Regulations, standards and Frameworks

Industry-standard frameworks are primarily useful for which of the following purposes?

• Aligning with an audit-based standard

• Aligning IT and security with the enterprise’s business strategy

• Providing high-level organization over processes

• Creating diagrams to document system architectures

Which of the following terms is a privacy regulation?

• CFAA

• SOX

• GDPR

• PCI DSS

Which of the following are security control lists that can be employed in an enterprise? (Choose all that apply.)

• ISO 27001

• CSA CCM

• CIS top 20 list

• NIST RMF

Which reports are done over a period of time to verify operational efficiency and effectiveness of controls?

• SOC Type I

• PCI DSS audit report

• CSA CCM

• SOC Type II

Which of the following is not a PCI DSS control objective?

• Build and maintain a secure network

• Maintain a vulnerability management program

• Establish a CSO position

• Implement strong access control measures

Which ISO standard covers risk management activities?

• ISO 27001

• ISO 27701

• ISO 27002

• ISO 31000

Guidance for setting up and operating computer systems to a secure level that is understood and documented can be obtained from which of the following? (Choose all that apply.)

• ISO

• CIS

• Government sources

• Vendors/manufacturers

Which of the following are not U.S. laws associated with cybersecurity? (Choose all that apply.)

• CFAA

• PCI DSS

• GDPR

• Sarbanes Oxley (SOX)

Where would one look for consensus-developed, secure configuration guidelines for hardening a wide range of technical items?

• CIS

• ISO

• Vendors/manufacturers

• Peers

Comprehensive, proscriptive configuration guides for all major operating systems are available from which of the following? (Choose all that apply.)

• Vendors/manufacturers

• NIST

• CIS

• ISO