Cybersecurity Resilience Quiz

An organization has established data classification levels and data retention policies. What is a potential consequence of inadequate data retention practices?

• A) Increased complexity in data management

• B) Enhanced data protection measures

• C) Improved compliance with data protection regulations

• D) Devastating impacts such as data loss and litigation issues

An organization is planning to export software with encryption capabilities to multiple countries and wants to ensure compliance with international export controls. Which resource can the organization refer to for understanding the legal stance on encryption in different countries?

• A) North Atlantic Treaty Organization (NATO) website

• B) United Nations Security Council (UNSC) database

• C) Global Encryption Report

• D) Organization for Economic Cooperation and Development (OECD) guidelines

An organization is undergoing a Capability Maturity Model Integration (CMMI) assessment to evaluate its operational or software capabilities. Which maturity level is characterized by the majority of work being well-defined via processes, with proactive measures in place?

• A) Level 1: Initial

• B) Level 2: Managed

• C) Level 3: Defined

• D) Level 4: Quantitatively Managed

An organization has classified its data into three levels: Public, Sensitive, and Confidential. Which of the following statements accurately describes the Confidential data classification level?

• A) Disclosure would not cause a negative impact to the organization.

• B) Disclosure would cause harm to the organization. Data in this classification requires special consideration and well-crafted protections.

• C) Disclosure would cause considerable harm to the organization. Data in this classification requires extensive analysis and stringent protections.

• D) The data in this classification level is not defined within the organization's data classification framework.

A federal agency has completed the certification phase of the certification and accreditation (C&A) process for its information systems. What is the primary objective of the accreditation phase?

• A) Implementing continuous monitoring mechanisms

• B) Verifying compliance with federal standards

• C) Assessing the effectiveness of security controls

• D) Granting official authorization for system operation

An organization aims to achieve the highest level of maturity in its operational or software capabilities as defined by the Capability Maturity Model Integration (CMMI). Which maturity level is characterized by work being proactive, measured, analyzed, and continuously improved?

• A) Level 1: Initial

• B) Level 2: Managed

• C) Level 3: Defined

• D) Level 5: Optimizing

A company is finalizing an attestation of compliance (AOC) with a third-party vendor for a service procurement agreement. What aspect should the AOC primarily cover to govern the relationship and ensure data protection?

• A) Incident response plans

• B) Internal employee training policies

• C) Data protection measures

• D) Security controls within the organization's internal systems

A company relies on multiple vendors for critical technology and software solutions. How should the company approach cybersecurity to effectively manage the associated risks?

• A) Implement cybersecurity measures only within the company's internal systems.

• B) Collaborate closely with vendors to share cybersecurity responsibilities.

• C) Focus on cybersecurity awareness training for internal employees only.

• D) Develop comprehensive cybersecurity policies and procedures for vendor engagements.

Two organizations are planning to share data via an interface for critical operational functions. Which legally enforceable document should they establish to describe and define the operating parameters, roles, requirements, and expectations of this data sharing?

• A) Memorandum of Understanding (MOU)

• B) Interconnection Security Agreement (ISA)

• C) Service Level Agreement (SLA)

• D) Operational-Level Agreement (OLA)

An organization operates an online platform targeting children under the age of 13 and collects personal information from users. Which regulation specifically safeguards children's online privacy under age 13?

• A) General Data Protection Regulation (GDPR)

• B) Payment Card Industry Data Security Standard (PCI DSS)

• C) Capability Maturity Model Integration (CMMI)

• D) Children's Online Privacy Protection Act (COPPA)