A global e-commerce company processes credit card payments, stores EU customer personal data, and is publicly traded. The security team must design a compliance program that satisfies multiple obligations. Which approach best addresses the overlapping requirements of PCI DSS, GDPR, and SOX?

Prioritize PCI DSS because it is the most prescriptive, and assume GDPR and SOX are covered by its controls

Adopt a risk-based approach that identifies common controls and implements specific controls for each regulation's unique requirements

Implement a single unified security framework based on ISO/IEC 27001 and map it to all three regulations

Create separate compliance programs for each regulation to ensure no overlap is missed

A multinational company with offices in the EU and the U.S. wants to align its security program with a widely recognized international standard that provides a certifiable framework for information security management. The company also needs to satisfy EU data protection requirements. Which approach best meets both needs?

Adopt the NIST Cybersecurity Framework as the sole compliance mechanism

Implement ISO/IEC 27001 and map controls to GDPR requirements

Rely on the Computer Fraud and Abuse Act

What is the primary purpose of the Cybersecurity Information Sharing Act (CISA)?

To regulate the collection and use of personal data by commercial entities.

To encourage the voluntary sharing of cybersecurity threat information between private entities and the government.

To establish standards for the protection of health information.

To mandate that all organizations implement a specific set of security controls.

How do information security standards, laws, and acts most directly influence an organization's security policies?

They only apply to government agencies and do not affect private sector organizations.

They provide a baseline of requirements that organizations must address in their policies to achieve compliance and reduce legal risk.

They replace the need for internal security policies because they are legally binding and enforceable.

They are voluntary guidelines that organizations can choose to ignore without consequences.

A US healthcare provider handles protected health information (PHI). Which law sets national standards for the protection of PHI and gives patients rights over their health information?

CFAA (Computer Fraud and Abuse Act)

HIPAA (Health Insurance Portability and Accountability Act)

CISA (Cybersecurity Information Sharing Act)

EC-CouncilSOC Essentials

Domain 1Objective 6

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 1)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 1–5

1expert · hard
A global e-commerce company processes credit card payments, stores EU customer personal data, and is publicly traded. The security team must design a compliance program that satisfies multiple obligations. Which approach best addresses the overlapping requirements of PCI DSS, GDPR, and SOX?
Select an answer first
2application · medium
A multinational company with offices in the EU and the U.S. wants to align its security program with a widely recognized international standard that provides a certifiable framework for information security management. The company also needs to satisfy EU data protection requirements. Which approach best meets both needs?
Select an answer first
3foundation · easy
What is the primary purpose of the Cybersecurity Information Sharing Act (CISA)?
Select an answer first
4foundation · easy
How do information security standards, laws, and acts most directly influence an organization's security policies?
Select an answer first
5foundation · easy
A US healthcare provider handles protected health information (PHI). Which law sets national standards for the protection of PHI and gives patients rights over their health information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.