What is an 'adequacy decision' in the context of cross-border data transfers?

A contractual agreement between two companies to share data

A determination by the European Commission that a non-EU country provides an adequate level of data protection

A court ruling that a company has violated data protection laws

A decision by a company to transfer data to any country it chooses

A global e-commerce company wants to align its security program with multiple regulatory frameworks to streamline compliance. Which approach is most effective?

Implement separate security programs for each regulation.

Map common controls across frameworks to a single control baseline, such as NIST SP 800-53.

Focus only on the most stringent regulation and ignore others.

Adopt a single framework, such as ISO 27001, and assume it covers all regulatory requirements.

A company experiences a data breach involving personal data of EU residents. The supervisory authority initiates an investigation and finds that the company did not have appropriate technical and organizational measures in place. What is the most likely consequence under GDPR?

Criminal prosecution of the CEO in every EU member state.

A public apology and a small fine of €10,000.

Automatic suspension of all data processing activities.

Administrative fines up to €20 million or 4% of global annual turnover, whichever is higher.

Which of the following is an example of a compliance monitoring activity?

Conducting periodic internal audits of security controls

Hiring additional sales personnel

Developing a new product marketing strategy

A hospital's compliance officer needs to report HIPAA compliance status to the board of directors. What is the most effective way to present this information?

Verbally assure the board that compliance is fine without documentation.

Distribute the full text of the HIPAA regulations to each board member.

Present a detailed technical log of all security events.

Provide a dashboard showing key compliance metrics, audit findings, and remediation progress.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 3

Regulatory and Legal Compliance CCISO Practice Questions (Page 2)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

9concepts

Questions 6–10

6foundation · easy
What is an 'adequacy decision' in the context of cross-border data transfers?
Select an answer first
7application · medium
A global e-commerce company wants to align its security program with multiple regulatory frameworks to streamline compliance. Which approach is most effective?
Select an answer first
8application · medium
A company experiences a data breach involving personal data of EU residents. The supervisory authority initiates an investigation and finds that the company did not have appropriate technical and organizational measures in place. What is the most likely consequence under GDPR?
Select an answer first
9foundation · easy
Which of the following is an example of a compliance monitoring activity?
Select an answer first
10application · medium
A hospital's compliance officer needs to report HIPAA compliance status to the board of directors. What is the most effective way to present this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.