3.2 - Understand Legal and Regulatory Concerns (e.g., Jurisdiction, Limitations, Privacy) SSCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An organization wants to monitor employee email communications to detect data leakage. What legal limitation must the organization consider before implementing such monitoring?

   • AThe monitoring must be conducted only during business hours.
   • BThe monitoring must be approved by the employees' union.
   • CThe monitoring must be performed by an external third party.
   • DThe monitoring must comply with applicable wiretap and privacy laws, and employees must be notified.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational corporation is considering moving its customer database from a data center in the EU to a cloud provider in a country that is not recognized as having adequate data protection. The company has customers in the EU and other regions. Which of the following is the most important factor to consider before the transfer?

   • AThe availability of appropriate safeguards, such as SCCs, and a transfer impact assessment.
   • BThe cloud provider's uptime guarantee.
   • CThe number of customers in the EU.
   • DThe cost of the cloud provider's services.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which scenario best illustrates the concept of legal jurisdiction applying to information systems across geographic boundaries?

   • AA company encrypts all data at rest to protect it from unauthorized access.
   • BA court in Country X issues a subpoena for data stored on servers located in Country Y.
   • CA security team monitors network traffic for anomalies using an intrusion detection system.
   • DAn organization implements multi-factor authentication for all remote access.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company that operates globally wants to use customer data for a new purpose that was not originally disclosed. The company is subject to GDPR and CCPA. What is the most appropriate action to ensure compliance?

   • ANotify customers of the new purpose and allow them to opt out.
   • BObtain new consent from customers for the new purpose.
   • CProceed with the new purpose if the data is anonymized.
   • DRely on the original consent as long as the data is not shared with third parties.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team wants to implement a data loss prevention (DLP) solution that scans outbound email for sensitive data. The company operates in the EU and the US. Employees in the EU have strong privacy protections. What is the most appropriate way to implement DLP while respecting legal limitations?

   • AApply the same DLP policies to all employees globally to ensure consistency.
   • BConfigure DLP policies that comply with the strictest applicable privacy laws, such as GDPR, for all employees.
   • CObtain consent from all employees before implementing DLP.
   • DImplement DLP only for US employees to avoid legal issues in the EU.
   Reveal Solution Discussion Select an answer first