FINAL FINAL

In which year was the original Federal Information Security Management Act (FISMA) passed?

1999

2002

2014

2023

The HITRUST CSF addresses which of the following domains?

Physical and Environmental Security

Incident Management

All of the above

Which of the following is NOT a benefit of FISMA?

Increased information security

Improved private-sector cybersecurity policies

Reduced cybersecurity training requirements

Enhanced threat monitoring

True or False: One challenge of FISMA is that security controls can be confusing and easy to misinterpret.

TRUE

FALSE

Which of the following is a best practice for FISMA compliance?

Ignoring outdated NIST guidelines

Keeping detailed records of compliance activities

Conducting security audits every five years

Disabling encryption for faster data access

What consequence can private contractors face if they fail to comply with FISMA?

They must submit weekly compliance reports

They may lose federal funding and future contracts

They are required to implement all NIST controls

They must undergo mandatory cybersecurity training

The 2023 proposed FISMA update includes a requirement for federal agencies to:

Reduce the number of cybersecurity audits

Report all cybersecurity incidents

Eliminate baseline security controls

Share cybersecurity information with the private sector

Why must High-Value Asset (HVA) systems receive the highest level of security?

They contain mission-critical or highly sensitive information

They are used by top government officials

They process large amounts of financial transactions

They require the most processing power

True or False: Agencies must receive an Authorization to Operate (ATO) before deploying an information system under FISMA.

TRUE

FALSE

What impact level describes a situation where a security breach could result in serious harm but does not involve loss of life?

Low

Moderate

High

Critical

What document is used to keep track of an agency’s security controls under FISMA?

Security Operations Report

System Security and Privacy Plan (SSPP)

Cyber Risk Log

Incident Response Framework

Where can agencies find the baseline security controls required for FISMA compliance?

NIST SP 800-53

ISO 27001

HIPAA Guidelines

The Federal Register

Why is continuous monitoring an essential part of FISMA compliance?

It allows agencies to quickly identify and respond to security threats

It reduces the need for annual audits

It eliminates the risk of cyberattacks

It replaces system risk categorization

True or False: Under FISMA, federal agencies must conduct security reviews every five years.

TRUE

FALSE

What was the main reason for the 2014 amendment of FISMA?

To increase penalties for non-compliance

To address the rising number of cyberattacks on the federal government

To require agencies to hire cybersecurity professionals

To eliminate annual security reviews

What does the Federal Information Security Modernization Act (FISMA) primarily focus on?

Developing new encryption technologies

Protecting government information and operations

Enhancing public access to federal records

Regulating private-sector cybersecurity

What are some challenges companies face with SOX compliance?

High compliance costs

Increased audits

Reduced penalties for noncompliance

Establishing new internal controls

Which of the following are examples of SOX internal controls?

Segregation of duties

Automated backups

Publishing quarterly marketing reports

Identity and access management (IAM) solutions

What are some benefits of SOX compliance?

Increased investor confidence

Reduced financial fraud

Improved cybersecurity posture

Decreased audit costs

Which of the following are key requirements for SOX compliance?

Filing accurate financial reports

Implementing internal controls

Publishing marketing strategies

Passing regular audits

What is the penalty for executives who willfully certify false financial reports under SOX?

$1 million fine and 10 years imprisonment

$5 million fine and 20 years imprisonment

$2 million fine and 15 years imprisonment

$10 million fine and 25 years imprisonment

What is the primary purpose of SOX Section 404?

To protect whistleblowers

To assess and report on the effectiveness of internal controls

To impose penalties for altering financial documents

To ensure cybersecurity compliance

Which section of SOX requires CEOs and CFOs to certify the accuracy of financial reports?

Section 302

Section 404

Section 806

Section 906

SOX compliance requires companies to report cybersecurity incidents within four days if they have a material impact.

TRUE

FALSE

The Sarbanes-Oxley Act was enacted in response to corporate scandals such as Enron and WorldCom.

TRUE

FALSE

SOX compliance is only applicable to publicly traded companies in the United States.

TRUE

FALSE

Who is responsible for certifying the accuracy of financial reports under SOX?

The Board of Directors

The CEO and CFO

The IT Department

External Auditors

What was one of the main reasons for the enactment of the Sarbanes-Oxley Act?

To regulate international trade

To address corporate fraud and restore trust in financial reporting

To improve employee benefits

To promote environmental sustainability

Which of the following is NOT a requirement for SOX compliance?

Implementing internal controls to protect financial data

Filing regular reports with the SEC

Conducting annual independent audits

Publishing marketing strategies annually

What is SOX compliance?

Adhering to financial reporting and auditing requirements of the Sarbanes-Oxley Act

A set of guidelines for marketing strategies

A law for regulating international trade

A cybersecurity framework for private companies

What can happen if an organization fails to report a data breach?

Nothing, it’s optional

They may face fines and penalties

They will receive a warning

They will be required to delete all data

Which body is responsible for enforcing GDPR?

European Parliament

National Data Protection Authorities

European Commission

United Nations

When is a Data Protection Impact Assessment required?

Only for large organizations

When processing is likely to result in high risk to individuals

It is never required

Only for new technologies

What is the minimum age for consent under GDPR for processing children’s data?

10 years

13 years

16 years

18 years

What principle does GDPR emphasize regarding data collection?

Data should be collected in bulk.

Only necessary data should be collected.

Data should be collected indefinitely.

Data should be collected from third parties only.

What does GDPR say about automated decision-making and profiling?

It is completely banned.

It is allowed without restrictions.

Individuals have the right not to be subject to automated decision-making.

It is only allowed for marketing purposes.

True or False: GDPR allows individuals to transfer their personal data from one service provider to another.

TRUE

FALSE

What is the ‘right to be forgotten’?

The right to access personal data

The right to have personal data deleted

The right to restrict processing

The right to data portability

Which organizations are required to appoint a Data Protection Officer?

Only public authorities

Organizations that process large amounts of sensitive data

All organizations

A and B only

What is the maximum fine for non-compliance with GDPR?

€10 million or 2% of global turnover

€20 million or 4% of global turnover

€5 million

There are no fines

True or False: Organizations must notify authorities of a data breach within 72 hours.

TRUE

FALSE

What is required for valid consent under GDPR?

It must be given freely, specific, informed, and unambiguous.

It can be implied through actions.

It can be obtained through silence.

It must be given in writing only.

True or False: Under GDPR, individuals have the right to access their personal data.

TRUE

FALSE

Which of the following is considered personal data under GDPR?

Name

Email address

IP address

All of the above

Which rule requires covered entities to notify individuals when their unsecured PHI is breached?

Privacy Rule

Security Rule

Breach Notification Rule

Enforcement Rule

True or False: The Security Rule applies only to electronic PHI (ePHI).

True

False

Which HIPAA rule establishes national standards for the protection of PHI?

Security Rule

Privacy Rule

Enforcement Rule

Breach Notification Rule

A wearable device records users’ heart rates and syncs this data with their smartphones without collecting any other personal information. Is this data considered PHI?

Yes, because it is health-related information.

No, because it lacks personally identifiable information.

Yes, because all health data is PHI.

No, because wearable devices are not covered by HIPAA.

Which of the following is NOT an example of PHI?

Medical record numbers

Full-face photographs

Blood sugar readings without personally identifiable information

Social security numbers

True or False: Geolocation data more specific than the state level is considered PHI.

True

False

Which of the following is considered PHI under HIPAA?

A patient's email address

A patient's heart rate reading without any identifiers

Number of steps recorded by a pedometer

Calories burned during a workout

Scenario: A software company develops a mobile app that tracks users’ fitness activities. The app collects users’ names, contact information, and detailed health metrics. Is this company required to comply with HIPAA regulations?

Yes, because it collects health-related information.

No, because it is not a healthcare provider.

Yes, because it collects both personal and health information.

No, because fitness data is not considered protected health information (PHI).

Which of the following is NOT a primary purpose of HIPAA?

Improve portability of health insurance coverage

Ensure the privacy and security of healthcare data

Standardize electronic healthcare transactions

Regulate pharmaceutical drug prices

True or False: HIPAA was enacted in 1996.

True

False

What does HIPAA stand for?

Health Information Privacy and Accountability Act

Health Insurance Portability and Accountability Act

Health Information Protection and Accessibility Act

Health Insurance Privacy and Accessibility Act

Scenario: The organization’s encryption keys are not rotated regularly as per policy. What is the BEST remediation?

Rotate the keys immediately and document the change.

Ignore the issue as no breaches have occurred.

Delay remediation until the next audit.

Reduce the encryption scope to avoid key management challenges.

Scenario: During the audit, a critical control failure is identified in the organization’s change management process. What is the BEST immediate action?

Suspend all system changes until the control is fixed.

Develop a corrective action plan and inform the auditor.

Focus on other areas and address the failure after the audit.

Remove the change management process from the audit scope.

A customer requests assurance that the organization’s critical vendors comply with SOC 2 standards. How should the organization respond?

Provide copies of all vendor contracts.

Share the vendor’s SOC 2 report or equivalent evidence.

Explain that vendor compliance is not the organization’s responsibility.

Avoid disclosing any vendor-related information.

Scenario: An organization relies on a third-party vendor for data storage. During the SOC audit, the vendor’s security policies are found to be outdated. What should the organization do?

Require the vendor to update their policies immediately.

Terminate the contract with the vendor.

Document the issue and implement compensating controls.

Ignore the issue since the vendor is responsible for its controls.

Scenario: An organization undergoes annual SOC 2 audits but struggles to maintain control readiness throughout the year. What is the BEST solution?

Conduct periodic internal audits.

Focus only on the audit period.

Hire a third party to manage controls.

Limit the scope of future audits.

Scenario: After completing a SOC 2 audit, the organization decides to expand its services. What is the BEST way to ensure continued compliance with Trust Services Criteria?

Perform a gap assessment for the new services.

Wait until the next audit to include the new services.

Assume existing controls will cover the new services.

Rely on customer feedback to identify gaps.

Scenario: An auditor requests access to confidential customer data to verify encryption controls. What is the BEST way to handle this request?

Deny the request to protect customer confidentiality.

Provide the data without informing the customers.

Offer anonymized or sample data for verification.

Allow unrestricted access to the data.

Scenario: The auditor identifies a minor gap in the availability criterion but notes it does not impact the overall effectiveness of controls. What should the organization do?

Disregard the finding as it is minor.

Document the gap and develop a remediation plan.

Argue that the finding should not be included in the report.

Request the auditor to omit the finding.

Scenario: An organization’s processing integrity controls fail to detect incomplete transactions during testing. What is the MOST effective remediation?

Implement automated validation checks for transactions.

Perform manual checks for all transactions.

Remove the processing integrity criterion from the scope

Postpone the audit until all issues are resolved.

Scenario: During a SOC 2 audit, the organization realizes its privacy notice is not aligned with its actual data handling practices. What is the BEST action to take?

Revise the privacy notice to reflect current practices.

Ignore the discrepancy since it's unrelated to the audit.

Inform the auditor and continue without changes.

Suspend all data processing until the privacy notice is updated.

Scenario: A customer requests a copy of the SOC 2 report, but the organization has a policy of only sharing SOC 3 reports externally. How should the organization respond?

Share the SOC 2 report anyway.

Explain the policy and offer the SOC 3 report instead.

Refuse to share any reports.

Create a summary version of the SOC 2 report.

Scenario: After completing a SOC 2 audit, the organization receives a qualified opinion due to insufficient data encryption practices. What is the BEST next step?

Inform customers that encryption is unnecessary.

Address the encryption gaps and schedule a follow-up audit.

Appeal the qualified opinion with the AICPA.

Stop providing services until the issue is resolved.

Scenario: An auditor finds that multi-factor authentication (MFA) is not implemented for administrative accounts. What should the organization do?

Dispute the finding and explain that MFA is unnecessary.

Immediately implement MFA and document the change.

Ignore the finding and continue the audit.

Provide evidence of other compensating controls.

Scenario: During a readiness assessment, the service organization realizes it has no formal incident response plan. What should the organization do?

Develop and implement an incident response plan before the SOC audit.

Explain to the auditor that incidents are handled informally.

Skip the readiness assessment and proceed with the audit.

Focus only on other Trust Services Criteria.

Scenario: A service organization is preparing for a SOC 2 audit. The IT team discovers that some documentation for their access control policies is outdated. What is the BEST course of action?

Delay the audit until the documentation is updated.

Notify the auditor and proceed without changes.

Update the documentation and conduct an internal review before the audit.

Focus on other controls that are ready and ignore the outdated documentation.

True or False: Using vendor-supplied defaults for passwords is acceptable under PCI DSS.

TRUE

FALSE

True or False: Level 1 merchants require an annual on-site audit.

TRUE

FALSE

True or False: Network segmentation reduces the scope of PCI DSS compliance.

TRUE

FALSE

True or False: Sampling allows an assessor to bypass specific PCI DSS requirements.

TRUE

FALSE

True or False: PCI DSS only applies to merchants.

TRUE

FALSE

What action should an assessor take if components have different versions?

Test all versions

Ignore the versions

Focus on the oldest version only

Which process ensures that the entire infrastructure is compliant?

Standardization

Sampling

Outsourcing

What is the role of a firewall under PCI DSS?

Protect stored cardholder data

Restrict access to networks

Prevent unauthorized transmission of data

If an organization lacks standardized processes, what happens to the sample size?

It increases

It decreases

It remains unchanged

Why is it important to validate automated controls during sampling?

To reduce compliance costs

To ensure controls effectively manage the population

To speed up the audit process

Which regulations govern financial services cybersecurity compliance?

Gramm-Leach-Bliley Act

HIPAA

SOC2

FFIEC IT

Which of the following are key steps to build a cybersecurity compliance plan?

Compliance team formation

Risk analysis

Marketing campaigns

Security controls implementation

What are the benefits of cybersecurity compliance?

Maintaining company reputation

Deepening customer trust

Improving security posture

Lowering marketing expenses

Which industries require cybersecurity compliance?

Healthcare

Financial services

Retail

Tourism

Which of the following are key elements of cybersecurity compliance?

Regulatory requirements

Access control

Risk management

Marketing strategies

What is the global average cost of a single data breach, according to IBM’s 2023 report?

$2.5 million

$3.8 million

$4.45 million

$5.1 million

What does SOC2 primarily focus on?

Marketing standards

Secure management of client data

Human resource compliance

Software development practices

Which regulation is most relevant to the healthcare sector?

PCI DSS

HIPAA

GDPR

CCPA

Which of the following is a key element of cybersecurity compliance?

Risk Management

Marketing Strategy

Recruitment Policies

Financial Auditing

What is the primary goal of cybersecurity compliance?

Increasing productivity

Protecting digital information and systems

Reducing operational costs

Expanding business opportunities

HITRUST Risk-based Assessment provides a high level of assurance.

True

False

Which of these is a control category under HITRUST CSF?

Marketing Strategies

Software Development

Content Creation

Endpoint Protection

What is a key requirement for cloud providers under TX-RAMP?

Conducting annual HIPAA audits

Obtaining TX-RAMP certification before working with Texas agencies

Encrypting all data at rest and in transit

Adopting GDPR-compliant policies

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question

21. Question

22. Question

23. Question

24. Question

25. Question

26. Question

27. Question

28. Question

29. Question

30. Question

31. Question

32. Question

33. Question

34. Question

35. Question

36. Question

37. Question

38. Question

39. Question

40. Question

41. Question

42. Question

43. Question

44. Question

45. Question

46. Question

47. Question

48. Question

49. Question

50. Question

51. Question

52. Question

53. Question

54. Question

55. Question

56. Question

57. Question

58. Question

59. Question

60. Question

61. Question

62. Question

63. Question

64. Question

65. Question

66. Question

67. Question

68. Question

69. Question

70. Question

71. Question

72. Question

73. Question

74. Question