Regulatory and Legal Compliance CCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A global company transfers personal data from its EU headquarters to a subsidiary in a country that does not have an adequacy decision from the EU. The company is considering using Binding Corporate Rules (BCRs) or Standard Contractual Clauses (SCCs). Which factor is most important in deciding between the two?

   • AThe speed of implementation, as SCCs can be adopted more quickly than BCRs.
   • BThe need for a single, comprehensive data protection policy across the entire corporate group.
   • CThe cost of implementation, as BCRs are more expensive than SCCs.
   • DThe preference of the data protection authority in the destination country.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A bank is subject to GLBA and must protect customer financial information. Which of the following is a key requirement under the GLBA Safeguards Rule?

   • AReport all security incidents to the FTC within 24 hours.
   • BDevelop, implement, and maintain a comprehensive written information security program.
   • CObtain annual ISO 27001 certification.
   • DEncrypt all customer data at rest and in transit.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A multinational company headquartered in the EU processes customer data in its US subsidiary. The company is considering a new data processing agreement with a US-based cloud provider. Under the GDPR, what is the most appropriate first step to ensure lawful cross-border data transfer?

   • AConduct a transfer impact assessment and implement appropriate safeguards such as Standard Contractual Clauses.
   • BStore all data in the EU and avoid any transfer to the US.
   • CObtain consent from each data subject for the transfer.
   • DRely on the provider's self-certification under the EU-US Data Privacy Framework without further review.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which legal obligation under the Health Insurance Portability and Accountability Act (HIPAA) applies to covered entities and business associates?

   • AReporting all data breaches to the public within 24 hours
   • BObtaining written consent from patients before any use of their health information
   • CConducting annual penetration tests on all systems that store PHI
   • DEnsuring the confidentiality, integrity, and availability of protected health information (PHI)
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which regulatory framework is primarily focused on the protection of personal data of individuals within the European Union?

   • AHIPAA
   • BGDPR
   • CSOX
   • DGLBA
   Reveal Solution Discussion Select an answer first