Law Ethics And Security Compliance Management

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

An information security manager discovers that a penetration tester, hired under a signed contract with a defined scope and rules of engagement, accessed a production database containing customer records that were explicitly excluded from the scope. The tester claims the access was accidental during a pivot. The organization is now deciding whether to pursue legal action. Which legal principle is most relevant in determining the tester's liability?

A security manager is developing an incident response plan that must comply with legal and regulatory requirements for evidence handling. The organization operates in a jurisdiction that follows common law and may need to present digital evidence in court. Which two principles must the manager ensure are followed to maintain the admissibility of digital evidence? (Choose two.)

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

A security manager is building a compliance monitoring capability for a multinational retailer that accepts payment cards and operates in the EU. The legal team wants assurance that the program can demonstrate ongoing adherence to both PCI DSS 4.0 and GDPR. Which approach BEST provides continuous, auditable evidence of compliance across both regimes?

A security manager at a U.S. publicly traded company is preparing for the annual external financial audit. The IT team wants to grant the external auditor temporary access to the ERP system to verify access controls. Which action best satisfies both the audit requirement and security governance principles?

A security manager at a publicly traded US retailer is preparing for the first year of SOX Section 404 IT general controls testing. The external auditor requests evidence that access to the financial reporting database is revoked within 24 hours of an employee's termination. Which control artifact best satisfies the auditor's request?

A security manager discovers that a business unit has been storing customer payment card data in a legacy on-premises application that was never brought into the PCI DSS assessment scope. The business unit argues the data is 'just for reporting.' Which action should the security manager take FIRST?

A security manager discovers that a business unit deployed a customer analytics platform that transfers personal data from the EU to a US-based processor without a valid transfer mechanism. Executive leadership wants to continue the processing. Which action best aligns with GDPR Chapter V obligations?

A security manager is building a compliance monitoring capability for a regulated environment. Which TWO activities are essential to demonstrate that controls remain effective between formal audits? (Choose two.)

During an internal investigation, a security manager learns that an employee copied proprietary source code to personal cloud storage before resigning. Legal counsel requests that the security team preserve evidence without tipping off the former employee. Which action best supports potential civil litigation while maintaining investigative integrity?

A security manager is asked to approve a vendor contract for a cloud service that will process regulated data. The vendor refuses any changes to its standard terms and offers only a self-attestation of security. Which action is most appropriate?

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

During an internal investigation, a security manager learns that an employee may have exfiltrated proprietary source code to a personal cloud account. Legal counsel has issued a litigation hold. Which action should the security manager take to preserve evidence while respecting legal constraints?

A security manager is building a compliance monitoring program for a multinational insurer subject to state breach notification laws, the Gramm-Leach-Bliley Act, and internal audit requirements. Which TWO activities best establish continuous compliance visibility across these obligations? (Choose two.)