Identify Compliance Requirements CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A company is developing a new payment processing module for an e-commerce platform. The module will handle credit card transactions. Which compliance standard must the software requirements explicitly address?

   • AHIPAA
   • BPCI DSS
   • CSOC 2
   • DISO 27001
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A software application will handle credit card transactions. Which industry-specific compliance standard must the software requirements address?

   • AThe Health Insurance Portability and Accountability Act (HIPAA)
   • BThe Payment Card Industry Data Security Standard (PCI DSS)
   • CThe Sarbanes-Oxley Act (SOX)
   • DThe Federal Information Security Management Act (FISMA)
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A hospital is deploying a new patient portal that will allow patients to view their medical records and schedule appointments. Which compliance standard must the software requirements address?

   • AFERPA
   • BHIPAA
   • CSOX
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A software company is developing a global e-commerce platform that will process personal data of users in the EU, the UK, and the United States. The platform will also handle credit card payments. The security team is identifying the regulatory authorities and standards. Which of the following is the most comprehensive set of authorities and standards to consider?

   • AOnly the U.S. FTC and PCI SSC
   • BOnly the EU national DPAs and PCI SSC
   • CEU national DPAs, the UK ICO, the U.S. FTC, and PCI SSC
   • DOnly the UK ICO and PCI SSC
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A multinational corporation is developing a human resources system that will store employee data for employees in the EU and the United States. The company is headquartered in the UK. Which regulatory authorities should the security team identify as having jurisdiction over the employee data?

   • AOnly the UK Information Commissioner's Office (ICO)
   • BOnly the U.S. Federal Trade Commission (FTC)
   • CThe EU national data protection authorities and the relevant U.S. federal and state authorities
   • DOnly the European Data Protection Board (EDPB)
   Reveal Solution Discussion Select an answer first