SY0-601 Governance, Risk & Compliance 2

Question 1

Which compliance standard specifically governs the protection of payment card data and requires quarterly external vulnerability scans of cardholder data environments?

Accepted Answer

PCI-DSS

Answer

PCI-DSS (Payment Card Industry Data Security Standard) mandates security controls for cardholder data environments, including quarterly vulnerability scans.

Question 2

A hospital must implement safeguards to protect the privacy and security of patients' electronic medical records. Which U.S. regulation applies?

Accepted Answer

HIPAA

Answer

HIPAA (Health Insurance Portability and Accountability Act) requires healthcare entities to protect the privacy and security of Protected Health Information (PHI).

Question 3

A server failure has an Annual Rate of Occurrence (ARO) of 2 and a Single Loss Expectancy (SLE) of $15,000. What is the Annual Loss Expectancy (ALE)?

Accepted Answer

$30,000

Answer

ALE = SLE × ARO = $15,000 × 2 = $30,000, representing the expected annual financial loss from this specific risk.

Question 4

A procurement team reviews a cloud vendor's SOC 2 Type II report before signing a contract. What type of assessment does this represent?

Accepted Answer

Third-party audit

Answer

A SOC 2 Type II report is produced by an independent third-party auditor, making its review part of third-party risk and audit evaluation.

Question 5

Which SOC report type evaluates the five trust service criteria (security, availability, processing integrity, confidentiality, privacy) over a defined period of time and is restricted to specified parties?

Accepted Answer

SOC 2 Type II

Answer

SOC 2 Type II covers the same five trust criteria as Type I but assesses controls over a period of time (6–12 months) and is not publicly available.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Governance, Risk & Compliance 2