A publicly traded company's IT team discovers a data breach that could materially affect the company's financial statements. The CFO is concerned about the legal obligation to maintain accurate financial records and internal controls. Which law is most directly relevant to this situation?

Cybersecurity Information Sharing Act (CISA)

Computer Fraud and Abuse Act (CFAA)

A company wants to achieve a competitive advantage by demonstrating strong security practices to customers. The company also wants to reduce the risk of regulatory fines. Which combination of actions is most effective?

Adopt NIST CSF without certification

Obtain ISO/IEC 27001 certification and map controls to relevant laws

A company operates in a jurisdiction with strict data protection laws and also processes credit card payments. The company wants to implement a single set of security controls that satisfies both the data protection law and PCI DSS. Which approach is most efficient?

Map ISO/IEC 27001 controls to both GDPR and PCI DSS requirements

Implement separate control sets for GDPR and PCI DSS

Use NIST CSF as the only framework

EC-CouncilSOC Essentials

Domain 1Objective 6

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 3)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 11–15

11application · medium
A publicly traded company's IT team discovers a data breach that could materially affect the company's financial statements. The CFO is concerned about the legal obligation to maintain accurate financial records and internal controls. Which law is most directly relevant to this situation?
Select an answer first
12expert · hard
A company wants to achieve a competitive advantage by demonstrating strong security practices to customers. The company also wants to reduce the risk of regulatory fines. Which combination of actions is most effective?
Select an answer first
13expert · hard
A company operates in a jurisdiction with strict data protection laws and also processes credit card payments. The company wants to implement a single set of security controls that satisfies both the data protection law and PCI DSS. Which approach is most efficient?
Select an answer first
14expert · hard
A U.S. company that is not publicly traded but processes EU residents' personal data and also handles credit card transactions. The company wants to share threat indicators with a government agency. Which combination of laws/standards must the company consider?
Select an answer first
15application · medium
A US-based healthcare provider stores electronic health records (EHR) and shares patient data with a third-party billing company. The provider wants to ensure that both organizations follow the same privacy and security rules for protecting patient information. Which law directly governs this data sharing arrangement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 3)

Questions 11–15

A publicly traded company's IT team discovers a data breach that could materially affect the company's financial statements. The CFO is concerned about the legal obligation to maintain accurate financial records and internal controls. Which law is most directly relevant to this situation?

A company wants to achieve a competitive advantage by demonstrating strong security practices to customers. The company also wants to reduce the risk of regulatory fines. Which combination of actions is most effective?

A company operates in a jurisdiction with strict data protection laws and also processes credit card payments. The company wants to implement a single set of security controls that satisfies both the data protection law and PCI DSS. Which approach is most efficient?

A U.S. company that is not publicly traded but processes EU residents' personal data and also handles credit card transactions. The company wants to share threat indicators with a government agency. Which combination of laws/standards must the company consider?

Keep studying — Computer Network and Security Fundamentals