Compliance Strategies CAS-005 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large e-commerce company is preparing for its annual PCI DSS assessment. The company has a complex network with multiple business units, and the cardholder data environment (CDE) is not clearly defined. The security team is concerned about the scope of the assessment. Which of the following is the most effective way to reduce the PCI DSS scope?

   • AConduct a comprehensive risk assessment to identify all systems that process cardholder data.
   • BImplement multi-factor authentication for all users with access to the CDE.
   • CEncrypt all cardholder data stored in the CDE.
   • DImplement network segmentation to isolate the CDE from the rest of the network.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is implementing an ISMS and wants to use a standard that provides a comprehensive set of security controls that can be selected based on the organization's risk assessment. Which of the following standards is most appropriate?

   • AISO/IEC 27002
   • BISO/IEC 27001
   • CNIST SP 800-53
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key requirement of ISO/IEC 27001 for maintaining an ISMS?

   • APerforming annual penetration tests
   • BContinual improvement of the ISMS
   • CUsing a specific encryption algorithm
   • DStoring all logs for at least one year
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following best describes the primary purpose of the PCI DSS?

   • ATo protect cardholder data and reduce credit card fraud
   • BTo ensure the accuracy and reliability of financial reporting
   • CTo establish a framework for managing information security risks across all business processes
   • DTo regulate the transfer of personal data across international borders
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services company is expanding its operations to accept credit card payments. The compliance officer is concerned about meeting both PCI DSS and industry-specific regulations such as GLBA. Which of the following is the most effective approach to align security practices with these requirements?

   • AFocus only on PCI DSS because it is more prescriptive than GLBA.
   • BImplement a single set of security controls that satisfies the most stringent requirements of each regulation.
   • CHire a third-party auditor to certify compliance with both regulations.
   • DUse a cloud provider that claims to be compliant with both regulations.
   Reveal Solution Discussion Select an answer first