Compliance Frameworks (CySA+): NIST, ISO 27001 & PCI DSS Quiz

1. NIST RMF consists of how many main steps?

4 steps

5 steps

6 steps

7 steps

2. ISO 27001 requires organizations to establish a process for managing which of the following?

Information security incidents

Access control

Cryptography

All of the above

3. What is the minimum required validation frequency for PCI DSS Requirement 11.2 (vulnerability scanning)?

Annually

Semi-annually

Quarterly

Monthly

4. NIST SP 800-171 is specifically designed for protecting what type of information?

Personal health information

Controlled unclassified information (CUI)

Financial records

Trade secrets

5. ISO 27001 requires regular review and approval of the Information Security Policy by which level of management?

IT Manager

Security Team

Top Management

Compliance Officer

6. Which compliance framework is most commonly required for organizations processing credit card payments?

HIPAA

GDPR

PCI DSS

SOX

7. PCI DSS requires organizations to maintain cardholder data in a secure environment called the ____.

Secure Data Vault

Cardholder Data Environment (CDE)

Protected Payment Zone

Compliance Perimeter

8. In NIST terminology, what does the 'Govern' function address?

Managing cybersecurity risk

Establishing organizational context and governance

Responding to incidents

Detecting anomalies

9. ISO 27001 Annex A contains how many control objectives?

8 objectives

11 objectives

14 objectives

18 objectives

10. Which PCI DSS requirement mandates the use of strong cryptography for cardholder data transmission?

Requirement 2

Requirement 4

Requirement 7

Requirement 10

11. Which NIST framework focuses on identifying, protecting, detecting, responding to, and recovering from cybersecurity events?

NIST Cybersecurity Framework (CSF)

NIST Risk Management Framework (RMF)

NIST Special Publication 800-53

NIST Privacy Framework

12. What is the primary purpose of a Risk Assessment Matrix in compliance frameworks?

To eliminate all risks

To prioritize risks by likelihood and impact

To document security incidents

To assign compliance budgets

13. ISO 27001 certification requires organizations to demonstrate compliance through which type of audit?

Internal audit only

Third-party external audit

Government audit

Peer review audit

14. PCI DSS Requirement 6 focuses on developing and maintaining secure systems. What is the primary goal?

Implement firewalls

Develop and maintain secure software

Conduct regular penetration testing

Maintain an inventory of assets

15. Which of the following is NOT one of the five core functions of the NIST Cybersecurity Framework?

Identify

Predict

Detect

Respond

16. NIST SP 800-53 provides security and privacy controls organized into how many control families?

14 families

18 families

22 families

26 families

17. ISO 27001 requires organizations to conduct risk assessments at what minimum frequency?

Annually

Quarterly

Semi-annually

Continuously or at planned intervals

18. Which PCI DSS requirement specifically addresses the protection of cardholder data?

Requirement 1

Requirement 3

Requirement 5

Requirement 8

19. What is the maximum number of days an organization has to notify affected individuals after a data breach under most compliance frameworks?

15 days

30 days

60 days

90 days

20. ISO 27001 is primarily designed to establish requirements for which type of system?

Information security management system (ISMS)

Business continuity management system

Quality management system

Environmental management system

Compliance Quiz: Can You Master NIST, ISO 27001 & PCI DSS?