A healthcare organization in the United States is subject to HIPAA. Which security operation is most directly impacted by HIPAA's privacy and security rules?

Conducting background checks on all employees

Monitoring network traffic for malware

Protecting the confidentiality, integrity, and availability of electronic protected health information (ePHI)

Implementing multi-factor authentication for all systems

A financial services company is subject to both GLBA and state breach notification laws. A data breach occurs involving customer financial information. Which of the following is the most appropriate initial action?

Wait for law enforcement to authorize notification before doing anything.

Notify all customers immediately without assessing the risk of harm.

Notify only the state attorney general and not customers.

Conduct a risk assessment to determine if notification is required under applicable laws.

Systems Security Certified Practitioner

Domain 3Objective 2

3.2 - Understand Legal and Regulatory Concerns (e.g., Jurisdiction, Limitations, Privacy) SSCP Practice Questions (Page 1)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

15%of the exam

Questions 1–5

1foundation · easy
An organization collects customer email addresses for the purpose of sending order confirmations. Later, the marketing department wants to use those email addresses for a promotional newsletter without obtaining additional consent. Which data protection principle would this practice violate?
Select an answer first
2foundation · easy
A healthcare organization in the United States is subject to HIPAA. Which security operation is most directly impacted by HIPAA's privacy and security rules?
Select an answer first
3foundation · easy
A security team is designing a new customer relationship management (CRM) system. To comply with data protection principles, they decide to collect only the customer data fields that are strictly necessary for the system's stated purpose. Which data protection principle does this practice exemplify?
Select an answer first
4application · medium
A financial services company is subject to both GLBA and state breach notification laws. A data breach occurs involving customer financial information. Which of the following is the most appropriate initial action?
Select an answer first
5application · medium
A marketing company operating in California collects personal data from website visitors to personalize ads. They also share this data with third-party analytics vendors. Which privacy law is most directly applicable to this practice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

3.2 - Understand Legal and Regulatory Concerns (e.g., Jurisdiction, Limitations, Privacy) SSCP Practice Questions (Page 1)

Questions 1–5

An organization collects customer email addresses for the purpose of sending order confirmations. Later, the marketing department wants to use those email addresses for a promotional newsletter without obtaining additional consent. Which data protection principle would this practice violate?

A healthcare organization in the United States is subject to HIPAA. Which security operation is most directly impacted by HIPAA's privacy and security rules?

A financial services company is subject to both GLBA and state breach notification laws. A data breach occurs involving customer financial information. Which of the following is the most appropriate initial action?

A marketing company operating in California collects personal data from website visitors to personalize ads. They also share this data with third-party analytics vendors. Which privacy law is most directly applicable to this practice?

Keep studying — Risk Identification, Monitoring and Analysis