Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A U.S. company that is not a healthcare provider stores health-related data for a wellness app. The app is offered to EU users. The company wants to avoid GDPR fines and also wants to ensure the data is protected against breaches. The company has a limited budget and cannot afford a full ISO 27001 certification. Which combination of actions is most appropriate?

   • AObtain ISO 27001 certification despite the budget constraint
   • BImplement GDPR-compliant data processing practices and adopt the NIST CSF for security controls
   • CStore all data in the U.S. and claim GDPR does not apply
   • DRely on the app store's privacy policy and use basic encryption
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is deciding between implementing ISO/IEC 27001 or the NIST Cybersecurity Framework. The company is a small business with limited resources and wants to prioritize practical, risk-based improvements. Which approach is most appropriate?

   • AChoose PCI DSS because it is the most common standard.
   • BAdopt both frameworks simultaneously to maximize security.
   • CUse NIST CSF as a flexible, risk-based guide and implement controls incrementally.
   • DPursue ISO/IEC 27001 certification immediately to gain a competitive advantage.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst discovers that a colleague has been using a password-cracking tool against the company's own user accounts to test password strength. The colleague claims this is a legitimate security assessment. Which action is most appropriate for the analyst to take?

   • AVerify that the activity is covered by an authorized penetration testing agreement
   • BReport the colleague to law enforcement immediately
   • CAsk the colleague to share the results so the analyst can fix weak passwords
   • DIgnore the activity because it is against the company's own systems
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security consultant is hired to test a client's internal network. The contract allows testing of the internal network but explicitly prohibits testing of the HR database. During the test, the consultant discovers that the HR database is accessible from the internal network without authentication. What is the most appropriate action?

   • AReport the vulnerability to the client without accessing the database contents
   • BAccess the database to confirm the vulnerability and then report it
   • CIgnore the database because it is out of scope
   • DAsk the client for permission to test the database before proceeding
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security researcher in the U.S. discovers a vulnerability in a popular IoT device. The researcher wants to publish a proof-of-concept exploit to demonstrate the risk. The researcher is concerned about legal liability. Which action is most likely to reduce legal risk while still disclosing the vulnerability?

   • APublish the exploit anonymously to avoid identification
   • BPublish the exploit immediately to force the vendor to act
   • CSell the exploit to a government agency without notifying the vendor
   • DCoordinate with the vendor and publish the exploit after a responsible disclosure period
   Reveal Solution Discussion Select an answer first