A company's website is defaced by an attacker who replaced the homepage with a political message. The attacker did not steal any data. Which type of cybercrime best describes this activity?

Hacktivism, because the attacker used the defacement to promote a political message.

Cyber espionage, because the attacker gained unauthorized access.

Ransomware, because the attacker took control of the website.

Identity theft, because the attacker impersonated the company.

Which of the following privacy regulations is specifically designed to protect the personal data of residents of the European Union?

Protection of Personal Information Act (POPIA)

California Consumer Privacy Act (CCPA)

Personal Information Protection Law (PIPL)

General Data Protection Regulation (GDPR)

A US company develops a cryptographic module that is classified as a dual-use item under the Export Administration Regulations (EAR). The company wants to share the module with a research partner in France. What is the most important consideration?

The transfer is exempt because it is for research purposes.

The transfer may require an export license from the Bureau of Industry and Security (BIS).

The research partner must sign a non-disclosure agreement (NDA).

The transfer is exempt because France is a member of the European Union.

A company experiences a data breach that exposes the personal data of customers in the European Union. Which regulation most directly imposes a legal obligation to notify the relevant supervisory authority of this breach?

The General Data Protection Regulation (GDPR)

The Payment Card Industry Data Security Standard (PCI DSS)

The Health Insurance Portability and Accountability Act (HIPAA)

Certified Information Systems Security Professional

Domain 1Objective 4

1.4 - Understand Legal, Regulatory, and Compliance Issues That Pertain to Information Security in a Holistic Context CISSP Practice Questions (Page 6)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

11concepts

16%of the exam

Questions 26–30

26application · medium
A company's website is defaced by an attacker who replaced the homepage with a political message. The attacker did not steal any data. Which type of cybercrime best describes this activity?
Select an answer first
27foundation · easy
Which of the following privacy regulations is specifically designed to protect the personal data of residents of the European Union?
Select an answer first
28expert · medium
A US company develops a cryptographic module that is classified as a dual-use item under the Export Administration Regulations (EAR). The company wants to share the module with a research partner in France. What is the most important consideration?
Select an answer first
29foundation · easy
A financial institution is required to implement specific security controls to protect customer financial information. Which of the following is a regulatory framework that mandates such controls?
Select an answer first
30foundation · easy
A company experiences a data breach that exposes the personal data of customers in the European Union. Which regulation most directly imposes a legal obligation to notify the relevant supervisory authority of this breach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.