Chapter 15 Business Continuity and Disaster Recovery

Question 1

What must a government agency consider when planning to store sensitive2 data with a global CSP?

A. Data sovereignty
B. Data ownership
C. Data classification
D. Data retention

Answer 1

A. Data sovereignty

Question 2

Who is accountable for the storage and protection of customer data? They must ensure that they implement controls to meet legal and regulatory requirements

A. Data controller
B. Data protection officer
C. Data processor
D. Supervisory authority

Answer 2

A. Data controller

Question 3

A CISO is assessing regulatory requirements for hospital employees and patient data (within Europe). What type of information will need to be protected and which regulation will be most important? (Choose two)

A. GDPR
B. Financial records
C. Intellectual property
D. PII
E. COPPA

Answer 3

A. GDPR
D. PII

Question 4

A multinational company wants the assurance that data will not be accessible when their contract with a CSP expires. What technology may be applicable?

A. Cryptoerase
B. Pulping
C. Shredding
D. Degaussing

Answer 4

A. Cryptoerase

Question 5

A global automobile manufacturer must ensure that its products are compatible with its worldwide customer base. What regulations or standards will be most important?

A. Export control regulations
B. General Data Protection Regulation (GDPR)
C. International Organization for Standardization (ISO)
D. National Institute of Standards and Technology (NIST)

Answer 5

C. International Organization for Standardization (ISO)

Question 6

A SaaS provider has several products designed to attract a young audience, while revenue is generated by advertising and subscriptions within the US. What regulations will be the most important for the provider?

A. Capability Maturity Model Integration (CMMI)
B. National Institute of Standards and Technology (NIST)
C. Children’s Online Privacy Protection Act (COPPA)
D. Cloud Security Alliance (CSA) Trust Assurance and Risk (STAR)

Answer 6

C. Children’s Online Privacy Protection Act (COPPA)

Question 7

A SaaS provider has several commercial products to assist with an automobile manufacturer. They must assure potential customers that the cloud provider is secure and trustworthy.. What accreditation can the SaaS provider attain to appeal to its customers?

A. Internation Organization for Standardization (ISO)
B. Capability Maturity Model Integration (CMMI)
C. National Institute of Standards and Technology (NIST)
D. Cloud Security Alliance (CSA) Trust Assurance and Risk (STAR)

Answer 7

D. Cloud Security Alliance (CSA) Trust Assurance and Risk (STAR)

Question 8

A software develpment company is trying to win a contract for a US Federal Government agency. They must assure the customer that they have a robust security framework for the delivery of software and services. What is the most relevant?
A. Internation Organization for Standardization (ISO)
B. Capability Maturity Model Integration (CMMI)
C. National Institute of Standards and Technology (NIST)
D. Cloud Security Alliance (CSA) Trust Assurance and Risk (STAR)

Answer 8

B. Capability Maturity Model Integration (CMMI)

Question 9

What compliance will be most important to a US based e-commerce retailer with respect to the storage of cardholder data and electronic transactions?

A. Payment Cared Industry Data Security Standard (PCI DSS)
B. International Organization for Standardization (ISO)
C. Interconnection Security Agreement (ISA)
D. Non Disclosure Agreement (NDA)

Answer 9

A. Payment Cared Industry Data Security Standard (PCI DSS)

Question 10

A smartcard manufacturer needs to sell products to a global market. They need to show compliance using internationally agreed upon protocols. What would be a useful accreditation or assurance that their products have been evaluated and will meet the security requirements of their customers?

A. International Organization for Standardization (ISO)
B. Capability Maturity Model Integration (CMMI)
C. National Institute of Standards and Technology (NIST)
D. Common Criteria (CC)

Answer 10

D. Common Criteria (CC)

Question 11

What regulatory body is intended to protect the personal data of EU citizens?

A. General Data Protection Regulation (GDPR)
B. National Institute of Standards and Technology (NIST)
C. International Organization for Standardization (ISO)
D. Common Criteria (CC)

Answer 11

A. General Data Protection Regulation (GDPR)

Question 12

A US smartcard manufacturer needs to sell its products in a global market. They need to ensure the technology is not sold to countries or governments hostile to the US. What guidance or regulations should they consult?

A. Due care
B. Export Controls
C. Legal Holds
D. E Discovery

Answer 12

B. Export Controls

Question 13

A government department has privacy requirements, and they need to have employees and service providers sign this agreement. They should be made aware of the strict terms of this agreement and the penalties that may be forthcoming. What type of agreement will be important?

A. Service Level Agreement (SLA)
B. Master Service Agreement (MSA)
C. Non disclosure agreement (NDA)
D. Operational Level Agreement (OLA)

Answer 13

C. Non disclosure agreement (NDA)

Question 14

A large multinational company intends to purchase multiple products on a rolling contract from a CSP. They need to document payment terms, dispute resolution, intellectual property ownership, and geographic operational locations within the scope of the contract. What type of contract would be most suitable?

A. Service Level Agreement (SLA)
B. Master Service Agreement (MSA)
C. Memorandum of Understanding (MOU)
D. Operational Level Agreement (OLA)

Answer 14

B. Master Service Agreement (MSA)

Question 15

A company would like to build resiliency into its network connections. They are working with an ISP that proposes a highly available MPLS solution. TO ensure the vendor is able to deliver the service with 99.999% uptime, what documentation will be important?

A. Service Level Agreement (SLA)
B. Memorandum of Understanding (MOU)
C. Interconnection security agreement (ISA)
D. Operational Level Agreement (OLA)

Answer 15

A. Service Level Agreement (SLA)

Question 16

What agreement should be used when business partners need to share data? This agreement may stipulate a timeline for the information exchange to be supported, security requirements, data types that will be exchanged, and the actual sites that will be part of the data interchange?

A. A. Service Level Agreement (SLA)
B. Master Service Agreement (MSA)
C. Memorandum of Understanding (MOU)
D. Interconnection security agreement (ISA)

Answer 16

D. Interconnection security agreement (ISA)

Question 17

What agreement ensures that the customer data will be protected by the service provider andf that agreed upon steps are in place if data breaches or any adverse action were to occur?

A. Non disclosure agreement (NDA)
B. Memorandum of understanding (MOU)
C. Interconnection security agreement (ISA)
D. Operational level agreement (OLA)
E. Privacy level agreement (PLA)

Answer 17

E. Privacy level agreement (PLA)

Question 18

An investigation is to be performed on an employee suspected of stealing company Intellectual Property (IP). What must be done first to ensure that the data is not deleted?

A. Due care
B. Export controls
C. Legal holds
D. E Discovery

Answer 18

C. Legal holds

Question 19

An investigation is to be performed on an employee suspected of stealing company intellectual property (IP). There are over 10 gigabytes stored across several information systems. What must be done to ensure that the relevant data is collected?

A. Due care
B. Export controls
C. Legal holds
D. E Discovery

Answer 19

D. E Discovery

Question 20

What document may be sued when business partners need to document responsibilities? This document will not be written by lawyers and is intended to formalize a verbal agreement or a handshake

A. Service level agreement
B. Master service agreement (MSA)
C. Memorandum of understanding (MOU)
D. Interconnection security agreement (ISA)

Answer 20

C. Memorandum of understanding (MOU)