Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A multinational company's security team must respond to a data breach involving personal data of EU residents. The breach occurred in a U.S. data center. Under GDPR, what is the company's primary obligation?

   • AMove all EU data to a data center within the EU before notifying authorities.
   • BNotify all affected individuals immediately, regardless of risk level.
   • CWait for the U.S. authorities to determine whether notification is required.
   • DNotify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to individuals.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is considering adopting a security framework to improve its incident response capabilities. The company currently has no formal incident response plan and wants a framework that provides specific, actionable guidance for detecting, responding to, and recovering from incidents. Which framework is most appropriate?

   • ANIST SP 800-61
   • BISO/IEC 27001
   • CPCI DSS
   • DCOBIT
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team discovers that an employee has been using a password-cracking tool against the company's own systems without authorization. The employee claims it was a security test. The company has an acceptable use policy that prohibits unauthorized testing. What is the most appropriate action?

   • AImmediately terminate the employee without investigation.
   • BPraise the employee for proactively testing security.
   • CIgnore the incident because the employee was testing the company's own systems.
   • DTreat the action as a policy violation and follow the disciplinary process, while reviewing whether the employee's intent was benign.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A multinational organization wants to demonstrate to customers that its information security management system (ISMS) meets internationally recognized best practices. The organization is not legally required to follow any specific framework. Which certification should the organization pursue?

   • AGDPR compliance audit
   • BISO/IEC 27001 certification
   • CNIST Cybersecurity Framework (CSF) certification
   • DPCI DSS compliance validation
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small online retailer that accepts credit card payments wants to reduce its compliance burden. The retailer processes fewer than 20,000 transactions per year. Which action is most appropriate to reduce PCI DSS scope?

   • AUse a third-party payment processor that handles cardholder data directly.
   • BStore card numbers in an encrypted database to avoid PCI DSS requirements.
   • CSwitch to a proprietary payment method that is not regulated.
   • DClaim an exemption because of the low transaction volume.
   Reveal Solution Discussion Select an answer first