SSCP Risk Management & Compliance 2

Question 1

Which PCI DSS requirement mandates that cardholder data environments be segmented from other networks?

Accepted Answer

Requirement 1 – Firewall configuration

Answer

Requirement 3 – Stored data protection

Answer

Requirement 6 – Secure systems development

Answer

Requirement 11 – Security testing

Question 2

What is the primary purpose of a risk register?

Accepted Answer

To document identified risks, their assessments, and treatment plans

Answer

To store encrypted passwords for privileged accounts

Answer

To log all firewall rule changes made by administrators

Answer

To track software patch compliance across endpoints

Question 3

Which law requires US federal agencies to implement information security programs and report security incidents to US-CERT?

Accepted Answer

FISMA (Federal Information Security Modernization Act)

Answer

SOX (Sarbanes-Oxley Act)

Answer

GLBA (Gramm-Leach-Bliley Act)

Answer

FERPA (Family Educational Rights and Privacy Act)

Question 4

An organization transfers risk by purchasing cyber liability insurance. Which risk response strategy does this represent?

Accepted Answer

Risk transference

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk mitigation

Question 5

Which control type is a security policy document that prohibits unauthorized data exfiltration?

Accepted Answer

Administrative control

Answer

Technical control

Answer

Physical control

Answer

Compensating control

Question 6

In risk management, what does 'threat likelihood' refer to?

Accepted Answer

The probability that a threat will exploit a vulnerability within a given timeframe

Answer

The dollar value of assets at risk

Answer

The number of controls currently protecting an asset

Answer

The maximum acceptable downtime for a critical system

Question 7

Which standard provides requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS)?

Accepted Answer

ISO/IEC 27001

Answer

NIST SP 800-53

Answer

CIS Controls v8

Answer

SOC 2 Type II