SP Security and Compliance

Question 1

Which security framework is commonly required for service providers handling credit card data?

Accepted Answer

PCI DSS

Answer

Payment Card Industry Data Security Standard (PCI DSS) mandates security controls for any organization that stores, processes, or transmits cardholder data.

Question 2

What is a 'penetration test' and why do service providers conduct them?

Accepted Answer

An authorized simulated cyberattack to identify security vulnerabilities before attackers do

Answer

Penetration testing is an authorized, simulated attack on systems to discover exploitable vulnerabilities before malicious actors can find and use them.

Question 3

What does 'least privilege' mean in a service provider security context?

Accepted Answer

Users and systems are granted only the minimum permissions required to perform their job function

Answer

The principle of least privilege limits access rights for users, accounts, and processes to only what is strictly necessary, minimizing potential damage from breaches.

Question 4

Which standard provides a framework for information security management systems (ISMS)?

Accepted Answer

ISO 27001

Answer

ISO 27001 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

Question 5

What is 'data encryption at rest' in a managed service context?

Accepted Answer

Encrypting stored data so it cannot be read if physical media is compromised

Answer

Encryption at rest ensures that data stored on disks, databases, and backups is unreadable without the correct encryption keys, even if physical storage is stolen.

SP - Certified Service Provider Practice Test

SP - Certified Service Provider Practice Test

SP Security and Compliance