SP Security and Compliance 3

Question 1

What is the primary purpose of a data retention policy for a managed service provider?

Accepted Answer

Define how long different types of data must be kept and when it must be securely deleted

Answer

A data retention policy ensures data is kept for required legal, regulatory, or business periods and then securely destroyed to minimize privacy and compliance risk.

Question 2

What is 'incident response' in the context of a cybersecurity event at a service provider?

Accepted Answer

A structured process for detecting, containing, eradicating, and recovering from security incidents

Answer

Incident response is a formal, documented process with defined phases — preparation, detection, containment, eradication, recovery, and lessons learned — for handling security events.

Question 3

What does 'network segmentation' accomplish from a security perspective?

Accepted Answer

Limits lateral movement of attackers by dividing the network into isolated zones

Answer

Network segmentation divides infrastructure into separate zones with controlled access between them, preventing an attacker who compromises one segment from freely moving to others.

Question 4

Which compliance regulation primarily governs data privacy for US citizens in California?

Accepted Answer

CCPA

Answer

The California Consumer Privacy Act (CCPA) gives California residents the right to know what personal data is collected, request deletion, and opt out of data sales.

Question 5

What is a 'patch management' program and why is it critical for service providers?

Accepted Answer

A systematic process to apply security updates to systems before vulnerabilities can be exploited

Answer

Patch management ensures that security updates are tested and deployed promptly across all managed systems to close known vulnerabilities before threat actors exploit them.

SP - Certified Service Provider Practice Test

SP - Certified Service Provider Practice Test

SP Security and Compliance 3