Applicability of Standards in Regulatory Versus Contractual Situations CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization in the United States is required to comply with HIPAA. They hire an external security testing firm to assess their systems. The testing firm's report will be used to demonstrate compliance to the Office for Civil Rights (OCR) during an audit. What is the most critical consideration for the security testing firm?

   • AEnsure the testing firm signs a business associate agreement (BAA) with the healthcare organization.
   • BEnsure the testing is performed by a certified ethical hacker (CEH) to meet HIPAA's personnel requirements.
   • CEnsure the testing is conducted in a manner that does not disrupt production systems, as HIPAA requires continuous availability.
   • DEnsure the testing methodology and report explicitly map findings to HIPAA Security Rule requirements.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How do contractual standards affect the scope of security testing?

   • AThey leave the scope entirely to the tester's discretion
   • BThey define the scope based on the contract's requirements
   • CThey require testing of all systems in the organization
   • DThey require testing to be performed only by external parties
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How do regulatory standards influence security testing activities?

   • AThey specify mandatory testing requirements and audit implications
   • BThey only apply to testing performed by government agencies
   • CThey define the exact testing tools that must be used
   • DThey are optional guidelines that testers may choose to follow
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational corporation operates a data center in the EU and a subsidiary in a non-EU country. The EU data center processes personal data of EU citizens and is subject to GDPR. The non-EU subsidiary is not subject to GDPR but has a contract with the EU parent company that requires adherence to GDPR principles. A security test is planned for both locations. Which statement accurately describes the legal basis for the security testing requirements?

   • AThe non-EU subsidiary must comply with GDPR as a regulatory requirement, while the EU data center must comply as a contractual requirement.
   • BBoth locations must comply with GDPR as a regulatory requirement because the parent company is EU-based.
   • CThe EU data center must comply with GDPR as a regulatory requirement, while the non-EU subsidiary must comply with GDPR principles as a contractual requirement.
   • DBoth locations must comply with GDPR as a contractual requirement because the contract between the parent and subsidiary is the only binding agreement.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does the regulatory nature of a standard influence the reporting of security testing?

   • AReports must be published publicly
   • BReports are only shared with the client and no one else
   • CReports must be tailored to meet audit and compliance requirements
   • DReports are optional and can be verbal
   Reveal Solution Discussion Select an answer first