1.4 Infer the Industry for Various Compliance Standards Such as PCI, FISMA, FedRAMP, SOC, SOX, PCI, GDPR, Data Privacy, and ISO 27101 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A U.S. company processes personal data of EU citizens as part of its HR operations for a subsidiary in Germany. The company also has a SOC 2 Type II report and follows ISO/IEC 27101 guidelines. The EU data protection authority asks the company to demonstrate compliance with GDPR. Which of the following is the most direct requirement the company must fulfill?

   • ARegister with the U.S. Federal Trade Commission as a data controller
   • BImplement ISO/IEC 27101 controls to achieve GDPR compliance
   • CObtain a SOC 2 Type II report with the privacy trust service criterion
   • DAppoint a Data Protection Officer (DPO) if the core activities require regular and systematic monitoring of data subjects on a large scale
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A global e-commerce company processes payments and stores customer profiles for EU and non-EU customers. The company wants to minimize compliance burden while still meeting GDPR and PCI DSS requirements. Which approach best balances these requirements?

   • AApply GDPR controls to all customer data and PCI DSS controls to all payment data
   • BSegment EU customer data into a separate database with GDPR-specific controls, and apply PCI DSS controls to all payment data
   • CStore all data in the EU to satisfy both GDPR and PCI DSS
   • DApply PCI DSS controls to all customer data
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A cloud service provider wants to offer its services to multiple U.S. federal agencies. The provider wants to avoid undergoing separate security assessments for each agency. Which approach should the provider take?

   • AComply with PCI DSS
   • BImplement ISO/IEC 27101
   • CObtain a SOC 2 Type II report
   • DObtain a FedRAMP authorization
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary focus of ISO/IEC 27101?

   • AGuidelines for auditing management systems
   • BSecurity techniques for storage systems
   • CPrivacy protection in cloud services
   • DGeneral requirements for information security management systems
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A data protection officer is reviewing the company's data handling practices and notices that personal data is retained indefinitely. The company operates in the EU. Which GDPR principle is most directly violated by this practice?

   • AAccountability
   • BIntegrity and confidentiality
   • CStorage limitation
   • DData minimization
   Reveal Solution Discussion Select an answer first