An e-commerce company operating in the European Union collects customer data for order processing. They also share some data with a payment processor in the United States. What must the company ensure to comply with GDPR requirements for international data transfers?

The payment processor must be certified under the EU-US Privacy Shield

All customer data must be stored only on servers located within the EU

The company must obtain explicit consent from every customer for the transfer

The transfer must have an appropriate legal mechanism, such as Standard Contractual Clauses (SCCs) or an adequacy decision

Which access control model assigns permissions based on the roles that users have within an organization?

Role-Based Access Control (RBAC)

Discretionary Access Control (DAC)

Attribute-Based Access Control (ABAC)

A security analyst needs to verify that a configuration file has not been tampered with since it was last approved. The analyst has the original hash value of the file. What should the analyst do?

Compare the file size to the original file size.

Compute the current hash of the file and compare it to the original hash.

Check the file's last modified date and time.

Open the file and visually inspect its contents.

What is the primary purpose of encrypting data at rest?

To speed up data retrieval from storage systems

To allow data to be processed without decryption

To ensure data is not altered during transmission over a network

To protect data stored on physical or logical media from unauthorized access

An organization processes credit card payments. To comply with PCI DSS, the organization must protect cardholder data. Which approach provides the strongest protection for data while it is being processed in memory?

Use tokenization to replace card numbers with tokens that have no value outside the payment system.

Use TLS to encrypt the data while it is in memory.

Use format-preserving encryption so that the data remains in the same format in memory.

Use a checksum to verify the data's integrity while it is in memory.

EC-CouncilCertified Security Specialist

Domain 1Objective 7

Data Security ECSS Practice Questions (Page 4)

Part of the Network Defense Fundamentals and Controls domain, which makes up ~21% of our current practice bank.

53questions here

11free pages

10concepts

Questions 16–20

16application · medium
An e-commerce company operating in the European Union collects customer data for order processing. They also share some data with a payment processor in the United States. What must the company ensure to comply with GDPR requirements for international data transfers?
Select an answer first
17foundation · easy
Which access control model assigns permissions based on the roles that users have within an organization?
Select an answer first
18application · medium
A security analyst needs to verify that a configuration file has not been tampered with since it was last approved. The analyst has the original hash value of the file. What should the analyst do?
Select an answer first
19foundation · easy
What is the primary purpose of encrypting data at rest?
Select an answer first
20application · medium
An organization processes credit card payments. To comply with PCI DSS, the organization must protect cardholder data. Which approach provides the strongest protection for data while it is being processed in memory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.