Security Control Types and Objectives CCISO Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A hospital is required by law to protect patient health information. The security officer must select controls that meet regulatory requirements while also addressing the risks identified in a recent risk assessment. Which approach is most appropriate?

   • AImplementing only the controls mandated by the regulation, as they are legally required
   • BImplementing controls that satisfy both regulatory requirements and the risk assessment, prioritizing based on risk level
   • CImplementing the most expensive controls available to ensure maximum protection
   • DImplementing controls based solely on the risk assessment, ignoring regulatory requirements
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A multinational company must comply with GDPR for EU customer data and also with a local law requiring data to remain within the country. The CISO must select controls for a new data processing system. The risk assessment shows that the biggest threat is insider misuse. Which control strategy best balances regulatory requirements and the identified risk?

   • AImplement strong encryption and rely on the cloud provider's compliance certifications.
   • BUse only on-premises infrastructure with no cloud services to ensure full control over data.
   • CDeploy data loss prevention (DLP) with user behavior analytics (UBA) and restrict access based on least privilege, while hosting data in a local cloud region that meets both GDPR and local residency requirements.
   • DConduct regular audits and require mandatory vacations for all employees with access to EU data.
   Reveal Solution Discussion Select an answer first