Regulatory Frameworks and Compliance Requirements NDE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A U.S. federal contractor handles government data and also processes EU citizens' personal data. The security team must implement a monitoring solution that satisfies both FISMA and GDPR requirements. Which approach best balances the two?

   • AFocus on FISMA compliance and ignore GDPR because the company is U.S.-based
   • BStore all monitoring data in the U.S. to avoid GDPR
   • CImplement continuous monitoring with role-based access to logs and data minimization for EU personal data
   • DDelete all logs after 24 hours to comply with GDPR's data minimization
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A US healthcare provider also processes credit card payments for patient copays. The compliance officer wants to streamline audits. Which approach correctly addresses the overlap between HIPAA and PCI DSS?

   • AApplying only PCI DSS requirements because they are more specific
   • BCreating separate, isolated networks for health data and payment data to avoid overlap
   • CImplementing a unified security framework that maps controls to both HIPAA and PCI DSS requirements
   • DApplying only HIPAA requirements because they are stricter
   Reveal Solution Discussion Select an answer first
4. 43expert · hard · select all that apply

   A company that processes credit card data and EU personal data is implementing network segmentation. The security team must ensure compliance with both PCI DSS and GDPR. Which of the following controls are appropriate? Select all that apply.

   • ARetain logs for at least one year for both PCI DSS and GDPR compliance
   • BImplement access controls that limit access to personal data to authorized personnel
   • CEncrypt personal data and cardholder data in transit
   • DAllow all internal traffic to flow freely to simplify network management
   • ESegment the cardholder data environment (CDE) from the rest of the network
   Check answers Discussion Select an answer first
5. 44application · medium

   A financial institution subject to GLBA is implementing network defense controls. The security team must ensure that customer financial information is protected during transmission. Which control is most directly aligned with GLBA's Safeguards Rule?

   • AAllow third-party vendors to access customer data without review
   • BImplement a data retention policy that deletes all logs after 24 hours
   • CEncrypt all customer data in transit using TLS
   • DDisable encryption to improve performance
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A U.S. federal agency is implementing network defense controls and must comply with FISMA. The agency's security team is developing an incident response plan. Which requirement is most directly tied to FISMA?

   • AComply with the EU's General Data Protection Regulation
   • BObtain a credit card industry certification
   • CEnsure all data is stored on-premises
   • DImplement continuous monitoring and reporting of security controls
   Reveal Solution Discussion Select an answer first