Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A manufacturing company wants to implement an information security management system to systematically protect its assets and demonstrate due diligence to customers. The company has no existing security framework and wants a certifiable, internationally recognized standard. Which approach best fits this requirement?

   • AAdopt the NIST Cybersecurity Framework and self-attest compliance
   • BFollow PCI DSS controls for all company data
   • CCreate a custom security policy based on industry best practices
   • DImplement ISO/IEC 27001 and undergo an external certification audit
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security researcher discovers a vulnerability in a popular software product and wants to disclose it responsibly. The researcher is concerned about legal liability under the U.S. Computer Fraud and Abuse Act (CFAA). Which action is most aligned with ethical and legal best practices?

   • AExploit the vulnerability on a production system to demonstrate impact.
   • BReport the vulnerability to the vendor through a coordinated disclosure program.
   • CPublish the vulnerability details on a public forum immediately to warn users.
   • DSell the vulnerability to a third party without notifying the vendor.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization is implementing ISO/IEC 27001 and must decide how to handle risk assessment. The organization has limited resources and wants to focus on the most critical risks. Which approach is most aligned with ISO/IEC 27001?

   • AAdopt all controls from Annex A to ensure full compliance.
   • BConduct a risk assessment that identifies, analyzes, and evaluates risks using a defined methodology.
   • CFocus only on technical vulnerabilities and ignore business impacts.
   • DUse a checklist of common controls without a formal risk assessment.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst at a financial institution discovers that a colleague has been accessing customer account records without a business need. The analyst suspects the colleague is selling the data. The institution has a legal obligation to report data breaches. What is the most appropriate first step for the analyst?

   • AConfront the colleague directly to ask for an explanation
   • BAccess the colleague's email to gather evidence
   • CNotify law enforcement immediately without internal reporting
   • DReport the suspicious activity to the incident response team or management
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company that processes credit card payments and stores personal data of EU customers wants to reduce its compliance burden. The company is considering tokenization of cardholder data and pseudonymization of personal data. Which statement is most accurate?

   • ATokenization eliminates GDPR obligations because the data is no longer identifiable
   • BPseudonymization eliminates PCI DSS scope because the data is no longer cardholder data
   • CTokenization can reduce PCI DSS scope, but pseudonymized data is still personal data under GDPR
   • DBoth tokenization and pseudonymization fully remove the data from all regulatory scope
   Reveal Solution Discussion Select an answer first