1.1 Identify Legal, Regulatory, Organizational, and Industry Requirements ISSAP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A multinational healthcare organization headquartered in the EU stores patient records in a US-based cloud provider. The organization must comply with GDPR for EU residents and HIPAA for its US operations. The security architect is designing a data classification and handling scheme. Which combination of actions best addresses the regulatory overlap?

   • AStore all data in the EU region only and apply GDPR exclusively, since GDPR is stricter than HIPAA.
   • BAnonymize all patient data at rest so that neither GDPR nor HIPAA applies, removing the need for further controls.
   • CApply GDPR requirements to all EU-origin data and HIPAA requirements to all US-origin data, with no overlap or additional controls.
   • DClassify all patient data as 'restricted' and enforce encryption at rest and in transit across all regions, while maintaining a data inventory that maps each record to its applicable regulation.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A manufacturing company uses a third-party supplier for critical components. The supplier's software update mechanism was compromised, leading to a malware infection in the company's production network. The company is reviewing its supply chain security. Which improvement is MOST directly aligned with a recognized standard to prevent a recurrence?

   • ARequire the supplier to sign all software updates with a code-signing certificate and verify the signature before installation.
   • BIncrease the frequency of vulnerability scans on the production network.
   • CMove the production network to a different IP address range to avoid the malware.
   • DTerminate the contract with the supplier and find a new one.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A multinational corporation wants to implement a privacy information management system (PIMS) to demonstrate compliance with GDPR and other privacy regulations. The architect is looking for a certifiable standard that provides requirements for establishing, implementing, maintaining, and improving a PIMS. Which standard should be used?

   • ANIST Privacy Framework (Version 1.0)
   • BISO/IEC 27001 (Information Security Management Systems)
   • CISO/IEC 27701 (Privacy Information Management System)
   • DGDPR (General Data Protection Regulation)
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which standard provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS)?

   • ANIST SP 800-53
   • BISO/IEC 27701
   • CCOBIT
   • DPCI DSS
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which framework from NIST is designed to help organizations manage privacy risk and improve privacy outcomes?

   • ANIST Privacy Framework
   • BNIST Cybersecurity Framework
   • CNIST SP 800-30
   • DNIST SP 800-37
   Reveal Solution Discussion Select an answer first