Regulatory and Legal Compliance CCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A software company based in Canada provides services to customers in the EU and stores personal data in Canadian data centers. The company is not established in the EU. Under GDPR, when does the company have to comply with GDPR?

   • AOnly when it has a physical office in the EU.
   • BWhen it offers goods or services to individuals in the EU, even if payment is not required.
   • CNever, because the company is based in Canada.
   • DOnly when it processes data on behalf of an EU-based company.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A healthcare organization in the United States handles protected health information (PHI) and is subject to HIPAA. It also processes credit card payments and is subject to PCI DSS. The CISO must prioritize compliance efforts with limited budget. Which approach best balances regulatory requirements and risk?

   • AFocus exclusively on HIPAA because it carries higher fines than PCI DSS.
   • BImplement all PCI DSS controls first because they are more prescriptive and easier to measure.
   • COutsource all PHI processing to a business associate to transfer HIPAA compliance responsibility.
   • DConduct a combined risk assessment that identifies overlapping controls and prioritizes gaps that affect both HIPAA and PCI DSS.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company has a compliance program that is well-documented, but employees frequently violate data protection policies. The CISO needs to improve compliance. What is the most effective action?

   • AAutomate all compliance controls to remove human error.
   • BIncrease the severity of penalties for policy violations.
   • CConduct more frequent audits to catch violations.
   • DImplement a culture of compliance through training, communication, and leadership example.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company in the EU transfers personal data to a US-based service provider. The provider is certified under the EU-US Data Privacy Framework. What does this certification provide?

   • AAn exemption from all GDPR requirements for the transferred data.
   • BA legal basis for the transfer, as the framework provides an adequacy decision for participating companies.
   • CA guarantee that the data will not be accessed by US authorities.
   • DA requirement to sign additional contracts with the US provider.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A retail company is subject to both PCI DSS and GDPR. During a compliance assessment, the team finds that encryption of cardholder data is required by PCI DSS, but GDPR requires data minimization. How should the company reconcile these requirements?

   • AFocus only on PCI DSS because it is more specific to card data.
   • BEncrypt all data, including non-cardholder personal data, to simplify compliance.
   • CEncrypt cardholder data and limit storage to what is necessary for business purposes.
   • DStop storing cardholder data entirely to comply with GDPR.
   Reveal Solution Discussion Select an answer first