Microsoft Networking Essentials Exam Regulatory Frameworks & Compliance 5

Question 1

A retailer experiences a breach of 60,000 payment card records. Under PCI DSS, which action is immediately required?

Accepted Answer

Contain the breach, notify acquiring bank and card brands, and preserve forensic evidence

Answer

Notify all cardholders within 24 hours

Answer

Shut down all payment systems permanently

Answer

File a report with the FTC within 48 hours

Question 2

Which of the following is an example of a technical control required by the NIST Cybersecurity Framework's 'Protect' function?

Accepted Answer

Implementing multi-factor authentication for network access

Answer

Conducting annual employee security awareness training

Answer

Developing an incident response plan

Answer

Performing a business impact analysis

Question 3

A healthcare organization wants to share de-identified patient data for research. Under HIPAA, what is the 'Safe Harbor' de-identification method?

Accepted Answer

Removing all 18 specific types of identifiers defined by HHS from the dataset

Answer

Encrypting all 18 categories of PHI identifiers

Answer

Obtaining explicit written consent from each patient

Answer

Assigning pseudonyms to replace patient names

Question 4

Which federal law establishes security and privacy requirements for federal government information systems and requires each agency to implement an information security program?

Accepted Answer

FISMA (Federal Information Security Modernization Act)

Answer

FERPA

Answer

CFAA (Computer Fraud and Abuse Act)

Answer

E-Government Act

Question 5

An organization's network policy requires all data classified as 'Confidential' to be encrypted at rest. This policy aligns with which type of compliance control?

Accepted Answer

Preventive control

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 6

Under which circumstance does the Electronic Communications Privacy Act (ECPA) permit an employer to monitor employee email without consent?

Accepted Answer

When the employer owns the email system and has established a monitoring policy

Answer

Only if the employee is suspected of criminal activity

Answer

Only with a court order

Answer

Never — employee email is always private under ECPA

Question 7

A network engineer is asked to verify that a third-party vendor's practices meet the organization's security standards before signing a contract. This process is best described as:

Accepted Answer

Third-party vendor risk assessment (supply chain risk management)

Answer

Penetration testing

Answer

Security information and event management (SIEM)

Answer

Gap analysis against ISO 27001