6.1 Identify the Impact of Laws and Regulations That Relate to Information Security ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is the primary purpose of security and privacy laws, regulations, and standards?

   • ATo establish mandatory requirements for protecting information and personal data.
   • BTo provide a competitive advantage for organizations that comply with them.
   • CTo ensure that all organizations use the same security technology.
   • DTo replace an organization's internal security policies.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security manager is reviewing the organization's policy on employee-created intellectual property. The organization has an employment agreement that assigns all intellectual property created by employees during their employment to the organization. An employee has developed a new software tool on their own time using their own equipment, but the tool is related to the organization's business. Which of the following is the most important factor in determining whether the organization owns the tool?

   • AWhether the employee has signed a non-disclosure agreement.
   • BWhether the employee has registered the tool with the copyright office.
   • CWhether the employee has filed a patent application for the tool.
   • DWhether the tool was developed within the scope of the employee's employment and using the organization's resources.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company discovers that a competitor is using a logo that is confusingly similar to its registered trademark. The competitor's logo appears on its website and marketing materials. Which of the following is the most appropriate legal action to protect the company's trademark?

   • AFile a patent application to protect the logo.
   • BSend a cease-and-desist letter and, if necessary, file a trademark infringement lawsuit.
   • CReport the competitor to the local data protection authority.
   • DRegister the logo as a copyright with the copyright office.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security manager is reviewing the organization's intellectual property protection strategy. The organization has developed a unique algorithm that provides a competitive advantage and is not publicly known. The algorithm is implemented in software and the company has not filed for any patents. Which of the following is the most appropriate protection strategy for the algorithm?

   • ARely on copyright protection for the algorithm's source code, which prevents others from using the algorithm.
   • BApply for a trademark to protect the algorithm's name and logo.
   • CTreat the algorithm as a trade secret and implement access controls, NDAs, and confidentiality policies.
   • DPublish the algorithm in a public repository to establish prior art and prevent others from patenting it.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A multinational company with headquarters in the United States processes customer data for its European Union (EU) subsidiary. The EU subsidiary's data is stored in a cloud provider's data center located in Ireland. The company's security team is asked to ensure compliance with the EU General Data Protection Regulation (GDPR). Which action is most directly required to address GDPR's trans-border data flow requirements?

   • AStore all EU customer data only in the Irish data center and prohibit any access from outside the EU.
   • BImplement encryption for all EU customer data at rest and in transit.
   • CObtain explicit consent from every EU customer before any data processing occurs.
   • DEnsure that any transfer of personal data from the EU to the U.S. is covered by an appropriate transfer mechanism, such as the EU-U.S. Data Privacy Framework.
   Reveal Solution Discussion Select an answer first