CASP+ (Chapter 2)

An organization is preparing to comply with privacy regulations and industry standards to protect sensitive data. Which of the following standards specifically provides guidelines for compliance with card data protection?

• A) General Data Protection Regulation (GDPR)

• B) Payment Card Industry Data Security Standard (PCI DSS)

• C) Capability Maturity Model Integration (CMMI)

• D) Cloud Security Assurance (CSA STAR)

An organization is planning to export software with encryption capabilities to multiple countries and wants to ensure compliance with international export controls. Which resource can the organization refer to for understanding the legal stance on encryption in different countries?

• A) North Atlantic Treaty Organization (NATO) website

• B) United Nations Security Council (UNSC) database

• C) Global Encryption Report

• D) Organization for Economic Cooperation and Development (OECD) guidelines

An organization is preparing to comply with cybersecurity regulations such as FISMA. Which of the following standards is commonly referenced by regulations like FISMA for compliance?

• A) ISO 27001

• B) NIST SP 800 series

• C) ISO 9001

• D) NIST Cybersecurity Framework (CSF)

A company relies on multiple vendors for critical technology and software solutions. How should the company approach cybersecurity to effectively manage the associated risks?

• A) Implement cybersecurity measures only within the company's internal systems.

• B) Collaborate closely with vendors to share cybersecurity responsibilities.

• C) Focus on cybersecurity awareness training for internal employees only.

• D) Develop comprehensive cybersecurity policies and procedures for vendor engagements.

A company relies on various vendors, suppliers, and contractors for its operations. What approach should the company prioritize to address cybersecurity concerns arising from its interconnected environment?

• A) Implementing isolated cybersecurity measures for each vendor, supplier, and contractor.

• B) Outsourcing all cybersecurity responsibilities to specialized third-party vendors.

• C) Developing a comprehensive cybersecurity framework that encompasses all vendors, suppliers, and contractors.

• D) Conducting periodic cybersecurity assessments for internal systems only.

An organization is considering migrating its data to a cloud service provider located in a different country. What primary challenge should the organization anticipate regarding data sovereignty?

• A) Ensuring data availability and accessibility in case of cloud service provider downtime.

• B) Managing data encryption and decryption processes to maintain data confidentiality.

• C) Addressing legal and regulatory requirements related to data protection and privacy.

• D) Implementing data backup and recovery strategies to mitigate data loss risks.

An organization is establishing a partnership with a third-party vendor for critical services. What crucial step should the organization prioritize to mitigate risks to operations and data protection in this partnership?

• A) Implementing additional security controls within the organization's internal systems.

• B) Conducting regular cybersecurity training for internal employees.

• C) Carefully assessing the third party's IT, systems, policies, procedures, and cybersecurity program.

• D) Developing incident response plans to address potential security breaches.

A company is finalizing an attestation of compliance (AOC) with a third-party vendor for a service procurement agreement. What aspect should the AOC primarily cover to govern the relationship and ensure data protection?

• A) Incident response plans

• B) Internal employee training policies

• C) Data protection measures

• D) Security controls within the organization's internal systems

A company is reviewing its data protection measures to ensure compliance with relevant regulations and standards. Which of the following data types is specifically associated with information related to patients, doctors, and healthcare systems, including Protected Health Information (PHI) that includes health details and payment information?

• A) Personally Identifiable Information (PII)

• B) Health Data

• C) Financial Information

• D) Intellectual Property (IP)

A company is planning to engage with a new vendor for critical services. What should be the primary consideration for the company to ensure cybersecurity resilience in its vendor relationships?

• A) Prioritize cost-effectiveness in vendor selection to reduce financial burden.

• B) Conduct thorough cybersecurity assessments of potential vendors before engagement.

• C) Focus on building strong relationships with vendors to mitigate cybersecurity risks.

• D) Implement reactive cybersecurity measures to respond to potential vendor-related incidents.