Compliance and Auditing IT Compliance and Security

Question 1

Which PCI DSS requirement mandates the use of a firewall to protect cardholder data?

Accepted Answer

Requirement 1

Answer

PCI DSS Requirement 1 mandates installing and maintaining network security controls (firewalls) to protect the cardholder data environment from unauthorized access.

Question 2

Under HIPAA Security Rule, what is a 'covered entity' required to conduct periodically?

Accepted Answer

Risk analysis of ePHI

Answer

The HIPAA Security Rule requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Question 3

What is 'data at rest' encryption in the context of IT security compliance?

Accepted Answer

Encrypting data that is stored on devices, databases, or backup media

Answer

Data at rest encryption protects data stored on physical or virtual storage media, such as databases, hard drives, and backup tapes, from unauthorized access if physical security is breached.

Question 4

Which security concept involves verifying a user's identity through multiple verification factors?

Accepted Answer

Multi-factor authentication (MFA)

Answer

Multi-factor authentication (MFA) requires users to verify their identity using two or more factors: something they know (password), something they have (token), or something they are (biometric).

Question 5

What is a 'penetration test' in the context of IT security compliance?

Accepted Answer

An authorized simulated attack to identify exploitable vulnerabilities

Answer

A penetration test is an authorized, simulated cyberattack performed by security professionals to identify exploitable vulnerabilities in systems, networks, or applications before malicious actors do.

Compliance and Auditing Practice Test

Compliance and Auditing Practice Test

Compliance and Auditing IT Compliance and Security