SSCP Risk Management & Compliance 2

Question 1

Which PCI DSS requirement mandates that cardholder data environments be segmented from other networks?

Accepted Answer

Requirement 1 – Firewall configuration

Answer

PCI DSS Requirement 1 addresses firewall and router configurations to isolate the cardholder data environment (CDE) from untrusted networks through network segmentation.

Question 2

What is the primary purpose of a risk register?

Accepted Answer

To document identified risks, their assessments, and treatment plans

Answer

A risk register is a central repository that records identified risks along with their likelihood, impact, owner, and chosen treatment (accept, mitigate, transfer, or avoid).

Question 3

Which law requires US federal agencies to implement information security programs and report security incidents to US-CERT?

Accepted Answer

FISMA (Federal Information Security Modernization Act)

Answer

FISMA establishes mandatory information security standards for US federal agencies, requiring risk management programs, security controls, and incident reporting to US-CERT.

Question 4

An organization transfers risk by purchasing cyber liability insurance. Which risk response strategy does this represent?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial burden of a loss to a third party (e.g., an insurance company) without eliminating the underlying risk.

Question 5

Which control type is a security policy document that prohibits unauthorized data exfiltration?

Accepted Answer

Administrative control

Answer

Administrative (also called managerial) controls are policy-based, procedural, or governance measures that guide employee behavior rather than technical or physical mechanisms.

(SSCP) Systems Security Certified Practitioner Exam Practice Test

(SSCP) Systems Security Certified Practitioner Exam Practice Test

SSCP Risk Management & Compliance 2