Explain How Industry Standard Security Frameworks (PCI, HIPAA, OT/IC, Others) Affect Cyber Defense Architecture. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A hospital is integrating its building management system (BMS) with its IT network to improve operational efficiency. The BMS controls HVAC and physical access. The security architect must comply with HIPAA for PHI and OT security best practices. Which architectural approach is most appropriate?

   • ADisable all remote access to the BMS to reduce risk.
   • BUse a cloud-based BMS service to avoid on-premises security concerns.
   • CPlace the BMS on a separate network segment with a firewall controlling traffic to the IT network.
   • DConnect the BMS directly to the IT network for easier management.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   How does a compliance obligation like PCI DSS typically influence the architecture of a logging and monitoring system?

   • AIt has no impact on logging because compliance is a paperwork exercise.
   • BIt prohibits logging of any data that could be considered sensitive, to reduce risk.
   • CIt requires logging of all access to cardholder data and monitoring for suspicious activity, driving centralized log management.
   • DIt requires that all logs be stored in a separate physical location to prevent tampering.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   Which HIPAA Security Rule safeguard category is most directly addressed by implementing encryption of electronic protected health information (ePHI) in transit and at rest?

   • AOrganizational safeguards
   • BAdministrative safeguards
   • CPhysical safeguards
   • DTechnical safeguards
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization is designing its network architecture to support remote access for clinicians. The security architect must ensure the architecture meets HIPAA requirements. Which control is most directly aligned with the HIPAA Security Rule's access control safeguard?

   • AAllow remote access only from approved devices.
   • BImplement a secure remote access solution with unique user IDs and multi-factor authentication.
   • CEncrypt all remote sessions using TLS.
   • DUse a VPN without additional authentication controls.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services firm is mapping PCI DSS requirements to its security architecture. Which architectural control directly satisfies the PCI DSS requirement to protect stored cardholder data?

   • AImplement network segmentation to isolate the CDE.
   • BUse multi-factor authentication for remote access to the CDE.
   • CDeploy a web application firewall (WAF) in front of the payment application.
   • DEncrypt cardholder data at rest using strong cryptography.
   Reveal Solution Discussion Select an answer first