Explain How Industry Standard Security Frameworks (PCI, HIPAA, OT/IC, Others) Affect Cyber Defense Architecture. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is designing its monitoring architecture to meet PCI DSS. Which monitoring capability is most directly required by PCI DSS?

   • AMonitor system performance to ensure availability.
   • BMonitor and track all access to cardholder data.
   • CMonitor employee productivity and internet usage.
   • DMonitor network traffic for malware using a SIEM.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company must comply with both PCI DSS and HIPAA. The security architect is designing a data flow for a system that handles both cardholder data and PHI. Which architectural decision best satisfies both frameworks?

   • ASeparate the data flows into distinct network segments with independent access controls and logging.
   • BApply the most restrictive controls from either framework to all data.
   • CEncrypt all data at rest and in transit, regardless of type.
   • DUse a single logging system to capture all events for both data types.
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   When an organization must comply with both PCI DSS and HIPAA, which architectural approach can satisfy both frameworks' logging requirements without conflict?

   • ADisable logging for ePHI to avoid conflict with PCI DSS requirements.
   • BUse separate logging systems for each framework to avoid any overlap.
   • CImplement a centralized logging solution that captures access to both cardholder data and ePHI, with appropriate access controls and retention policies.
   • DStore logs only in the cloud to satisfy both frameworks.
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   Which architectural control is most directly mapped to the PCI DSS requirement to 'protect stored cardholder data'?

   • AIntrusion detection system
   • BMulti-factor authentication
   • CNetwork segmentation
   • DEncryption of cardholder data at rest
   Reveal Solution Discussion Select an answer first
6. 10foundation · medium

   Which architectural decision is most directly driven by the HIPAA Security Rule's requirement to implement audit controls?

   • AConducting regular risk assessments.
   • BUsing encryption for ePHI in transit.
   • CDeploying a centralized logging and audit trail system to record access to ePHI.
   • DImplementing network segmentation to isolate ePHI systems.
   Reveal Solution Discussion Select an answer first