A company that provides online services to children under 13 must comply with COPPA. What is a key legal requirement under COPPA?

Allow children to delete their accounts at any time

Encrypt all data in transit and at rest

Appoint a Data Protection Officer

Obtain verifiable parental consent before collecting personal information from children

A company has a compliance monitoring program that generates a large number of alerts, many of which are false positives. The compliance team is overwhelmed and may miss real issues. The CISO wants to improve the program. Which approach is most effective?

Automatically close all low-priority alerts without review.

Tune the monitoring tools to reduce false positives and prioritize alerts based on risk, while maintaining a process for human review of high-risk alerts.

Disable all alerts and rely on quarterly audits.

Increase the number of compliance staff to review all alerts manually.

A US-based healthcare provider is expanding its telehealth services to patients in multiple states. The compliance team must identify which regulatory framework imposes mandatory breach notification requirements that vary by state. Which framework should be the primary focus for the notification process?

FERPA, because it protects student health records and telehealth is an educational service.

GLBA, because it applies to all financial institutions and telehealth is a financial service.

State-specific laws only, because HIPAA preempts all state breach notification laws.

HIPAA, because it sets a federal baseline for breach notification that applies to all covered entities and business associates.

A multinational company is subject to GDPR and the local data protection law of a country that requires data to be stored within its borders. The company wants to use a cloud provider. What is the best approach?

Encrypt data before sending it to the cloud provider

Choose a cloud provider with a data center in that country and ensure contractual commitments for data residency

Use a cloud provider in a neighboring country and rely on GDPR adequacy decisions

Use a private cloud hosted in the company's own data center

EC-CouncilAssociate C|CISO

Domain 1Objective 3

Regulatory and Legal Compliance ACCISO Practice Questions (Page 6)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 26–30

26application · medium
A company that provides online services to children under 13 must comply with COPPA. What is a key legal requirement under COPPA?
Select an answer first
27expert · hard
A company has a compliance monitoring program that generates a large number of alerts, many of which are false positives. The compliance team is overwhelmed and may miss real issues. The CISO wants to improve the program. Which approach is most effective?
Select an answer first
28application · medium
A US-based healthcare provider is expanding its telehealth services to patients in multiple states. The compliance team must identify which regulatory framework imposes mandatory breach notification requirements that vary by state. Which framework should be the primary focus for the notification process?
Select an answer first
29expert · hard
A multinational company is subject to GDPR and the local data protection law of a country that requires data to be stored within its borders. The company wants to use a cloud provider. What is the best approach?
Select an answer first
30application · medium
A university in the United States maintains student education records and wants to ensure compliance with federal law. Which regulation is most directly applicable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Regulatory and Legal Compliance ACCISO Practice Questions (Page 6)

Questions 26–30

A company that provides online services to children under 13 must comply with COPPA. What is a key legal requirement under COPPA?

A company has a compliance monitoring program that generates a large number of alerts, many of which are false positives. The compliance team is overwhelmed and may miss real issues. The CISO wants to improve the program. Which approach is most effective?

A multinational company is subject to GDPR and the local data protection law of a country that requires data to be stored within its borders. The company wants to use a cloud provider. What is the best approach?

A university in the United States maintains student education records and wants to ensure compliance with federal law. Which regulation is most directly applicable?

Keep studying — Governance, Risk, and Compliance