Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company that is not required to comply with any specific regulation wants to improve its security posture. The company has a limited budget and must choose between implementing a security framework or purchasing a new firewall. Which decision is most appropriate?

   • AImplement a security framework first to identify and prioritize risks, then purchase the firewall if it addresses a high-priority risk.
   • BDelay any action until a breach occurs to justify the budget.
   • CDo both simultaneously to maximize security.
   • DPurchase the firewall first because it provides immediate protection.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An e-commerce company that accepts credit card payments wants to reduce the risk of cardholder data theft and avoid fines from card brands. The company already uses encryption in transit and stores card numbers only when necessary. Which additional measure is most directly aligned with the applicable industry standard?

   • AImplement multi-factor authentication for all customer accounts
   • BObtain a business associate agreement from the payment processor
   • CConduct quarterly vulnerability scans and annual on-site assessments
   • DRegister with the local data protection authority
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multinational company with offices in the EU and the U.S. wants to transfer employee HR data from its EU subsidiary to its U.S. headquarters for centralized processing. The company has already implemented appropriate safeguards. Which GDPR requirement is most directly relevant to this transfer?

   • AObtain consent from each employee for the transfer
   • BStore the data only in the EU and never transfer it
   • CAnonymize the HR data before transfer
   • DEnsure an adequate transfer mechanism, such as Standard Contractual Clauses
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration tester is hired by a company to test its web application. The tester signs a contract that limits the testing to specific IP ranges and times. During the test, the tester discovers a vulnerability that could be exploited to access a partner's system. What is the most ethical action?

   • AExploit the vulnerability to access the partner's system and document the impact.
   • BIgnore the finding because it is outside the scope of the test.
   • CTest the partner's system to confirm the vulnerability before reporting.
   • DStop testing and report the finding to the client, recommending coordination with the partner.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A U.S. company experiences a data breach that exposes customer payment card data and EU residents' personal data. The company has 72 hours to notify the relevant authority under GDPR. The company also has contractual obligations to notify its payment processor. Which action is most appropriate?

   • ANotify the payment processor first and delay GDPR notification until the investigation is complete
   • BWait for law enforcement to complete its investigation before notifying anyone
   • CNotify the GDPR supervisory authority within 72 hours and the payment processor according to the contract
   • DNotify only the affected customers and not the authorities
   Reveal Solution Discussion Select an answer first