Applying Security Standards CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A test team is preparing to test a system that must comply with the HIPAA Security Rule. The system stores electronic protected health information (ePHI). The team is writing the test plan. Which requirement must be addressed in the test plan to ensure HIPAA compliance?

   • AVerifying that audit controls are in place to record and examine activity in systems that contain ePHI
   • BVerifying that the system can be accessed from any device without authentication
   • CTesting the system's ability to integrate with social media platforms
   • DEnsuring the system can process credit card payments securely
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A software company is developing a SaaS product for European customers and must comply with GDPR. The test team is planning security testing. The product will store personal data in an EU region. A key GDPR requirement is conducting a Data Protection Impact Assessment (DPIA). How should the test team integrate the DPIA into the testing lifecycle?

   • AEnsure the DPIA is performed only by the legal team and not shared with testers
   • BUse the DPIA findings to prioritize test scenarios for high-risk data processing activities
   • CConduct the DPIA after all testing is complete to document what was done
   • DReplace all functional testing with privacy-focused testing
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A healthcare organization is developing a patient portal that will handle protected health information (PHI). The security test team needs to select a standard that specifically addresses the security and privacy requirements for this type of data. Which standard is most appropriate?

   • ASOC 2
   • BISO/IEC 27001
   • CHIPAA Security Rule
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A test manager is planning the security testing for a system that must comply with both ISO/IEC 27001 and the NIST SP 800-53. The system is a cloud-based service. The test manager needs to decide how to handle the overlapping requirements. What is the most effective strategy?

   • ATest against ISO/IEC 27001 only and document that NIST SP 800-53 is out of scope
   • BRun two completely separate test cycles, one for each standard
   • CCreate a unified control matrix that maps requirements from both standards to specific test cases
   • DUse NIST SP 800-53 only because it is more detailed than ISO/IEC 27001
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is adopting the OWASP Application Security Verification Standard (ASVS) for its web application testing. The test lead needs to determine the appropriate verification level for a new internet-facing customer portal. According to ASVS, which level is most appropriate for this application?

   • ALevel 3, which is reserved for applications with the highest security requirements, such as military or critical infrastructure
   • BLevel 1, which is required for all applications and covers basic security verification
   • CLevel 0, which indicates no security verification is required
   • DLevel 2, which is recommended for applications that handle sensitive data or are internet-facing
   Reveal Solution Discussion Select an answer first