Regulatory and Legal Compliance CCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which compliance framework is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS)?

   • APCI DSS
   • BCOBIT
   • CNIST SP 800-53
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A multinational company with headquarters in the EU and subsidiaries in Brazil and Japan needs to transfer employee HR data from the EU to its Brazilian subsidiary for payroll processing. The company currently relies on Standard Contractual Clauses (SCCs) for EU data transfers. A new data protection law in Brazil imposes additional requirements for cross-border transfers. What should the CISO do first?

   • ARely solely on the existing SCCs because they are recognized by the EU and should be accepted by Brazil.
   • BConduct a data protection impact assessment (DPIA) and verify that the SCCs are supplemented with additional safeguards required by Brazilian law.
   • CMove all HR data to a cloud provider with servers located only in the EU to avoid any cross-border transfer.
   • DStop all data transfers to Brazil immediately and route payroll processing through a third-party processor in the EU.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A defense contractor that handles Controlled Unclassified Information (CUI) must comply with NIST SP 800-171. The company is implementing a compliance program. Which of the following is a mandatory requirement under NIST SP 800-171?

   • AObtain ISO 27001 certification for all systems.
   • BImplement the 14 families of security requirements for protecting CUI in nonfederal systems.
   • CUse only FedRAMP-authorized cloud services.
   • DConduct annual penetration tests by an external party.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A government contractor that processes controlled unclassified information (CUI) must comply with NIST SP 800-171. The contractor also handles personal data of EU citizens and is subject to GDPR. Which compliance framework should the contractor use as the primary basis for its information security program?

   • AISO 27001, because it is an international standard that covers both CUI and personal data.
   • BNIST SP 800-171, because it is contractually required for handling CUI.
   • CA custom framework that combines elements of all three to maximize compliance.
   • DGDPR, because it has broader applicability and higher fines.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company suffers a data breach affecting 500,000 EU customers. The supervisory authority fines the company €15 million. The company argues that it had implemented encryption for data at rest. However, the breach occurred because encryption keys were stored on the same server as the data. What is the most likely reason the fine was not reduced?

   • AThe encryption was not an appropriate technical measure because key management was inadequate.
   • BThe fine is mandatory and cannot be reduced.
   • CThe company should have used a different encryption algorithm.
   • DThe company did not notify the authority within 72 hours.
   Reveal Solution Discussion Select an answer first