SY0-601 Governance, Risk & Compliance 2

Question 1

Which compliance standard specifically governs the protection of payment card data and requires quarterly external vulnerability scans of cardholder data environments?

Accepted Answer

PCI-DSS

Answer

HIPAA

Answer

GLBA

Answer

SOX

Question 2

A hospital must implement safeguards to protect the privacy and security of patients' electronic medical records. Which U.S. regulation applies?

Accepted Answer

HIPAA

Answer

FERPA

Answer

COPPA

Answer

GLBA

Question 3

A server failure has an Annual Rate of Occurrence (ARO) of 2 and a Single Loss Expectancy (SLE) of $15,000. What is the Annual Loss Expectancy (ALE)?

Accepted Answer

$30,000

Answer

$7,500

Answer

$15,000

Answer

$45,000

Question 4

A procurement team reviews a cloud vendor's SOC 2 Type II report before signing a contract. What type of assessment does this represent?

Accepted Answer

Third-party audit

Answer

Penetration test

Answer

Vulnerability scan

Answer

Internal risk assessment

Question 5

Which SOC report type evaluates the five trust service criteria (security, availability, processing integrity, confidentiality, privacy) over a defined period of time and is restricted to specified parties?

Accepted Answer

SOC 2 Type II

Answer

SOC 1 Type I

Answer

SOC 2 Type I

Answer

SOC 3

Question 6

An organization's policy requires all email records to be stored for 7 years to satisfy legal and regulatory requirements. In which type of policy is this defined?

Accepted Answer

Data Retention Policy

Answer

Acceptable Use Policy

Answer

Change Management Policy

Answer

Incident Response Policy

Question 7

Which U.S. state law grants residents the right to know what personal information is collected about them, the right to opt out of its sale, and the right to request its deletion?

Accepted Answer

CCPA

Answer

HIPAA

Answer

FERPA

Answer

SOX