Legal, Regulatory and Contractual Requirements CISM Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company in the European Union is developing a new mobile app that collects location data from users. The information security manager is reviewing the app's data handling practices. Which legal requirement is most directly applicable to this scenario?

   • AThe PCI DSS requirement for securing cardholder data.
   • BThe Sarbanes-Oxley Act's requirement for financial reporting controls.
   • CThe GDPR's requirement for a Data Protection Impact Assessment (DPIA) for high-risk processing activities.
   • DThe HIPAA requirement for protecting health information.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is subject to a new data protection law that requires it to report data breaches to the regulator within 72 hours. The information security manager must update the incident response plan to ensure compliance. What is the most critical element to add to the plan?

   • AA process for conducting a post-incident review.
   • BA list of potential legal penalties for non-compliance.
   • CA detailed procedure for notifying affected individuals.
   • DA clear escalation path that ensures the regulator is notified within the required timeframe.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is outsourcing its IT support to a third-party provider. The contract includes a service level agreement (SLA) that requires the provider to patch all systems within 48 hours of a patch release. The information security manager is concerned that this SLA is not being met. What is the most effective way to verify compliance with this SLA?

   • AImplement a technical control that automatically verifies patch levels and alerts on non-compliance.
   • BConduct a quarterly audit of the provider's patching procedures.
   • CRely on the provider's self-certification that it is meeting the SLA.
   • DRequire the provider to submit a monthly report of all patching activities.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is the PRIMARY reason an information security manager must identify and interpret legal requirements affecting the organization?

   • ATo satisfy the requirements of external auditors during certification audits
   • BTo ensure security controls align with applicable laws and avoid legal penalties
   • CTo reduce the cost of security investments by focusing only on mandatory controls
   • DTo prioritize security initiatives based on the severity of potential threats
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is planning to implement a new biometric authentication system for employee access to its facilities. The system will store biometric data of all employees. The information security manager must assess the impact of this system on the organization's compliance with data protection laws. What is the most critical factor to evaluate?

   • AThe technical accuracy of the biometric system.
   • BThe cost of implementing the biometric system.
   • CThe legal requirements for processing biometric data under applicable data protection laws.
   • DThe employees' acceptance of the new system.
   Reveal Solution Discussion Select an answer first