A global company processes personal data of EU citizens and US residents. The company is implementing a new CRM system that will store this data. The DPO is concerned about GDPR compliance and data transfers. Which approach best addresses the GDPR requirement for international data transfers?

Use standard contractual clauses (SCCs) for transfers to non-EU countries

Obtain consent from every data subject for each transfer

Store all data in the EU to avoid transfers

Anonymize all personal data before storing it

A financial institution is required by regulators to implement strong authentication for customer accounts. The security team proposes a solution that would require all customers to use biometric authentication, but this would exclude some customers who cannot use biometrics. The institution has a risk appetite that prioritizes customer accessibility. Which risk treatment approach best balances regulatory compliance and accessibility?

Offer biometrics as an option but allow alternative methods such as one-time passcodes

Implement biometrics for all customers and accept the accessibility risk

Avoid the requirement by not offering online accounts

Transfer the risk by outsourcing authentication to a third party

A company's disaster recovery plan specifies an RTO of 2 hours and an RPO of 15 minutes for its customer database. The database is replicated synchronously to a secondary site, but the secondary site is in the same city. A recent regional power outage affected both sites. What is the most significant gap in the DR plan?

The RPO is too aggressive for the replication method

The secondary site is not geographically diverse

The RTO is unrealistic for the database size

The DR plan does not include a backup of the database

EC-CouncilCertified Ethical Hacker

Domain 1Objective 7

Information Assurance and Risk Management CEH Practice Questions (Page 2)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 6–10

6expert · hard
A global company processes personal data of EU citizens and US residents. The company is implementing a new CRM system that will store this data. The DPO is concerned about GDPR compliance and data transfers. Which approach best addresses the GDPR requirement for international data transfers?
Select an answer first
7expert · hard
A financial institution is required by regulators to implement strong authentication for customer accounts. The security team proposes a solution that would require all customers to use biometric authentication, but this would exclude some customers who cannot use biometrics. The institution has a risk appetite that prioritizes customer accessibility. Which risk treatment approach best balances regulatory compliance and accessibility?
Select an answer first
8foundation · easy
Which term refers to the maximum amount of time that a business process can be down before it causes unacceptable damage?
Select an answer first
9foundation · easy
An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk treatment option does this represent?
Select an answer first
10expert · hard
A company's disaster recovery plan specifies an RTO of 2 hours and an RPO of 15 minutes for its customer database. The database is replicated synchronously to a secondary site, but the secondary site is in the same city. A recent regional power outage affected both sites. What is the most significant gap in the DR plan?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Information Assurance and Risk Management CEH Practice Questions (Page 2)

Questions 6–10

A global company processes personal data of EU citizens and US residents. The company is implementing a new CRM system that will store this data. The DPO is concerned about GDPR compliance and data transfers. Which approach best addresses the GDPR requirement for international data transfers?

Which term refers to the maximum amount of time that a business process can be down before it causes unacceptable damage?

An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk treatment option does this represent?

Keep studying — Information Security and Ethical Hacking Overview