A cloud service provider fails to implement required security controls and suffers a data breach affecting thousands of customers. The regulator determines the provider was negligent. What is the most likely consequence for the provider?

No consequence if the provider cooperates with the investigation

Only a requirement to issue a public apology

Monetary fines and potential legal action

Automatic revocation of all business licenses

A company is subject to GDPR and CCPA. It has customers in both the EU and California. The legal team is drafting a privacy notice. Which approach satisfies both regulations?

Provide a single notice that only mentions GDPR rights, because GDPR is more comprehensive.

Provide a notice that only lists the company's contact information and does not disclose data practices.

Provide separate notices for EU and California customers, but only if they request them.

Provide a privacy notice that includes the categories of personal data collected, the purposes of processing, and the rights of data subjects under both GDPR and CCPA.

A financial institution is subject to GLBA and must protect customer financial information. The CISO is designing a vendor management program. Which legal obligation must the institution fulfill?

Allow service providers to use customer data for their own marketing purposes if they sign a confidentiality agreement.

Obtain written consent from customers before sharing data with any service provider, even for core processing.

Conduct background checks on all service provider employees, regardless of their role.

Enter into contracts with service providers that require them to safeguard customer information and notify the institution of any breach.

EC-CouncilAssociate C|CISO

Domain 1Objective 3

Regulatory and Legal Compliance ACCISO Practice Questions (Page 1)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 1–5

1application · medium
A cloud service provider fails to implement required security controls and suffers a data breach affecting thousands of customers. The regulator determines the provider was negligent. What is the most likely consequence for the provider?
Select an answer first
2application · medium
A multinational company processes personal data of EU citizens and also has operations in California. The data protection officer is reviewing the legal obligations for handling this data. Which combination of regulations must the organization consider?
Select an answer first
3expert · hard
A company is subject to GDPR and CCPA. It has customers in both the EU and California. The legal team is drafting a privacy notice. Which approach satisfies both regulations?
Select an answer first
4application · medium
A financial institution is subject to GLBA and must protect customer financial information. The CISO is designing a vendor management program. Which legal obligation must the institution fulfill?
Select an answer first
5application · medium
A software company that processes credit card transactions wants to ensure it meets industry security standards. The company does not store cardholder data but transmits it to a payment processor. Which standard is most relevant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Regulatory and Legal Compliance ACCISO Practice Questions (Page 1)

Questions 1–5

A cloud service provider fails to implement required security controls and suffers a data breach affecting thousands of customers. The regulator determines the provider was negligent. What is the most likely consequence for the provider?

A multinational company processes personal data of EU citizens and also has operations in California. The data protection officer is reviewing the legal obligations for handling this data. Which combination of regulations must the organization consider?

A company is subject to GDPR and CCPA. It has customers in both the EU and California. The legal team is drafting a privacy notice. Which approach satisfies both regulations?

A financial institution is subject to GLBA and must protect customer financial information. The CISO is designing a vendor management program. Which legal obligation must the institution fulfill?

A software company that processes credit card transactions wants to ensure it meets industry security standards. The company does not store cardholder data but transmits it to a payment processor. Which standard is most relevant?

Keep studying — Governance, Risk, and Compliance