Which action is an example of a legal limitation on data handling in security operations?

Retaining security logs for a period specified by law or regulation.

Deleting personal data after the purpose for which it was collected has been fulfilled.

Encrypting data in transit to prevent interception.

Sharing incident data with law enforcement only when legally compelled or permitted.

A retail company wants to analyze customer purchase history to improve marketing. They have collected more data than needed, including social security numbers, which are not necessary for marketing. What is the most appropriate action to align with data protection principles?

Delete the social security numbers and keep only the data necessary for marketing.

Retain the social security numbers in case they are needed in the future.

Anonymize the social security numbers and keep them for analysis.

Encrypt the social security numbers and continue to store them.

A company based in the United States transfers personal data of European Union customers to a data processor in a country that the European Commission has not deemed to have adequate data protection laws. Which legal mechanism could the company use to lawfully transfer this data?

Verbal consent from the data subjects

A simple data processing agreement

Standard contractual clauses (SCCs)

The company's internal privacy policy

A company wants to implement a new customer relationship management (CRM) system that will store customer data. The company is subject to GDPR and wants to minimize privacy risks. Which approach best aligns with data protection by design and by default?

Collect as much data as possible to enable future marketing opportunities.

Set privacy settings to the least restrictive to improve user experience.

Collect only the data necessary for the CRM's purpose and set privacy settings to the most restrictive by default.

Collect data without consent and rely on legitimate interest.

Systems Security Certified Practitioner

Domain 3Objective 2

3.2 - Understand Legal and Regulatory Concerns (e.g., Jurisdiction, Limitations, Privacy) SSCP Practice Questions (Page 3)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

15%of the exam

Questions 11–15

11foundation · easy
Which action is an example of a legal limitation on data handling in security operations?
Select an answer first
12application · medium
A retail company wants to analyze customer purchase history to improve marketing. They have collected more data than needed, including social security numbers, which are not necessary for marketing. What is the most appropriate action to align with data protection principles?
Select an answer first
13application · medium
A hospital in the United States is implementing a new patient portal that allows patients to access their medical records online. Which privacy law is most directly applicable to the protection of this data?
Select an answer first
14foundation · easy
A company based in the United States transfers personal data of European Union customers to a data processor in a country that the European Commission has not deemed to have adequate data protection laws. Which legal mechanism could the company use to lawfully transfer this data?
Select an answer first
15expert · hard
A company wants to implement a new customer relationship management (CRM) system that will store customer data. The company is subject to GDPR and wants to minimize privacy risks. Which approach best aligns with data protection by design and by default?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.