A global company with headquarters in the EU and a data center in a country with restrictive data localization laws wants to offer a cloud service to customers in that country. The service requires processing personal data. Which approach best balances legal compliance and operational efficiency?

Anonymize all personal data before processing to avoid localization requirements.

Use a cloud provider in a neighboring country that has a data-sharing agreement.

Process all data in the EU and transfer results to the restrictive country.

Establish a local data center in the restrictive country to process data locally.

A security analyst in a multinational company discovers that a data breach affected customers in several countries. The company's headquarters is in Country A, but the affected data is stored on servers in Country B. Which factor most directly determines which country's legal jurisdiction applies to the breach investigation?

The language used in the company's privacy policy

The physical location of the servers storing the data

The nationality of the company's CEO

The location of the company's headquarters

A company with operations in the EU and Asia is subject to a court order from a country in Asia to produce customer data stored in the EU. The company believes the order conflicts with GDPR. What is the most appropriate action?

Transfer the data to a third country that has an adequacy decision.

Refuse to comply with the court order because GDPR prohibits all transfers.

Seek legal advice and, if necessary, challenge the order through legal channels while considering GDPR obligations.

Comply with the court order immediately to avoid legal penalties.

What is the primary legal concern when transferring data across international borders?

Ensuring the data is encrypted during transit

Complying with the data protection laws of both the exporting and importing countries

Obtaining permission from the receiving country's government

Ensuring the data is stored on servers owned by the company

An organization is subject to the General Data Protection Regulation (GDPR). During a security incident involving personal data, which compliance requirement must the organization fulfill?

Notify the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals.

Publish the breach details on the company's website.

Notify all affected individuals within 24 hours.

Report the incident to the local police immediately.

Systems Security Certified Practitioner

Domain 3Objective 2

3.2 - Understand Legal and Regulatory Concerns (e.g., Jurisdiction, Limitations, Privacy) SSCP Practice Questions (Page 4)

Part of the Risk Identification, Monitoring and Analysis domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

15%of the exam

Questions 16–20

16expert · hard
A global company with headquarters in the EU and a data center in a country with restrictive data localization laws wants to offer a cloud service to customers in that country. The service requires processing personal data. Which approach best balances legal compliance and operational efficiency?
Select an answer first
17foundation · easy
A security analyst in a multinational company discovers that a data breach affected customers in several countries. The company's headquarters is in Country A, but the affected data is stored on servers in Country B. Which factor most directly determines which country's legal jurisdiction applies to the breach investigation?
Select an answer first
18expert · hard
A company with operations in the EU and Asia is subject to a court order from a country in Asia to produce customer data stored in the EU. The company believes the order conflicts with GDPR. What is the most appropriate action?
Select an answer first
19foundation · easy
What is the primary legal concern when transferring data across international borders?
Select an answer first
20foundation · easy
An organization is subject to the General Data Protection Regulation (GDPR). During a security incident involving personal data, which compliance requirement must the organization fulfill?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.