Legal, Regulatory and Contractual Requirements CISM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation operates in the EU, the US, and Asia. It processes personal data subject to GDPR, CCPA, and various local laws. The information security manager is tasked with designing a compliance management process that is both effective and efficient. Which approach best balances these objectives?

   • ACreate separate compliance programs for each region to ensure full compliance.
   • BDevelop a core set of controls that meet the strictest common requirements and add region-specific controls where needed.
   • CImplement a single global privacy policy and apply it uniformly across all regions.
   • DFocus only on the GDPR because it is the most comprehensive regulation.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An organization has just learned that a new regulation will require encryption of all personal data at rest. What should the information security manager do FIRST to assess the impact on governance?

   • ANotify all employees of the new encryption policy
   • BRequest an extension from the regulatory body
   • CImmediately purchase and deploy encryption software across all systems
   • DIdentify which systems store personal data and evaluate current encryption controls
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing company is considering a new cloud-based HR system that will store employee personal data. The system is hosted in a country with different data protection laws. The information security manager must assess the impact of this decision on the organization's information security governance. What is the most critical factor to evaluate in this impact assessment?

   • AThe data protection and privacy laws of the hosting country and their effect on the company's legal obligations.
   • BThe cost of the cloud service compared to the on-premises alternative.
   • CThe reputation of the cloud provider in the industry.
   • DThe technical features of the cloud platform, such as encryption and access controls.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A credit card processing company is required to comply with PCI DSS. The information security manager is reviewing the network architecture and discovers that cardholder data is being transmitted over an internal network segment that is shared with non-cardholder systems. Which PCI DSS requirement is most directly violated?

   • AImplement strong access control measures for all system components.
   • BProtect cardholder data with strong encryption during transmission over open, public networks.
   • CMaintain a network segmentation policy that isolates cardholder data environments from untrusted networks.
   • DRestrict access to cardholder data by business need-to-know.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A financial institution is subject to both PCI DSS and the Gramm-Leach-Bliley Act (GLBA). The information security manager is reviewing the security program and finds that the current controls meet PCI DSS but may not fully address GLBA's Safeguards Rule. What is the most appropriate action to ensure compliance with both?

   • AAssume that PCI DSS compliance is sufficient for GLBA compliance.
   • BWait for the next regulatory examination to identify any gaps.
   • CConduct a gap analysis to identify where GLBA requirements exceed PCI DSS controls.
   • DReplace the PCI DSS program with a GLBA-focused program.
   Reveal Solution Discussion Select an answer first