Applicability of Standards in Regulatory Versus Contractual Situations CT-SEC Practice Questions (Page 3)

Questions 11–14

1. 11foundation · easy

   Which scenario best illustrates the application of a contractual standard?

   • AA hospital must follow a national health data privacy law
   • BA software vendor agrees to follow OWASP ASVS in a client contract
   • CA manufacturer adopts ISO 9001 for internal quality management
   • DA bank must comply with a central bank's security regulation
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common consequence of non-compliance with a regulatory standard?

   • AThe organization may lose its certification from a private body
   • BThe organization may be publicly criticized by a standards body
   • CThe organization may face fines or legal sanctions
   • DThe organization may be required to renegotiate its contracts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security testing firm is hired by a hospital to conduct a penetration test. The hospital is subject to HIPAA. The testing firm's report will be used to demonstrate compliance to the Office for Civil Rights (OCR). What is the most important aspect of the testing report?

   • AThe report must be reviewed by a certified public accountant (CPA) to be considered valid.
   • BThe report must clearly link each finding to specific HIPAA Security Rule requirements.
   • CThe report must include a detailed cost-benefit analysis of remediation options.
   • DThe report must be written in a way that is understandable to non-technical hospital administrators.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following standards is typically mandated by law or regulation for organizations handling credit card data?

   • AISO/IEC 27001
   • BOWASP ASVS
   • CPCI DSS
   • DNIST SP 800-53
   Reveal Solution Discussion Select an answer first