Information Security Standards, Laws, and Acts SCE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A US-based cloud service provider hosts data for a European customer. The customer's data includes personal data of EU residents. The provider is considering moving the data to a US region to reduce costs. The customer insists on compliance with GDPR. Which consideration is most critical for the provider to address?

   • AThe provider must obtain explicit consent from each data subject before transferring data
   • BThe data must remain in the EU to comply with GDPR
   • CThe provider must delete all EU personal data after processing
   • DThe provider must implement appropriate safeguards for international data transfers, such as standard contractual clauses
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company wants to demonstrate to its customers that it has a comprehensive information security management system in place. The company is considering obtaining a certification that is internationally recognized and requires third-party audits. Which certification should the company pursue?

   • ANIST SP 800-53
   • BSOX
   • CISO/IEC 27001
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company wants to implement a security program that satisfies multiple regulatory requirements without duplicating efforts. The company processes EU personal data, credit card transactions, and is publicly traded. Which framework should the company use as the baseline?

   • APCI DSS
   • BNIST Cybersecurity Framework
   • CISO/IEC 27001
   • DCOBIT
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   The Sarbanes-Oxley Act (SOX) primarily impacts an organization's security policies in which way?

   • AIt mandates that all organizations implement multi-factor authentication for all employee accounts.
   • BIt requires all organizations to share cybersecurity threat information with the government.
   • CIt applies only to healthcare organizations and requires the protection of patient data.
   • DIt requires public companies to establish internal controls over financial reporting, including IT controls that ensure the integrity of financial data.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A government contractor is required to implement a comprehensive set of security controls to protect federal information systems. The contract references a widely used framework that provides a catalog of controls and is often used for FedRAMP authorization. Which framework is the contractor most likely required to follow?

   • ANIST SP 800-53
   • BPCI DSS
   • CISO/IEC 27001
   • DSOX
   Reveal Solution Discussion Select an answer first