A security analyst is explaining to a new team member the role of the ISO/IEC 27001 standard. Which statement best describes the primary purpose of ISO/IEC 27001?

It is a framework that focuses exclusively on cloud security architecture and shared responsibility models.

It provides a set of technical controls specifically for securing payment card transactions and cardholder data.

It is a US federal law that mandates security controls for federal information systems and contractors.

It specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).

A company wants to demonstrate to customers that its information security management system meets international best practices. Which certification would provide the most recognized third-party validation?

NIST Cybersecurity Framework alignment

EC-CouncilSOC Essentials

Domain 1Objective 6

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 6)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 26–30

26application · medium
A multinational company operates in the EU and the US. The security team is developing a unified incident response plan. They need to ensure that the plan addresses both the EU's data breach notification requirements and the US's voluntary cyber threat information sharing incentives. Which combination of regulations should the plan incorporate?
Select an answer first
27application · medium
A European company's website collects personal data from users. The company wants to ensure it has a legal basis for processing this data and must provide users with the right to access and delete their data. Which regulation grants these rights?
Select an answer first
28foundation · easy
A security analyst is explaining to a new team member the role of the ISO/IEC 27001 standard. Which statement best describes the primary purpose of ISO/IEC 27001?
Select an answer first
29expert · hard
A security analyst at a U.S. company discovers that an employee accessed a competitor's system without authorization and stole trade secrets. The company also processes EU personal data and is considering sharing the incident details with a government agency. Which combination of laws must the analyst consider?
Select an answer first
30application · medium
A company wants to demonstrate to customers that its information security management system meets international best practices. Which certification would provide the most recognized third-party validation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Information Security Standards, Laws, and Acts SCE Practice Questions (Page 6)

Questions 26–30

A European company's website collects personal data from users. The company wants to ensure it has a legal basis for processing this data and must provide users with the right to access and delete their data. Which regulation grants these rights?

A security analyst is explaining to a new team member the role of the ISO/IEC 27001 standard. Which statement best describes the primary purpose of ISO/IEC 27001?

A company wants to demonstrate to customers that its information security management system meets international best practices. Which certification would provide the most recognized third-party validation?

Keep studying — Computer Network and Security Fundamentals