Applicability of Standards in Regulatory Versus Contractual Situations CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In which context is a regulatory standard most likely to be mandatory?

   • AA company voluntarily adopts a security framework to improve its internal processes
   • BA financial institution must comply with a data protection law that specifies security controls
   • CA software vendor includes a security checklist in its product documentation
   • DA government agency requires a specific security standard for all its contractors
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A software vendor is negotiating a security assessment with a large enterprise client. The client insists that the assessment follow the PCI DSS requirements because the client processes credit card transactions. The vendor's standard methodology is based on the ISO/IEC 27001 framework. What is the most appropriate action for the vendor to take?

   • ARefuse to follow PCI DSS because it is a regulatory standard that only applies to the client, not to the vendor.
   • BAgree to follow PCI DSS in the contract, as it is a contractual requirement that becomes binding once both parties sign.
   • CFollow both PCI DSS and ISO/IEC 27001 simultaneously, as this is the only way to satisfy the client's regulatory obligations.
   • DUse ISO/IEC 27001 instead, as it is a more comprehensive standard and the client's request is not legally enforceable.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What role do acceptance criteria play in contractual security testing?

   • AThey are used to determine the legal penalties for non-compliance
   • BThey are optional and can be ignored if testing is successful
   • CThey are set by the tester after testing is complete
   • DThey define the conditions that must be met for the testing to be considered complete
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key difference between regulatory and contractual standards?

   • ARegulatory standards apply only to private companies, while contractual standards apply to public entities
   • BRegulatory standards are developed by private bodies, while contractual standards are developed by governments
   • CRegulatory standards are voluntary, while contractual standards are mandatory
   • DRegulatory standards are enforced by government authorities, while contractual standards are enforced through civil law
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a typical audit implication of a regulatory standard?

   • AThe organization must maintain evidence of compliance for a specified period
   • BThe organization must use a specific commercial testing tool
   • CThe organization must publish its test results on a public website
   • DThe organization must hire an external tester for every test
   Reveal Solution Discussion Select an answer first