ISC Law Ethics And Security Compliance Management — 15 Questions

Question 1

A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Artifact Reports. AWS Artifact provides on-demand access to AWS compliance reports, including SOC 2 Type II, for auditing purposes.

Answer

AWS Trusted Advisor

Answer

AWS Config rules

Answer

AWS Security Hub

Question 2

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

Accepted Answer

Mandatory user acknowledgment signature. A signed acknowledgement of the AUP is necessary to establish legal evidence that the user was aware of the policy expectations.

Answer

Inclusion of the entire ISO 27001 standard

Answer

A list of blocked websites

Answer

Detailed technical specifications of the firewall

Question 3

To ensure adherence to the PCI DSS 4.0 requirement for log integrity, which configuration in a centralized SIEM like Splunk is mandatory to prevent unauthorized modification of audit logs?

Accepted Answer

Implementing WORM (Write Once Read Many) storage. PCI DSS 4.0 requires cryptographic verification or WORM storage for logs to ensure their integrity.

Answer

Utilizing Splunk Heavy Forwarders

Answer

Enabling Splunk Indexer Clustering

Answer

Configuring Role-Based Access Control (RBAC)

Question 4

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Accepted Answer

Microsoft Purview DLP policies. Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.

Answer

Exchange Online Protection (EOP) malware filtering

Answer

Microsoft Defender for Endpoint

Answer

Retention labels in the Compliance Center

Question 5

A Chief Information Security Officer (CISO) is establishing an ethics program. Which framework provides the most comprehensive international standard for establishing an Information Security Management System (ISMS) encompassing compliance and ethical conduct?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the global standard for ISMS, which inherently includes compliance and governance management.

Answer

COBIT 2019

Answer

ITIL 4

Answer

NIST SP 800-53

Question 6

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

Accepted Answer

Cloud Storage Lifecycle Management rules. Lifecycle management policies in Cloud Storage are the standard way to automate data deletion based on specific conditions to meet privacy regulations.

Answer

Cloud IAM condition policies

Answer

VPC Service Controls

Answer

Data Loss Prevention (DLP) API scan-only mode

Question 7

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides automated assessments against industry standards, including CIS Benchmarks.

Answer

Azure Resource Graph

Answer

Microsoft Purview Data Map

Answer

Azure Network Watcher

Question 8

A multinational organization is deploying an automated compliance monitoring solution across its cloud environments. Which GDPR-related mechanism must the security manager prioritize when configuring data residency policies in Microsoft Purview to ensure automated cross-border transfer controls?

Accepted Answer

Information Protection sensitivity labels. Microsoft Purview's Data Residency controls allow for specific location-based tagging to satisfy GDPR requirements for cross-border data management.

Answer

Azure Policy definitions for Resource Group tagging

Answer

Microsoft Entra ID conditional access policies

Answer

Microsoft Defender for Cloud JIT access

Question 9

A firm must adhere to the EU's Digital Operational Resilience Act (DORA). Which activity is the primary compliance requirement for 'Third-Party Risk Management' under this regulation?

Accepted Answer

Regular threat-led penetration testing of critical third-party services. DORA requires systematic monitoring and testing of the ICT services provided by third parties, including exit strategies.

Answer

Annual user awareness training

Answer

Automated patch management reporting

Answer

Mandatory hardware-based encryption

Question 10

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Accepted Answer

Defining the compliance scope and regulatory requirements. Identification of regulatory requirements (scope) is the foundation of any compliance program.

Answer

Performing a penetration test

Answer

Auditing existing logs

Answer

Deploying security controls

Question 11

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Accepted Answer

Data Processing Addendum (DPA) with SCCs. Standard Contractual Clauses (SCCs) are the primary legal mechanism required for the transfer of data from the EEA to third countries post-Schrems II.

Answer

An annual security audit report

Answer

A signed Non-Disclosure Agreement (NDA)

Answer

A simple Certificate of Origin

Question 12

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

Accepted Answer

Duty of care / Stewardship. The principle of stewardship and duty of care requires leaders to act in the best interest of the data subject.

Answer

Transparency

Answer

Principle of least privilege

Answer

Separation of duties

Question 13

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

Accepted Answer

Okta Adaptive MFA. Okta's Adaptive Multi-Factor Authentication (MFA) uses risk-based policies to ensure identity assurance.

Answer

Okta Lifecycle Management

Answer

Okta Single Sign-On (SSO)

Answer

Okta Directory Integration

Question 14

In an environment governed by SOX (Sarbanes-Oxley), which feature of AWS IAM must be utilized to maintain strict 'Segregation of Duties' for account administrative tasks?

Accepted Answer

AWS IAM Roles with Service Control Policies (SCPs). IAM Policies with explicit denies or restricted permission sets (like Service Control Policies) enforce segregation of duties in AWS.

Answer

AWS CloudTrail insights

Answer

IAM User Access Keys

Answer

AWS Directory Service

Question 15

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

Accepted Answer

Azure Monitor Diagnostic Settings. Azure Key Vault logs accessed via Azure Monitor and Log Analytics provide the necessary evidence for key management compliance.

Answer

Key Vault Backup

Answer

Key Vault Access Policies

Answer

Azure Active Directory B2C