A financial institution is subject to GLBA and is implementing a vendor management program. The security team is evaluating a third-party cloud provider that will store customer financial data. Which action is required to align with GLBA's Safeguards Rule?

Ignore the provider's security posture because the contract transfers liability

Require the provider to store data in a foreign country to avoid U.S. regulations

Conduct due diligence and contractually require the provider to safeguard customer information

Allow the provider to access all customer data without restrictions

A global company processes personal data of EU citizens and also handles credit card transactions. The security team is prioritizing compliance efforts. Which statement accurately reflects the relationship between GDPR and PCI DSS?

Both frameworks apply, and the company must implement controls that satisfy both sets of requirements

GDPR replaces PCI DSS for payment card data

The company can choose to comply with only one framework to reduce costs

PCI DSS overrides GDPR for all data processing activities

A cloud service provider that hosts customer data must comply with GDPR. A customer requests that their data be deleted. What must the provider do to align with GDPR?

Erase the customer's personal data and confirm deletion to the customer

Keep the data for at least 10 years for potential legal disputes

Anonymize the data and keep it for analytics

Transfer the data to a third country for storage

A financial institution subject to GLBA and PCI DSS is implementing a data loss prevention (DLP) system. The DLP must monitor outbound traffic for customer financial data and cardholder data. Which configuration best meets both frameworks' requirements?

Deploy DLP with policies that detect and block both customer financial data and cardholder data, with alerts for review

Deploy DLP only for customer financial data because GLBA is broader

Use DLP to block all outbound traffic to reduce risk

Deploy DLP only for cardholder data because PCI DSS is more specific

EC-CouncilNetwork Defense Essentials

Domain 2Objective 1

Regulatory Frameworks and Compliance Requirements NDE Practice Questions (Page 7)

Part of the Administrative and Physical Security Controls domain, which makes up ~15% of our current practice bank.

46questions here

10free pages

4concepts

Questions 31–35

31application · medium
A multinational company processes personal data of EU citizens and also handles credit card transactions. The compliance team must determine which regulatory frameworks apply. Which combination of frameworks is most likely applicable?
Select an answer first
32application · medium
A financial institution is subject to GLBA and is implementing a vendor management program. The security team is evaluating a third-party cloud provider that will store customer financial data. Which action is required to align with GLBA's Safeguards Rule?
Select an answer first
33application · medium
A global company processes personal data of EU citizens and also handles credit card transactions. The security team is prioritizing compliance efforts. Which statement accurately reflects the relationship between GDPR and PCI DSS?
Select an answer first
34application · medium
A cloud service provider that hosts customer data must comply with GDPR. A customer requests that their data be deleted. What must the provider do to align with GDPR?
Select an answer first
35expert · hard
A financial institution subject to GLBA and PCI DSS is implementing a data loss prevention (DLP) system. The DLP must monitor outbound traffic for customer financial data and cardholder data. Which configuration best meets both frameworks' requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.