A university is implementing a data classification policy. The policy must comply with FERPA for student education records and GDPR for EU student data. The university wants to ensure that data is handled according to its sensitivity. Which approach is MOST appropriate?

Classify all student data as 'Confidential' and apply the same handling requirements to all records, regardless of origin.

Apply GDPR requirements to all student data because GDPR is more comprehensive than FERPA.

Create a classification scheme with categories such as 'Public', 'Internal', 'Confidential', and 'Restricted', and map each category to specific handling requirements based on the applicable regulations.

Store all student data in a single database with access restricted to the registrar's office.

A global logistics company relies on a central tracking system. The system must be available during a regional disaster, but the budget is limited. The current system has a single data center with a recovery time objective (RTO) of 24 hours and a recovery point objective (RPO) of 24 hours. The company wants to improve resilience to an RTO of 4 hours and an RPO of 1 hour. Which solution BEST meets the requirements within a limited budget?

Keep the current single data center but invest in more reliable hardware.

Use a backup and restore approach with daily backups to a different region.

Deploy a full active-active configuration in two regions with synchronous replication.

Implement a pilot light strategy in a second region, with data replication every hour and automated recovery scripts.

Information Systems Security Architecture Professional

Domain 1Objective 1

1.1 Identify Legal, Regulatory, Organizational, and Industry Requirements ISSAP Practice Questions (Page 6)

Part of the Governance, Risk, and Compliance (GRC) domain, which accounts for 21% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

12concepts

21%of the exam

Questions 26–30

26application · medium
A university is implementing a data classification policy. The policy must comply with FERPA for student education records and GDPR for EU student data. The university wants to ensure that data is handled according to its sensitivity. Which approach is MOST appropriate?
Select an answer first
27foundation · easy
Which standard provides a framework for establishing, implementing, maintaining, and continually improving an information security management system (ISMS)?
Select an answer first
28foundation · easy
Which security standard is specifically designed for organizations that store, process, or transmit cardholder data?
Select an answer first
29expert · hard
A global logistics company relies on a central tracking system. The system must be available during a regional disaster, but the budget is limited. The current system has a single data center with a recovery time objective (RTO) of 24 hours and a recovery point objective (RPO) of 24 hours. The company wants to improve resilience to an RTO of 4 hours and an RPO of 1 hour. Which solution BEST meets the requirements within a limited budget?
Select an answer first
30foundation · easy
Which U.S. law requires financial institutions to protect the privacy and security of consumers' personal financial information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

1.1 Identify Legal, Regulatory, Organizational, and Industry Requirements ISSAP Practice Questions (Page 6)

Questions 26–30

A university is implementing a data classification policy. The policy must comply with FERPA for student education records and GDPR for EU student data. The university wants to ensure that data is handled according to its sensitivity. Which approach is MOST appropriate?

Which standard provides a framework for establishing, implementing, maintaining, and continually improving an information security management system (ISMS)?

Which security standard is specifically designed for organizations that store, process, or transmit cardholder data?

Which U.S. law requires financial institutions to protect the privacy and security of consumers' personal financial information?

Keep studying — Governance, Risk, and Compliance (GRC)