A cybersecurity analyst wants to share threat intelligence about a new malware strain with other organizations and the government to improve collective defense. The analyst is concerned about legal liability for sharing this information. Which act was specifically designed to encourage such sharing by providing liability protections?

Cybersecurity Information Sharing Act (CISA)

Computer Fraud and Abuse Act (CFAA)

A U.S. healthcare organization stores electronic protected health information (ePHI) in a cloud environment and must demonstrate compliance with a federal law that mandates specific administrative, physical, and technical safeguards. The organization also processes credit card payments for patient co-pays. Which combination of standards/regulations must the organization address?

SOX and NIST Cybersecurity Framework

Which of the following is a key provision of the General Data Protection Regulation (GDPR)?

It requires organizations to report data breaches to the relevant supervisory authority within 72 hours of becoming aware, where feasible.

It requires all organizations to appoint a Data Protection Officer (DPO) regardless of their processing activities.

It mandates that all personal data must be stored within the European Union at all times.

It applies only to organizations physically located in the European Union.

A European company's security team is investigating a data breach that involves personal data of EU residents. The team wants to share the breach details with a U.S.-based partner for forensic analysis. Which legal requirement must the company consider before sharing the data?

GDPR restrictions on international data transfers

PCI DSS requirement to encrypt data in transit

SOX requirement for audit committee approval

CFAA prohibition on unauthorized access

A small online retailer that accepts credit cards wants to achieve PCI DSS compliance but has limited resources. The retailer is considering using a third-party payment processor to reduce its compliance scope. Which approach is most effective in reducing PCI DSS scope?

Use a payment processor that handles all cardholder data and ensure the retailer's systems do not store, process, or transmit cardholder data

Use a virtual private network (VPN) for all internal communications

Implement strong encryption on all internal systems that may store cardholder data

Conduct quarterly external vulnerability scans

EC-CouncilSOC Essentials

Domain 1Objective 6

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 4)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 16–20

16application · medium
A cybersecurity analyst wants to share threat intelligence about a new malware strain with other organizations and the government to improve collective defense. The analyst is concerned about legal liability for sharing this information. Which act was specifically designed to encourage such sharing by providing liability protections?
Select an answer first
17application · medium
A U.S. healthcare organization stores electronic protected health information (ePHI) in a cloud environment and must demonstrate compliance with a federal law that mandates specific administrative, physical, and technical safeguards. The organization also processes credit card payments for patient co-pays. Which combination of standards/regulations must the organization address?
Select an answer first
18foundation · easy
Which of the following is a key provision of the General Data Protection Regulation (GDPR)?
Select an answer first
19application · medium
A European company's security team is investigating a data breach that involves personal data of EU residents. The team wants to share the breach details with a U.S.-based partner for forensic analysis. Which legal requirement must the company consider before sharing the data?
Select an answer first
20expert · hard
A small online retailer that accepts credit cards wants to achieve PCI DSS compliance but has limited resources. The retailer is considering using a third-party payment processor to reduce its compliance scope. Which approach is most effective in reducing PCI DSS scope?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 4)

Questions 16–20

Which of the following is a key provision of the General Data Protection Regulation (GDPR)?

A European company's security team is investigating a data breach that involves personal data of EU residents. The team wants to share the breach details with a U.S.-based partner for forensic analysis. Which legal requirement must the company consider before sharing the data?

A small online retailer that accepts credit cards wants to achieve PCI DSS compliance but has limited resources. The retailer is considering using a third-party payment processor to reduce its compliance scope. Which approach is most effective in reducing PCI DSS scope?

Keep studying — Computer Network and Security Fundamentals