SP Security and Compliance

Question 1

Which security framework is commonly required for service providers handling credit card data?

Accepted Answer

PCI DSS

Answer

HIPAA

Answer

SOC 2

Answer

FISMA

Question 2

What is a 'penetration test' and why do service providers conduct them?

Accepted Answer

An authorized simulated cyberattack to identify security vulnerabilities before attackers do

Answer

A performance benchmark for network throughput

Answer

A test of customer VPN connectivity

Answer

A firewall rule validation exercise

Question 3

What does 'least privilege' mean in a service provider security context?

Accepted Answer

Users and systems are granted only the minimum permissions required to perform their job function

Answer

Only executives have full system access

Answer

New employees start with zero access until trained

Answer

Service accounts share a single privileged login

Question 4

Which standard provides a framework for information security management systems (ISMS)?

Accepted Answer

ISO 27001

Answer

ISO 9001

Answer

NIST SP 800-53

Answer

CIS Controls

Question 5

What is 'data encryption at rest' in a managed service context?

Accepted Answer

Encrypting stored data so it cannot be read if physical media is compromised

Answer

Encrypting data only while it is being transmitted

Answer

Archiving data in compressed format

Answer

Securing backup tapes in a vault

Question 6

What is a SOC 2 report and why is it important for service providers?

Accepted Answer

A security audit report covering system availability, confidentiality, and processing integrity

Answer

A report on network outage root causes

Answer

An annual financial statement for investors

Answer

A software license compliance report