Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which US federal agency publishes the Cybersecurity Framework (CSF) that provides voluntary guidance for organizations to manage and reduce cybersecurity risk?

   • AFTC
   • BCISA
   • CNIST
   • DNSA
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to implement a risk management process that is aligned with the NIST Cybersecurity Framework. Which sequence of functions best represents the core of the NIST CSF?

   • APlan, Do, Check, Act
   • BAssess, Design, Implement, Monitor
   • CIdentify, Protect, Detect, Respond, Recover
   • DPrevent, Detect, Contain, Eradicate, Recover
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A European company's marketing team wants to send promotional emails to customers who signed up for a newsletter. The team has a list of email addresses collected from a previous campaign, but the customers were not told their data would be used for marketing. Under GDPR, what must the company do before sending the emails?

   • AAnonymize the email addresses before sending the campaign
   • BSend the emails but include an unsubscribe link in each message
   • CNotify the data protection authority of the new processing activity
   • DObtain explicit consent from each customer for the new marketing purpose
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company that processes credit card payments wants to ensure its network segmentation reduces the scope of PCI DSS compliance. Which approach is most effective?

   • AEncrypt all data in the database and claim segmentation is unnecessary.
   • BApply segmentation only during audits to demonstrate compliance.
   • CIsolate the cardholder data environment (CDE) from the rest of the network with firewalls.
   • DUse a single flat network to simplify management and reduce costs.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization is implementing ISO/IEC 27001 and needs to define the scope of its ISMS. Which factor is most important to consider when defining the scope?

   • AThe number of employees in the organization.
   • BThe organization's annual revenue.
   • CThe boundaries and applicability of the ISMS, including internal and external issues.
   • DThe location of the organization's headquarters.
   Reveal Solution Discussion Select an answer first