A federal agency is moving its email system to a cloud provider. The agency's security team must ensure the provider's security controls are assessed and authorized. The provider already has an ISO/IEC 27101 certification. Which of the following is the most appropriate next step?

Require the provider to obtain a FedRAMP authorization

Conduct a separate FISMA assessment for the provider

Accept the ISO/IEC 27101 certification as sufficient

What is the primary purpose of the Federal Risk and Authorization Management Program (FedRAMP)?

To secure federal agency on-premises data centers

To regulate the use of personal data of EU citizens

To enforce financial reporting controls for public companies

To standardize security assessments for cloud services used by federal agencies

A U.S.-based e-commerce company processes credit card payments for EU customers. The security team is designing a compliance program and must address both the handling of cardholder data and the personal data of EU customers. Which combination of frameworks should the team prioritize?

ISO/IEC 27101 for security management and PCI DSS for cardholder data

PCI DSS for cardholder data and GDPR for EU personal data

FedRAMP for cloud authorization and GDPR for EU personal data

SOX for financial reporting and PCI DSS for cardholder data

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 4

1.4 Infer the Industry for Various Compliance Standards Such as PCI, FISMA, FedRAMP, SOC, SOX, PCI, GDPR, Data Privacy, and ISO 27101 350-201 Practice Questions (Page 2)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

8concepts

20%of the exam

Questions 6–10

6expert · hard
A federal agency is moving its email system to a cloud provider. The agency's security team must ensure the provider's security controls are assessed and authorized. The provider already has an ISO/IEC 27101 certification. Which of the following is the most appropriate next step?
Select an answer first
7foundation · easy
What is the primary purpose of the Federal Risk and Authorization Management Program (FedRAMP)?
Select an answer first
8expert · hard
A publicly traded company's IT department provides hosting services to its own financial reporting systems. The external auditor requests evidence of internal controls over financial reporting. Which report or framework is most relevant to this request?
Select an answer first
9expert · hard
A payment processor is evaluating its compliance obligations. It handles cardholder data for merchants and also processes personal data of EU data subjects. The company is not a U.S. federal contractor and is not publicly traded. Which combination of compliance requirements is most appropriate?
Select an answer first
10application · medium
A U.S.-based e-commerce company processes credit card payments for EU customers. The security team is designing a compliance program and must address both the handling of cardholder data and the personal data of EU customers. Which combination of frameworks should the team prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

1.4 Infer the Industry for Various Compliance Standards Such as PCI, FISMA, FedRAMP, SOC, SOX, PCI, GDPR, Data Privacy, and ISO 27101 350-201 Practice Questions (Page 2)

Questions 6–10

A federal agency is moving its email system to a cloud provider. The agency's security team must ensure the provider's security controls are assessed and authorized. The provider already has an ISO/IEC 27101 certification. Which of the following is the most appropriate next step?

What is the primary purpose of the Federal Risk and Authorization Management Program (FedRAMP)?

A publicly traded company's IT department provides hosting services to its own financial reporting systems. The external auditor requests evidence of internal controls over financial reporting. Which report or framework is most relevant to this request?

A payment processor is evaluating its compliance obligations. It handles cardholder data for merchants and also processes personal data of EU data subjects. The company is not a U.S. federal contractor and is not publicly traded. Which combination of compliance requirements is most appropriate?

A U.S.-based e-commerce company processes credit card payments for EU customers. The security team is designing a compliance program and must address both the handling of cardholder data and the personal data of EU customers. Which combination of frameworks should the team prioritize?

Keep studying — Fundamentals