SC-100 Regulatory Compliance Requirements

1. Which regulation applies to healthcare organizations handling patient data?

GDPR

PCI DSS

HIPAA

NIST SP 800-53

2. Which control activity detects security incidents after they have occurred?

Preventive control

Detective control

Corrective control

Compensating control

3. What is the purpose of periodic security awareness training in compliance programs?

To reduce IT department workload

To ensure employees understand compliance obligations

To eliminate the need for technical controls

To replace security policies

4. Which document formally outlines an organization's commitment to information security?

Security policy

Risk assessment report

Audit findings

Incident log

5. A risk with high probability but low impact should be____.

Ignored

Mitigated

Transferred

Accepted

6. What does PCI DSS primarily protect?

Patient health information

Payment card data

Personal data of EU residents

Corporate financial records

7. Which of the following is NOT a typical phase of the risk management lifecycle?

Risk identification

Risk analysis

Risk response

Risk elimination

8. What is the primary responsibility of a Chief Compliance Officer?

Managing IT infrastructure

Ensuring organizational adherence to laws and regulations

Handling customer support

Managing financial budgets

9. Which framework is developed by NIST for cybersecurity risk management?

ISO/IEC 27001

NIST Cybersecurity Framework

CIS Critical Security Controls

COBIT 5

10. What does 'defense in depth' mean in a compliance context?

Using only one security control

Implementing multiple layers of security controls

Focusing only on network security

Eliminating all access controls

11. Which framework provides a comprehensive approach to information security management across an organization?

ISO/IEC 27001

NIST Cybersecurity Framework

CIS Controls

COBIT 5

12. What is the purpose of a Data Protection Impact Assessment (DPIA)?

To reduce data storage costs

To identify and mitigate privacy risks in data processing

To eliminate the need for consent

To bypass regulatory requirements

13. Which standard specifically addresses information security controls for organizations?

ISO 9001

ISO/IEC 27002

ISO 14001

ISO 45001

14. What is the primary goal of a Business Continuity Plan (BCP)?

To reduce operational costs

To ensure critical business functions resume after disruptions

To eliminate all downtime

To replace disaster recovery plans

15. Which control type focuses on preventing security incidents before they occur?

Detective control

Preventive control

Corrective control

Compensating control

16. What does SOX (Sarbanes-Oxley) primarily regulate?

Healthcare data privacy

Financial reporting and corporate governance

Payment card security

Personal data of EU citizens

17. Which of the following is a key component of a compliance program?

Regular policy reviews and updates

Employee training and awareness

Documentation and record-keeping

All of the above

18. In risk management, what does the acronym 'RTO' stand for?

Recovery Time Objective

Regulatory Threshold Operation

Risk Transfer Option

Remediation Task Order

19. Which regulation specifically addresses data protection for EU residents?