Security Compliance SY0-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team needs to provide compliance evidence to an auditor that its firewall rules are reviewed and approved by the security manager. Which process would best support this requirement?

   • AUsing a firewall that automatically applies rules without human intervention
   • BConducting an annual review of firewall rules and documenting the results
   • CAllowing the network team to make changes and report them at the end of the month
   • DImplementing a change management process that requires manager approval for any firewall rule change
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company fails to comply with a regulation that requires it to delete personal data upon request. The regulator has imposed a fine and ordered the company to implement a process for handling deletion requests. What is the most likely reason the regulator took this action?

   • AThe company violated the data subject's rights, which is a serious compliance failure
   • BThe company's customers complained to the media
   • CThe company did not have enough storage space to delete the data
   • DThe company's IT department was too busy to process the requests
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization wants to monitor compliance with its policy that requires all laptops to have full-disk encryption enabled. Which tool would provide the most direct evidence of compliance?

   • AA network access control (NAC) system that checks for antivirus updates
   • BA security information and event management (SIEM) system that collects firewall logs
   • CAn endpoint management tool that reports the encryption status of each laptop
   • DA physical security system that tracks laptop location
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is privacy a critical consideration in compliance reporting?

   • APrivacy regulations require that all compliance reports be made public
   • BPrivacy considerations are optional if the report is encrypted
   • CReports may contain personal data that must be protected according to privacy regulations
   • DPrivacy considerations are only relevant for external audits, not internal reports
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is subject to both GDPR and a local data protection law that has stricter requirements. The compliance team is preparing a privacy impact assessment (PIA) for a new system that processes personal data. Which approach should they take?

   • AAsk the system vendor to decide which law to follow
   • BFollow only the local law because it is more recent
   • CFollow only GDPR because it is an international standard
   • DApply the stricter requirements of the local law where it exceeds GDPR
   Reveal Solution Discussion Select an answer first