6.1 Identify the Impact of Laws and Regulations That Relate to Information Security ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security manager is evaluating the risks of non-compliance with multiple regulations. The organization is subject to HIPAA, PCI DSS, and GDPR. A data breach occurs involving PHI, credit card data, and EU personal data. Which of the following is the most significant risk the organization faces?

   • ARegulatory fines and penalties from multiple authorities, potentially including HIPAA, PCI DSS, and GDPR.
   • BLoss of the organization's ability to process credit card payments, which is the most severe consequence.
   • CAutomatic revocation of the organization's business license.
   • DCriminal prosecution of the security manager for negligence.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company based in Australia provides cloud services to customers in the EU. The company stores all customer data in data centers located in Singapore. The company is subject to GDPR because it offers services to EU residents. Which of the following is a key compliance obligation under GDPR for this company?

   • AEnsure that all customer data is stored in Australia to comply with GDPR.
   • BRegister with the Australian Privacy Commissioner to process EU data.
   • CAppoint a representative in the EU if the company does not have an establishment there.
   • DObtain a data protection license from the Singapore government.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A U.S. public university is subject to the Family Educational Rights and Privacy Act (FERPA) and is implementing a new learning management system (LMS) that will store student education records. Which of the following is a primary compliance requirement under FERPA for the LMS?

   • AConduct annual security awareness training for all faculty and staff.
   • BAppoint a data protection officer to oversee FERPA compliance.
   • CEncrypt all education records at rest and in transit to comply with FERPA.
   • DObtain written consent from parents or eligible students before disclosing education records to third parties, with limited exceptions.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following best describes the legal jurisdiction that applies to an organization's information systems?

   • AThe jurisdiction where the organization operates, where its users are located, and where its data is processed or stored.
   • BOnly the jurisdiction where the data is physically stored.
   • CThe jurisdiction that offers the most favorable data protection laws.
   • DOnly the jurisdiction where the organization is legally incorporated.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security manager is advising the board on the risks of non-compliance with the Sarbanes-Oxley Act (SOX). The organization is a publicly traded company and has experienced a material weakness in its internal controls over financial reporting. Which of the following is the most significant risk of this non-compliance?

   • AThe organization may face SEC enforcement actions, fines, and potential criminal penalties for executives.
   • BThe organization's customers will lose confidence and stop purchasing products.
   • CThe organization will be delisted from the stock exchange automatically.
   • DThe organization will be required to disclose the material weakness to all its employees.
   Reveal Solution Discussion Select an answer first