Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
M5 - CyberSec & Priv
CYBERSECURITY AND PRIVACY / IT0204
| Question | Answer |
|---|---|
| An e-commerce platform accepts credit cards but fails to encrypt payment details. Which compliance standard is violated? | PCI DSS |
| A retail chain adopts ISO 27001. What is its primary focus? | Information Security Management System (ISMS) requirements |
| A government SOC uses the NIST Cybersecurity Framework to guide risk management. Which NIST function involves continuous monitoring and detection? | Detect |
| A government data center implements ISO 27033. This means its focus is on: | Network security design and management |
| A BPO firm encrypts sensitive client data but lacks an incident response team. This shows partial but not full compliance with ISO 27001. | True |
| Which frameworks are useful for risk management? | COSO | NIST CSF | ISO 27001 |
| A manufacturing company adopts COSO to strengthen enterprise governance. Its emphasis is on: | Internal control and risk management |
| Which NIST CSF function ensures systems are resilient and recover quickly after an incident? | Recover |
| An organization wants a high-level governance and control framework to ensure IT aligns with business goals. Which should it adopt? | COBIT |
| A cloud provider applying ISO 27017 and ISO 27018 is addressing both cloud security and privacy. | True |
| A SOC that monitors continuously but lacks incident response is still fully compliant with NIST CSF. | False |
| Which ISO standard addresses best practices for cloud privacy? | ISO 27018 |
| A local bank is adopting ISO 27701. Which is its main purpose? | Privacy Information Management (PIMS) |
| Which ISO standards are most relevant for cloud security and privacy? | ISO 27017 | ISO 27018 |
| Which of the following best describes COBIT? | Governance and management framework for IT |
| A company that processes credit card payments is required to implement firewall configurations and encryption. This requirement is mandated by: | PCI DSS |
| An e-commerce firm stores sensitive payment card data unencrypted in databases. Which law or standard directly applies? | PCI DSS |
| Which practices demonstrate strong SOC operations? | Continuous monitoring | Incident response services | Threat detection and analysis |
| A company adopts both COSO and COBIT. COSO will focus on governance and risk management, while COBIT will emphasize: | IT governance and control alignment |
| Which laws and standards regulate healthcare data security? | HIPAA | ISO 27701 (when handling privacy) |
| A bank that uses ISO 27001 certification but ignores privacy controls under ISO 27701 is still fully compliant with privacy management standards. | False |
| Which frameworks are best suited for supplier and third-party risk? | ISO 27036 | COBIT |
| Which ISO standard sets out the Information Security Code of Practice? | ISO 27002 |
| A financial services firm develops a “Built Cybersecurity and Privacy Wall” around its SOC. This reflects which element of compliance programs? | End-to-end privacy protection structure |
| A cloud storage provider designs encryption at rest and in transit while ensuring regulatory compliance. Which ISO is most applicable? | ISO 27017 |
| Which ISO framework serves as a privacy framework supporting Data Privacy Law compliance? | ISO 29100 |
| A bank outsources IT services but fails to secure supplier contracts. This violates ISO 27036. | True |
| A retailer documents asset inventories and configuration records. This falls under: | Configuration Inventory Standard |
| PCI DSS requires encryption of cardholder data during transmission over public networks. | True |
| PCI DSS applies only to government agencies. | False |
| Which Japanese law governs data protection and requires business operators to protect personal data? | APPI |
| A logistics firm deploys encryption to protect stored data backups. Which ISO security standard directly applies? | ISO 27040 |
| A BPO firm collects excessive customer data beyond business needs. This violates which compliance principle? | Proportionality (supported in ISO 29100 framework) |
| A cybersecurity manager chooses COSO over COBIT. Which key area is COSO more focused on? | Enterprise risk management and financial reporting |
| HIPAA compliance in the U.S. includes administrative, technical, and physical safeguards. | True |
| A company adopts ISO 29100. This framework primarily provides: | Privacy principles framework |
| A cloud storage provider designs encryption at rest and in transit while ensuring regulatory compliance. Which ISO is most applicable? | ISO 27040 |
| Which actions are violations of PCI DSS? | Storing unencrypted cardholder data | Weak firewall configurations | Ignoring access control rules |
| Which functions are missing if a SOC has monitoring but no recovery planning? | Respond | Recover |
| Which requirements are part of HIPAA safeguards? | Administrative safeguards | Technical safeguards | Physical safeguards |
| Which ISO standard provides controls for managing supplier relationships securely? | ISO 27036 |
| COSO is more focused on IT controls than COBIT. | False |
| A firm that develops a compliance folder, standard tree, and inventory is building an effective compliance program. | True |
| A cloud provider implements ISO 27017 and ISO 27018. What do these specifically address? | Cloud security and cloud privacy |
| A hospital integrates cloud solutions to store patient files but must safeguard both confidentiality and cloud privacy. Which ISO applies? | ISO 27017 and ISO 27018 |
| A BPO handling financial accounts secures its cloud environment against supplier risks. Which ISO pair is most relevant? | ISO 27017 and ISO 27036 |
| A firm adopts ISO 27002. What does this provide? | Security control best practices (Code of Practice) |
| Which ISO provides guidelines on network security architecture, design, and operations? | ISO 27033 |
| Which are considered evolving compliance structures and programs? | Data Privacy Wall | End-to-End Security Portfolio | Global Cybersecurity Knowledge Ecosystem |
| A retailer implements PCI DSS but fails to update firewalls regularly. This is still acceptable under the PCI DSS framework. | False |
| A hospital following HIPAA but ignoring local RA 10173 (Data Privacy Act) requirements is fully compliant in the Philippines. | False |
| Which are privacy-focused standards? | ISO 29100 | ISO 27701 | ISO 27018 |
| A multinational has weak policies for employee awareness and training. Which compliance element is missing? | Effective compliance program requirements |
| A hospital's SOC integrates privacy and security operations for continuity. Which compliance implementation layer is this? | Information Security Layer of Data Privacy Protection |
| COBIT and COSO complement each other by addressing IT governance and enterprise governance. | True |
| ISO 27003 provides guidance for implementing ISMS. | True |
| Which compliance framework provides enterprise risk and financial reporting guidance? | COSO |
| A hospital handling both Philippine and U.S. patients ensures its systems comply with both RA 10173 and HIPAA. What is this practice called? | Cross-jurisdictional compliance |
| A government financial agency develops both IT controls and financial governance policies. Which frameworks together best support this? | COBIT and COSO |
| A SOC requires robust incident response team services. Which compliance strategy supports this? | Incident Response Team Services in compliance programs |
| A telecom SOC integrates continuous monitoring and threat hunting. Which NIST function aligns? | Detect |
| A firm wants to ensure consistent global supplier security practices. Which ISO provides relevant guidelines? | ISO 27036 |
| Which ISO standards apply to storage and network security? | ISO 27033 | ISO 27040 |
| A multinational uses the NIST CSF to improve response capabilities. Which function includes developing communication plans for incidents? | Respond |
| A BPO firm secures cloud-hosted HR systems. Which standards guide both cloud security and cloud privacy? | ISO 27017 | ISO 27018 |
| A firm collects credit card data but deletes transaction logs prematurely. Which framework ensures correct storage requirements? | PCI DSS |
| A financial services company must secure customer credit card transactions. Which compliance framework applies? | PCI DSS |
| Which ISO standards are most relevant for cloud security and privacy? | ISO 27017 | ISO 27018 |
Created by:
Jsean-Ed