1.4 - Understand Legal, Regulatory, and Compliance Issues That Pertain to Information Security in a Holistic Context CISSP Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A global SaaS company with customers in the EU, China, and South Africa needs to store customer data. The EU customers require GDPR compliance, China requires PIPL compliance, and South Africa requires POPIA compliance. The company wants to minimize legal risk while maintaining a single global data store. What is the most appropriate approach?

   • AAnonymize all data before storing it in a single global data center.
   • BStore all data in the US and rely on the US Privacy Shield framework.
   • CStore data in regional data centers and implement separate data handling policies for each jurisdiction.
   • DStore all data in a single EU data center and rely on GDPR as the highest standard.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company in the healthcare industry wants to ensure its security program aligns with a recognized framework. The company processes protected health information (PHI) and is subject to HIPAA. Which framework is most directly applicable?

   • AISO/IEC 27001
   • BPCI DSS
   • CHIPAA Security Rule
   • DNIST Cybersecurity Framework (CSF)
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An organization is implementing a new customer relationship management (CRM) system that will store personal data. To comply with privacy regulations, which of the following is the most appropriate initial step?

   • AConducting a privacy impact assessment (PIA) to identify and mitigate privacy risks
   • BImmediately collecting as much data as possible to ensure the system is useful
   • CDeleting all existing customer data
   • DEncrypting all data at rest and in transit
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a key principle that governs transborder data flows?

   • AData should only be transferred to countries that provide an adequate level of data protection
   • BData can be transferred freely as long as it is encrypted
   • CData should be transferred only to countries that are members of the United Nations
   • DData should be transferred to the country with the lowest storage costs
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important for a contract with a third-party vendor to include a data breach notification clause?

   • AIt ensures the organization is promptly informed of a breach so it can meet its own legal and regulatory obligations
   • BIt transfers all liability for the breach to the vendor
   • CIt allows the organization to avoid notifying its own customers
   • DIt prevents the vendor from experiencing a data breach
   Reveal Solution Discussion Select an answer first