Industry Best Practices, Guidance, Frameworks, and Standards CCOA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security manager is reviewing the organization's compliance with multiple standards, including ISO 27001, PCI DSS, and GDPR. The manager wants to streamline the compliance process and reduce duplication of effort. Which approach is most effective?

   • AAutomate compliance checking without a unified framework
   • BFocus only on the most stringent standard and ignore others
   • CMaintain separate compliance documentation for each standard
   • DCreate a single control framework that maps requirements from all applicable standards
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which organization publishes the CIS Benchmarks, which provide configuration guidelines for securing systems?

   • ACenter for Internet Security (CIS)
   • BNational Institute of Standards and Technology (NIST)
   • CInternational Organization for Standardization (ISO)
   • DInternet Engineering Task Force (IETF)
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is reviewing the organization's incident response plan. The analyst wants to ensure the plan aligns with guidance from a recognized body. Which document provides the most directly applicable guidance for structuring incident response?

   • AISO 27001 Annex A
   • BCIS Controls v8
   • CNIST SP 800-61
   • DOWASP ASVS
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare organization is required to demonstrate to auditors that it has a structured process for identifying, protecting, detecting, responding to, and recovering from cyber threats. Which recognized framework should the organization adopt to structure this process?

   • AThe NIST Cybersecurity Framework (CSF)
   • BThe ISO 27001 standard
   • CThe MITRE ATT&CK framework
   • DThe CIS Controls
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security consultant is advising a client that must comply with both GDPR and PCI DSS. The client wants to adopt a single framework that can help manage both compliance obligations efficiently. Which approach is most appropriate?

   • AUse the NIST CSF as the sole compliance framework
   • BRely on the CIS Controls to satisfy all GDPR and PCI DSS requirements
   • CImplement separate, siloed compliance programs for GDPR and PCI DSS
   • DAdopt ISO 27001 and map GDPR and PCI DSS requirements to its controls
   Reveal Solution Discussion Select an answer first