Compliance Strategies CAS-005 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company that processes credit card payments is implementing a new system to store cardholder data. The security team is deciding how to protect the data at rest. Which of the following is a PCI DSS requirement that must be implemented?

   • AUse strong cryptography to render cardholder data unreadable.
   • BImplement network segmentation to isolate the cardholder data environment.
   • CRestrict access to cardholder data to authorized personnel only.
   • DDeploy an intrusion detection system to monitor the storage systems.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is designing a new payment processing system and wants to minimize its PCI DSS compliance scope. Which of the following strategies is most effective for reducing scope?

   • AUse network segmentation to isolate the cardholder data environment from the rest of the network.
   • BConduct annual security awareness training for all staff.
   • CEncrypt all cardholder data in transit and at rest.
   • DImplement strong access control measures for all employees.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the ISO/IEC 27000 series of standards?

   • ATo provide a framework for information security management systems
   • BTo establish standards for financial reporting and auditing
   • CTo define requirements for data privacy in the European Union
   • DTo specify technical requirements for network hardware
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   According to PCI DSS, which of the following is a key requirement for protecting cardholder data?

   • AStoring cardholder data in a separate physical server
   • BPerforming annual vulnerability scans by internal staff
   • CEncrypting cardholder data when transmitted over open, public networks
   • DUsing a firewall to block all inbound and outbound traffic
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization is implementing an ISMS and has decided to pursue ISO/IEC 27001 certification. The organization has a limited budget and must choose between hiring a consultant to conduct the risk assessment or using internal staff. Which of the following is the most important factor to consider when making this decision?

   • AThe consultant may provide an objective and unbiased risk assessment.
   • BInternal staff will be more cost-effective than hiring a consultant.
   • CThe consultant will be able to implement the risk treatment plan.
   • DInternal staff are more familiar with the organization's systems and processes.
   Reveal Solution Discussion Select an answer first