Information Security Laws, Regulations, and Standards EHE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which US federal law requires publicly traded companies to implement internal controls over financial reporting, including IT controls that affect financial data integrity?

   • AComputer Fraud and Abuse Act (CFAA)
   • BFederal Information Security Management Act (FISMA)
   • CElectronic Communications Privacy Act (ECPA)
   • DSarbanes-Oxley Act (SOX)
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security researcher in the U.S. wants to test the security of a public Wi-Fi network at a coffee shop. The researcher plans to use packet-sniffing tools to capture traffic from other customers. Which legal consideration is most relevant?

   • AThe researcher must comply with PCI DSS because the network may carry credit card data
   • BThe Wiretap Act may prohibit intercepting communications without consent
   • CThe researcher must obtain a business associate agreement from the coffee shop
   • DThe researcher must register with the FTC before conducting the test
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which practice is considered an ethical violation for an information security professional?

   • ADisclosing a discovered vulnerability to the affected vendor privately
   • BUsing a vulnerability scanner on a system you own
   • CSelling customer data to a third party without consent
   • DDocumenting test results in a detailed report for the client
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company processes personal data of EU residents and also handles credit card transactions. The company wants to minimize compliance overhead while meeting both GDPR and PCI DSS. Which strategy is most effective?

   • AApply the same security controls to all data to simplify compliance.
   • BImplement a data inventory and classification scheme that identifies personal data and cardholder data separately.
   • COutsource all data processing to a third party to avoid compliance responsibilities.
   • DFocus only on PCI DSS because it is more prescriptive.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A global company operates a healthcare subsidiary in the U.S. and a retail subsidiary in the EU. The retail subsidiary collects customer email addresses for a loyalty program. The healthcare subsidiary stores patient records. The company wants to use the retail customer emails for a new health-related product launch and also wants to transfer patient records to a cloud provider for analytics. Which combination of actions is most appropriate?

   • AAnonymize the email addresses before the launch and store patient records only in the EU
   • BRely on legitimate interest for the marketing and rely on the cloud provider's privacy policy for PHI
   • CObtain consent for the marketing and rely on the cloud provider's ISO 27001 certification for PHI
   • DObtain GDPR consent for the new marketing purpose and sign a BAA with the cloud provider
   Reveal Solution Discussion Select an answer first