Regulatory Frameworks and Compliance Requirements NDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A U.S. company that handles health records and also processes credit card payments is determining which regulatory frameworks apply. The compliance officer asks which frameworks are relevant. Which combination is correct?

   • ACOPPA and FERPA
   • BFISMA and CCPA
   • CHIPAA and PCI DSS
   • DSOX and GLBA
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which network defense practice directly supports compliance with GDPR's requirement to protect personal data?

   • ADeleting all security logs to reduce data retention
   • BEncrypting personal data in transit and at rest
   • CAllowing all employees to access personal data without restrictions
   • DStoring all personal data in plaintext for easy access
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company that processes credit card payments is designing its network architecture. To reduce the scope of PCI DSS compliance, which network defense measure is most effective?

   • AConducting regular vulnerability scans of all systems
   • BSegmenting the cardholder data environment from the rest of the network using firewalls
   • CImplementing strong encryption for all data at rest
   • DDeploying a network intrusion prevention system (IPS) at the internet edge
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company operates in the EU and the US, handling both EU employee data and US customer payment card data. The security team is designing a data retention policy. Which approach best balances GDPR's data minimization with PCI DSS's retention requirements?

   • ARetaining all data for 10 years to ensure compliance with both frameworks
   • BDeleting all data after 30 days to minimize GDPR risk
   • CStoring all data in the EU to simplify compliance
   • DSetting different retention periods for personal data and cardholder data, with automated deletion after the required period
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   To comply with PCI DSS, which network defense control should an organization implement for systems that store cardholder data?

   • ADisabling all network monitoring to avoid detection of sensitive data
   • BAllowing unrestricted outbound internet access from cardholder data systems
   • CPlacing cardholder data systems on a separate network segment with strict firewall rules
   • DUsing shared credentials for administrative access to cardholder data systems
   Reveal Solution Discussion Select an answer first