Under GDPR, organizations must report data breaches to the relevant supervisory authority within how many hours of becoming aware?
- 24 hours
- 48 hours
- 72 hours
- 96 hours
Under the General Data Protection Regulation (GDPR), organizations must report data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach. This prompt reporting requirement is designed to ensure swift action and notification to protect individuals' privacy.
In the context of access control, the decision to grant or deny a user's request is referred to as _______.
- Authentication
- Authorization
- Validation
- Verification
Authorization is the process of deciding whether a user's request should be granted or denied. It's the step that follows authentication and validation and determines the level of access a user has to resources based on their permissions or privileges.
The process of examining code for security vulnerabilities before it's executed in a live environment is known as?
- Code Review
- Dynamic Testing
- Pre-execution Analysis
- Runtime Analysis
Code review is the process of examining code for security vulnerabilities before it's executed in a live environment. This helps identify and fix security issues in the code.
In TLS, what cryptographic process is used to establish a shared secret between the client and server without ever transmitting the secret itself?
- DES Encryption
- Diffie-Hellman Key Exchange
- MD5 Hash Algorithm
- RSA Key Exchange
In TLS, the Diffie-Hellman Key Exchange is used to establish a shared secret without transmitting the secret itself. This process allows secure key exchange even if eavesdroppers are present.
Which of the following is a globally recognized standard for information security management?
- Commercial Off-the-Shelf Software (COTS)
- Company Trademark Policy
- ISO/IEC 27001
- Internal Company Policy
ISO/IEC 27001 is a globally recognized standard for information security management systems (ISMS). It provides a systematic approach for managing sensitive company information, ensuring its confidentiality, integrity, and availability.
Which method of encryption uses the same key for both encryption and decryption processes?
- Asymmetric Key Encryption
- Public Key Encryption
- Secure Sockets Layer
- Symmetric Key Encryption
Symmetric Key Encryption, also known as Private Key Encryption, uses the same key for both the encryption and decryption processes. It's efficient for fast and secure data transfer, but it requires a secure way to share the key between the sender and receiver.
In cybersecurity, a detailed step-by-step approach on how to respond to and manage a security breach is termed a(n) _______.
- Incident Response Plan
- Penetration Test Plan
- Security Policy
- Vulnerability Assessment
An "Incident Response Plan" outlines the actions to take when a security breach occurs, helping to manage and respond to such incidents.
John, a network administrator, notices a sudden spike in outbound traffic from a single workstation in the organization. Upon further investigation, he discovers that the workstation is contacting multiple external IP addresses. This could be indicative of which type of threat?
- Botnet Infection
- Data Exfiltration
- Insider Threat
- Malware Infection
The sudden spike in outbound traffic from a workstation contacting multiple external IP addresses is a strong indicator of a botnet infection. A botnet is a network of compromised devices controlled by an attacker, often used for various malicious activities, including sending spam or launching DDoS attacks.
Which layer of the OSI model does SSL/TLS primarily operate at?
- Application
- Data Link Layer
- Physical Layer
- Transport Layer
SSL/TLS (Secure Sockets Layer/Transport Layer Security) primarily operates at the Application Layer (Layer 7) of the OSI model. It provides encryption and security for application-level data.
A hospital's electronic record system was breached, exposing patient records. The hospital is based in the United States. Which regulation mandates that the hospital notify affected patients of the breach?
- CCPA
- FERPA
- GDPR
- HIPAA
HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that mandates the protection of health information privacy and security. It requires healthcare organizations to notify affected patients in the event of a data breach involving their protected health information.