A company is implementing a new security policy and must align it with multiple frameworks and laws. The company is subject to ISO/IEC 27001, GDPR, and SOX. The security team is deciding how to structure the policy documentation. Which approach is most effective?

Adopt the most restrictive requirements from each framework and law into a single policy

Create separate policies for each framework and law to ensure clarity

Create a tiered policy structure with a high-level security policy and detailed standards and procedures that map to each requirement

Create a single comprehensive policy that covers all requirements from all frameworks and laws

An organization is implementing a security policy to comply with the GDPR. Which of the following policy elements is most directly required by GDPR?

A policy that mandates the use of a specific encryption algorithm for all data at rest.

A data breach response procedure that includes notifying the supervisory authority within 72 hours of a breach.

A policy that requires all employees to use strong passwords and change them every 30 days.

A policy that requires all personal data to be stored on-premises within the organization's own data center.

A company that processes credit card transactions wants to reduce the scope of its PCI DSS compliance by isolating its cardholder data environment from the rest of the network. Which security control best supports this goal?

Conducting quarterly vulnerability scans

Network segmentation with firewalls

Implementing multi-factor authentication

A multinational corporation is subject to GDPR, HIPAA, and PCI DSS. The security team is designing a single access control policy. Which approach best balances compliance with all three regulations?

Implement a role-based access control (RBAC) system and map roles to the specific requirements of each regulation

Use the same access control policy for all systems to simplify management

Defer access control decisions to individual business units

Implement the most restrictive access control requirements from each regulation across the entire organization

EC-CouncilSOC Essentials

Domain 1Objective 6

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 5)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 21–25

21expert · hard
A company is implementing a new security policy and must align it with multiple frameworks and laws. The company is subject to ISO/IEC 27001, GDPR, and SOX. The security team is deciding how to structure the policy documentation. Which approach is most effective?
Select an answer first
22foundation · easy
A company that processes credit card payments must comply with a standard that specifically addresses the security of cardholder data. Which standard is this?
Select an answer first
23foundation · easy
An organization is implementing a security policy to comply with the GDPR. Which of the following policy elements is most directly required by GDPR?
Select an answer first
24application · medium
A company that processes credit card transactions wants to reduce the scope of its PCI DSS compliance by isolating its cardholder data environment from the rest of the network. Which security control best supports this goal?
Select an answer first
25expert · hard
A multinational corporation is subject to GDPR, HIPAA, and PCI DSS. The security team is designing a single access control policy. Which approach best balances compliance with all three regulations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.