Compliance Strategies CAS-005 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company that operates in the European Union and processes credit card payments is required to comply with both GDPR and PCI DSS. Which of the following is a key difference between these two compliance frameworks?

   • AGDPR applies only to companies in the EU, while PCI DSS applies globally.
   • BGDPR requires encryption of all personal data, while PCI DSS does not require encryption.
   • CGDPR focuses on the protection of personal data, while PCI DSS focuses on the protection of cardholder data.
   • DGDPR is a security standard, while PCI DSS is a data protection regulation.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization is seeking ISO/IEC 27001 certification. The internal audit team has identified that the organization has not conducted a formal risk assessment in the past two years. Which of the following is the most appropriate action to take to align with ISO/IEC 27001 requirements?

   • AUpdate the organization's security policy to include a risk assessment requirement.
   • BRequest an extension from the certification body.
   • CImplement a new firewall to address all identified risks.
   • DConduct a risk assessment and document the results.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small e-commerce company processes credit card payments through a third-party payment gateway. The company stores cardholder names, addresses, and the last four digits of card numbers in its customer database for order history. According to PCI DSS, which of the following best describes the company's compliance obligation?

   • AThe company must comply with PCI DSS only if it processes more than one million transactions per year.
   • BThe company is in scope only for the portion of its network that stores or transmits cardholder data.
   • CThe company is exempt from PCI DSS because it uses a third-party payment gateway.
   • DThe company is fully out of scope because the payment gateway handles all card transactions.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A healthcare organization is implementing a new patient portal that will allow patients to view their medical records and make online payments. The organization must comply with both HIPAA and PCI DSS. Which of the following is the most important consideration when designing the security controls for this portal?

   • AEnsure that the portal uses encryption for both patient health information and cardholder data.
   • BImplement role-based access control to limit access to patient records.
   • CObtain a signed business associate agreement with the payment processor.
   • DConduct a risk assessment to identify potential threats to patient data.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a key requirement of ISO/IEC 27001 for an organization's information security management system?

   • AImplementing a risk assessment process
   • BConducting annual external audits
   • CUsing a specific firewall vendor
   • DEncrypting all data at rest
   Reveal Solution Discussion Select an answer first