6.1 Identify the Impact of Laws and Regulations That Relate to Information Security ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A multinational organization stores customer personal data in a data center located in Country A but processes that data in Country B. Which of the following is the primary legal concern regarding trans-border data flow?

   • AThe organization must obtain a patent for the data processing method before transferring data.
   • BThe data must be encrypted during transit between the two countries.
   • CThe data must be stored in the country where it was collected to avoid any legal issues.
   • DThe transfer may be subject to restrictions or requirements imposed by the laws of Country A, Country B, or both.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A global company with offices in the EU, the U.S., and Asia collects personal data from users in all regions. The company's data is stored in a centralized data center in the U.S. The company is subject to GDPR for its EU users. Which of the following is a key consideration for the company's data flow architecture?

   • AEU personal data transferred to the U.S. must have an appropriate legal basis, such as standard contractual clauses or an adequacy decision.
   • BU.S. data protection laws automatically apply to all EU user data because the data is stored in the U.S.
   • CEU personal data must be stored exclusively within the EU to be GDPR-compliant.
   • DThe company can avoid GDPR compliance by obtaining consent from EU users once at the time of data collection.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A global organization is subject to both the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The organization is updating its privacy program to comply with both laws. Which of the following is the most significant challenge in reconciling GDPR and CCPA requirements?

   • AGDPR requires a Data Protection Officer, while CCPA prohibits the appointment of a Data Protection Officer.
   • BGDPR applies only to EU residents, while CCPA applies only to California residents, making compliance mutually exclusive.
   • CGDPR requires a legal basis for processing, while CCPA provides consumers with the right to opt out of the sale of their personal information.
   • DGDPR requires data minimization, while CCPA requires data retention for at least five years.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational corporation with headquarters in the EU and a subsidiary in a country that is not recognized by the EU as having adequate data protection is planning to transfer employee personal data to that subsidiary for HR management. The company is considering using standard contractual clauses (SCCs) as the transfer mechanism. Which of the following is the most critical consideration when relying on SCCs?

   • AThe company must ensure that the subsidiary is certified under the EU-U.S. Data Privacy Framework.
   • BThe company must store a copy of the SCCs with the local data protection authority.
   • CThe company must conduct a transfer impact assessment to evaluate whether the laws of the destination country undermine the protections of the SCCs.
   • DThe company must obtain explicit consent from each employee before transferring their data.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A U.S. organization that provides health insurance is subject to the Health Insurance Portability and Accountability Act (HIPAA). The organization is implementing a new patient portal that will allow patients to access their health records online. Which of the following is a primary compliance requirement under HIPAA for the patient portal?

   • AAppoint a privacy officer and a security officer, which is optional under HIPAA.
   • BEncrypt all patient data at rest and in transit, regardless of risk assessment.
   • CImplement technical safeguards, such as access controls and audit logs, to protect electronic protected health information (ePHI).
   • DObtain written consent from patients before allowing them to access their own health records.
   Reveal Solution Discussion Select an answer first