contractors.

Question 2

Under HIPAA, a Business Associate Agreement (BAA) is required when a third party does which of the following?

Accepted Answer

Creates, receives, maintains, or transmits PHI on behalf of a covered entity

Answer

A BAA is required whenever a third-party business associate creates, receives, maintains, or transmits PHI while performing services for a covered entity.

Question 3

Which PCI DSS requirement mandates that cardholder data environments must restrict inbound and outbound traffic to only that which is necessary?

Accepted Answer

Requirement 1 — Install and maintain network security controls

Answer

PCI DSS Requirement 1 focuses on network security controls, including firewalls and router configurations that restrict unnecessary traffic to and from the cardholder data environment.

Question 4

The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule requires financial institutions to designate a qualified individual responsible for overseeing what?

Accepted Answer

Customer information security program

Answer

The GLBA Safeguards Rule requires financial institutions to designate a qualified individual to oversee, implement, and enforce the information security program.

Question 5

Under GDPR, which legal basis allows an organization to process personal data without consent when it is necessary to fulfill a contract with the data subject?

Accepted Answer

Contractual necessity

Answer

Article 6(1)(b) of GDPR permits processing personal data without consent when it is necessary for the performance of a contract to which the data subject is a party.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Compliance Standards & Regulatory Requirements 3