Administrative Security Controls ECSS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A global company processes personal data of customers in the European Union. The company is considering moving this data to a public cloud provider with a data center in the EU. The legal team is concerned about GDPR compliance. Which action BEST addresses the compliance requirement?

   • ASelect a cloud region located within the EU and ensure the provider offers contractual data protection guarantees
   • BStore all data on-premises in the company's US headquarters
   • CAnonymize all personal data before moving it to the cloud
   • DIgnore GDPR because the company is not based in the EU
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of a security baseline?

   • ATo describe the organization's long-term security goals
   • BTo offer optional best practices that are not required
   • CTo replace the need for security policies
   • DTo provide a minimum set of security configuration requirements for systems
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a disaster recovery plan that specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour for its customer database. The current backup strategy takes a full backup every 24 hours and stores it offsite. The plan has never been tested. Which improvement is MOST critical to meet the stated RPO and RTO?

   • AMove the offsite backup storage to a different cloud provider
   • BImplement more frequent backups (e.g., hourly transaction log backups) and conduct a full DR test
   • CReduce the RTO to 2 hours
   • DIncrease the frequency of full backups to every 12 hours
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is evaluating its exposure to data breaches. The security team has identified that customer data is stored without encryption and that a breach could result in regulatory fines. The team decides to implement encryption and restrict access to the data. Which risk management strategy are they applying?

   • ARisk transfer
   • BRisk avoidance
   • CRisk mitigation
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary goal of a security awareness program?

   • ATo enforce security policies through disciplinary action
   • BTo change employee behavior and reduce human error
   • CTo provide advanced technical training for security professionals
   • DTo replace the need for technical security controls
   Reveal Solution Discussion Select an answer first