Regulatory and Legal Compliance CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company operates in both the healthcare and financial sectors. It must comply with HIPAA and GLBA. The compliance team is designing a unified control framework. What is the most significant challenge?

   • AHIPAA requires physical security controls, while GLBA does not.
   • BHIPAA requires encryption of all data, while GLBA prohibits encryption.
   • CGLBA applies only to federal agencies, while HIPAA applies to private companies.
   • DThe two regulations have different scopes and requirements, making a single control set difficult to map.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company collects personal data from customers in multiple countries. The CISO needs to ensure that the company's data processing activities are lawful. What is the first step?

   • AHire a data protection officer (DPO) immediately.
   • BImplement encryption for all personal data at rest and in transit.
   • CObtain consent from all customers for all processing activities.
   • DConduct a data inventory and mapping exercise to identify what data is collected, where it is stored, and how it is processed.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is planning to enter a new market in a country with strict data localization laws. The company's current infrastructure is centralized in another region. What is the most important factor to consider when developing the compliance program?

   • AThe cost of building local infrastructure versus the risk of non-compliance penalties.
   • BThe need to maintain a single global data policy.
   • CThe preference of the company's IT department for centralized infrastructure.
   • DThe potential for reputational damage if the company does not enter the market.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company that transfers personal data from the EU to a country without an adequacy decision fails to implement appropriate safeguards. What is a potential consequence under GDPR?

   • AThe company will be required to delete all data transferred.
   • BThe company will automatically be fined 4% of annual turnover.
   • CThe supervisory authority may suspend the data transfer.
   • DThe company's EU operations will be shut down.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A hospital is subject to HIPAA and also processes payment card transactions. The CISO needs to ensure compliance with both. What is the most efficient approach?

   • AFocus on HIPAA because it is a federal law with higher penalties.
   • BMap HIPAA and PCI DSS controls to a common control framework to identify overlaps and gaps.
   • CImplement separate compliance programs for HIPAA and PCI DSS.
   • DUse a single compliance software tool that claims to cover both regulations.
   Reveal Solution Discussion Select an answer first