ISC Law Ethics And Security Compliance Management — All Questions With Answers

Question 1mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?

Question 2mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

To ensure adherence to the PCI DSS 4.0 requirement for log integrity, which configuration in a centralized SIEM like Splunk is mandatory to prevent unauthorized modification of audit logs?

Question 3easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A Chief Information Security Officer (CISO) is establishing an ethics program. Which framework provides the most comprehensive international standard for establishing an Information Security Management System (ISMS) encompassing compliance and ethical conduct?

Question 4mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A multinational organization is deploying an automated compliance monitoring solution across its cloud environments. Which GDPR-related mechanism must the security manager prioritize when configuring data residency policies in Microsoft Purview to ensure automated cross-border transfer controls?

Question 5mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A firm must adhere to the EU's Digital Operational Resilience Act (DORA). Which activity is the primary compliance requirement for 'Third-Party Risk Management' under this regulation?

Question 6hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

In an environment governed by SOX (Sarbanes-Oxley), which feature of AWS IAM must be utilized to maintain strict 'Segregation of Duties' for account administrative tasks?

Question 7mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A data controller is managing personal data under GDPR. Which tool within the AWS ecosystem allows the controller to locate and inventory all instances of 'Personal Data' across S3 buckets to support Data Subject Access Requests (DSARs)?

Question 8hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE configurations are necessary to satisfy the 'Technical Safeguards' requirement under HIPAA for data at rest?

Question 9hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A multinational corporation is establishing a security compliance program. The legal team advises that the program must account for the EU's General Data Protection Regulation (GDPR), the U.S. Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry Data Security Standard (PCI DSS). The CISO must prioritize which framework to implement first to address the most severe regulatory penalties and data protection requirements. Which factor should be the primary driver for prioritization?

Question 10easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

Question 11hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Question 12hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

Question 13mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

Question 14easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Question 15hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Question 16easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

Question 17mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

Question 18mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

Question 19hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Question 20easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

Question 21mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Question 22hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Question 23mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Question 24hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Question 25mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Question 26mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Question 27hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Question 28hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Question 29mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

Question 30mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

An information security manager discovers that a penetration tester, hired under a signed contract with a defined scope and rules of engagement, accessed a production database containing customer records that were explicitly excluded from the scope. The tester claims the access was accidental during a pivot. The organization is now deciding whether to pursue legal action. Which legal principle is most relevant in determining the tester's liability?

Question 31easymulti select

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is developing an incident response plan that must comply with legal and regulatory requirements for evidence handling. The organization operates in a jurisdiction that follows common law and may need to present digital evidence in court. Which two principles must the manager ensure are followed to maintain the admissibility of digital evidence? (Choose two.)

Question 32hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

Question 33mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is building a compliance monitoring capability for a multinational retailer that accepts payment cards and operates in the EU. The legal team wants assurance that the program can demonstrate ongoing adherence to both PCI DSS 4.0 and GDPR. Which approach BEST provides continuous, auditable evidence of compliance across both regimes?

Question 34mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager at a U.S. publicly traded company is preparing for the annual external financial audit. The IT team wants to grant the external auditor temporary access to the ERP system to verify access controls. Which action best satisfies both the audit requirement and security governance principles?

Question 35mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager at a publicly traded US retailer is preparing for the first year of SOX Section 404 IT general controls testing. The external auditor requests evidence that access to the financial reporting database is revoked within 24 hours of an employee's termination. Which control artifact best satisfies the auditor's request?

Question 36hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager discovers that a business unit has been storing customer payment card data in a legacy on-premises application that was never brought into the PCI DSS assessment scope. The business unit argues the data is 'just for reporting.' Which action should the security manager take FIRST?

Question 37hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager discovers that a business unit deployed a customer analytics platform that transfers personal data from the EU to a US-based processor without a valid transfer mechanism. Executive leadership wants to continue the processing. Which action best aligns with GDPR Chapter V obligations?

Question 38mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is building a compliance monitoring capability for a regulated environment. Which TWO activities are essential to demonstrate that controls remain effective between formal audits? (Choose two.)

Question 39mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

During an internal investigation, a security manager learns that an employee copied proprietary source code to personal cloud storage before resigning. Legal counsel requests that the security team preserve evidence without tipping off the former employee. Which action best supports potential civil litigation while maintaining investigative integrity?

Question 40easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is asked to approve a vendor contract for a cloud service that will process regulated data. The vendor refuses any changes to its standard terms and offers only a self-attestation of security. Which action is most appropriate?

Question 41easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

Question 42hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

During an internal investigation, a security manager learns that an employee may have exfiltrated proprietary source code to a personal cloud account. Legal counsel has issued a litigation hold. Which action should the security manager take to preserve evidence while respecting legal constraints?

Question 43hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is building a compliance monitoring program for a multinational insurer subject to state breach notification laws, the Gramm-Leach-Bliley Act, and internal audit requirements. Which TWO activities best establish continuous compliance visibility across these obligations? (Choose two.)

Question 1mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?

Question 2mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

To ensure adherence to the PCI DSS 4.0 requirement for log integrity, which configuration in a centralized SIEM like Splunk is mandatory to prevent unauthorized modification of audit logs?

Question 3easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A Chief Information Security Officer (CISO) is establishing an ethics program. Which framework provides the most comprehensive international standard for establishing an Information Security Management System (ISMS) encompassing compliance and ethical conduct?

Question 4mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A multinational organization is deploying an automated compliance monitoring solution across its cloud environments. Which GDPR-related mechanism must the security manager prioritize when configuring data residency policies in Microsoft Purview to ensure automated cross-border transfer controls?

Question 5mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A firm must adhere to the EU's Digital Operational Resilience Act (DORA). Which activity is the primary compliance requirement for 'Third-Party Risk Management' under this regulation?

Question 6hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

In an environment governed by SOX (Sarbanes-Oxley), which feature of AWS IAM must be utilized to maintain strict 'Segregation of Duties' for account administrative tasks?

Question 7mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A data controller is managing personal data under GDPR. Which tool within the AWS ecosystem allows the controller to locate and inventory all instances of 'Personal Data' across S3 buckets to support Data Subject Access Requests (DSARs)?

Question 8hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE configurations are necessary to satisfy the 'Technical Safeguards' requirement under HIPAA for data at rest?

Question 9hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A multinational corporation is establishing a security compliance program. The legal team advises that the program must account for the EU's General Data Protection Regulation (GDPR), the U.S. Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry Data Security Standard (PCI DSS). The CISO must prioritize which framework to implement first to address the most severe regulatory penalties and data protection requirements. Which factor should be the primary driver for prioritization?

Question 10easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

Question 11hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Question 12hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

Question 13mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

Question 14easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Question 15hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Question 16easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

Question 17mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

Question 18mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

Question 19hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Question 20easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

Question 21mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Question 22hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Question 23mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Question 24hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Question 25mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Question 26mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Question 27hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Question 28hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Question 29mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

Question 30mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

An information security manager discovers that a penetration tester, hired under a signed contract with a defined scope and rules of engagement, accessed a production database containing customer records that were explicitly excluded from the scope. The tester claims the access was accidental during a pivot. The organization is now deciding whether to pursue legal action. Which legal principle is most relevant in determining the tester's liability?

Question 31easymulti select

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is developing an incident response plan that must comply with legal and regulatory requirements for evidence handling. The organization operates in a jurisdiction that follows common law and may need to present digital evidence in court. Which two principles must the manager ensure are followed to maintain the admissibility of digital evidence? (Choose two.)

Question 32hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

Question 33mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is building a compliance monitoring capability for a multinational retailer that accepts payment cards and operates in the EU. The legal team wants assurance that the program can demonstrate ongoing adherence to both PCI DSS 4.0 and GDPR. Which approach BEST provides continuous, auditable evidence of compliance across both regimes?

Question 34mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager at a U.S. publicly traded company is preparing for the annual external financial audit. The IT team wants to grant the external auditor temporary access to the ERP system to verify access controls. Which action best satisfies both the audit requirement and security governance principles?

Question 35mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager at a publicly traded US retailer is preparing for the first year of SOX Section 404 IT general controls testing. The external auditor requests evidence that access to the financial reporting database is revoked within 24 hours of an employee's termination. Which control artifact best satisfies the auditor's request?

Question 36hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager discovers that a business unit has been storing customer payment card data in a legacy on-premises application that was never brought into the PCI DSS assessment scope. The business unit argues the data is 'just for reporting.' Which action should the security manager take FIRST?

Question 37hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager discovers that a business unit deployed a customer analytics platform that transfers personal data from the EU to a US-based processor without a valid transfer mechanism. Executive leadership wants to continue the processing. Which action best aligns with GDPR Chapter V obligations?

Question 38mediummulti select

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is building a compliance monitoring capability for a regulated environment. Which TWO activities are essential to demonstrate that controls remain effective between formal audits? (Choose two.)

Question 39mediummultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

During an internal investigation, a security manager learns that an employee copied proprietary source code to personal cloud storage before resigning. Legal counsel requests that the security team preserve evidence without tipping off the former employee. Which action best supports potential civil litigation while maintaining investigative integrity?

Question 40easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is asked to approve a vendor contract for a cloud service that will process regulated data. The vendor refuses any changes to its standard terms and offers only a self-attestation of security. Which action is most appropriate?

Question 41easymultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

Question 42hardmultiple choice

Read the full Law Ethics And Security Compliance Management explanation →

During an internal investigation, a security manager learns that an employee may have exfiltrated proprietary source code to a personal cloud account. Legal counsel has issued a litigation hold. Which action should the security manager take to preserve evidence while respecting legal constraints?

Question 43hardmulti select

Read the full Law Ethics And Security Compliance Management explanation →

A security manager is building a compliance monitoring program for a multinational insurer subject to state breach notification laws, the Gramm-Leach-Bliley Act, and internal audit requirements. Which TWO activities best establish continuous compliance visibility across these obligations? (Choose two.)