Compliance Strategies CAS-005 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization is implementing an ISMS and has decided to use ISO/IEC 27001. The organization has a mature security program but lacks a formal risk management process. Which of the following is the most appropriate first step in implementing the ISMS?

   • ADevelop a risk treatment plan.
   • BImplement security controls.
   • CDefine the scope of the ISMS.
   • DConduct a risk assessment.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has implemented an ISMS aligned with ISO/IEC 27001. During an internal audit, the auditor notes that the company has not defined a process for regularly reviewing and updating the risk treatment plan. Which ISO/IEC 27001 requirement is being violated?

   • AInformation security risk assessment and treatment
   • BLeadership and commitment
   • CPerformance evaluation
   • DContext of the organization
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A global financial services company processes credit card payments and is subject to both PCI DSS and local data protection regulations. The company is considering using a cloud provider to host its payment processing system. Which of the following is the most important consideration for maintaining compliance?

   • AUse a cloud provider that is located in the same country as the company.
   • BImplement encryption for all data stored in the cloud.
   • CConduct a risk assessment to identify all risks associated with cloud hosting.
   • DEnsure the cloud provider is PCI DSS compliant and provides a shared responsibility model.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a key requirement of PCI DSS for maintaining a secure network?

   • AInstalling and maintaining a firewall configuration to protect cardholder data
   • BUsing strong passwords for all user accounts
   • CRestricting physical access to cardholder data
   • DEncrypting all data stored on the network
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is implementing PCI DSS controls and needs to ensure that only authorized personnel can access cardholder data. Which of the following is a PCI DSS requirement that directly addresses this?

   • AImplement a formal access control policy that restricts access to cardholder data on a need-to-know basis.
   • BEncrypt all cardholder data stored in databases.
   • CConduct regular vulnerability scans of the network.
   • DImplement a firewall to protect the cardholder data environment.
   Reveal Solution Discussion Select an answer first