ISC Law Ethics And Security Compliance Management Practice Test 2 — 15 Questions

Question 1

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

Accepted Answer

Duty of care / Stewardship. The principle of stewardship and duty of care requires leaders to act in the best interest of the data subject.

Answer

Transparency

Answer

Principle of least privilege

Answer

Separation of duties

Question 2

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

Accepted Answer

Okta Adaptive MFA. Okta's Adaptive Multi-Factor Authentication (MFA) uses risk-based policies to ensure identity assurance.

Answer

Okta Lifecycle Management

Answer

Okta Single Sign-On (SSO)

Answer

Okta Directory Integration

Question 3

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

Accepted Answer

Azure Monitor Diagnostic Settings. Azure Key Vault logs accessed via Azure Monitor and Log Analytics provide the necessary evidence for key management compliance.

Answer

Key Vault Backup

Answer

Key Vault Access Policies

Answer

Azure Active Directory B2C

Question 4

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

Accepted Answer

Pod Security Admission policies. Pod Security Admissions (formerly Pod Security Policies) can explicitly forbid privileged containers to maintain security benchmarks.

Answer

Cluster Autoscaler settings

Answer

Namespace resource quotas

Answer

Kube-proxy configuration

Question 5

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

Accepted Answer

To identify the delta between current state and compliance requirements. A gap analysis identifies the difference between current controls and the required regulatory standard.

Answer

To rewrite the security policy

Answer

To perform a vulnerability scan

Answer

To punish departments for non-compliance

Question 6

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

Accepted Answer

Vertex AI Explainable AI (XAI). Vertex AI Explainable AI provides insights into how models make predictions, satisfying transparency requirements.

Answer

Vertex AI Model Monitoring

Answer

Vertex AI Feature Store

Answer

Vertex AI Pipelines

Question 7

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Accepted Answer

Require Multi-Factor Authentication. Requiring MFA and device compliance is the core component of explicit verification in Zero Trust.

Answer

Require Password Change

Answer

Enable Identity Protection alerts

Answer

Disable legacy authentication

Question 8

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

Accepted Answer

Maintain comprehensive audit logs for all financial system changes. SOX focuses on financial reporting integrity, specifically requiring access controls and audit trails.

Answer

Conduct quarterly physical server room inspections

Answer

Encrypt all data at rest using AES-256

Answer

Ensure all employees receive annual ethics training

Question 9

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Accepted Answer

User-accessible consent management portals. Privacy by design requires technical controls, governance, and user rights management.

Answer

Public internet routing policies

Answer

Hardware security module (HSM) deployment

Question 10

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

Accepted Answer

The potential impact on data subjects if a breach occurs. PIAs must account for the nature of the data and the risks to the data subjects.

Answer

The cost of the cloud storage subscription

Answer

The number of CPU cores required

Answer

The uptime SLA of the provider

Question 11

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

Accepted Answer

Identify (ID) function. The CSF provides structure; 'Govern' and 'Identify' are the pillars for compliance management.

Answer

Recover (RC) function

Answer

Detect (DE) function

Answer

Protect (PR) function

Question 12

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

Accepted Answer

Commitment that the processor only processes data on documented instructions. GDPR Article 28 lists mandatory items for DPAs, including security obligations and rights of the data subject.

Answer

Marketing agreements for joint promotions

Answer

The price list for cloud services

Question 13

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

Accepted Answer

The availability of audit logs for compliance verification. Option B is correct because audit logs provide the evidentiary trail needed to verify that the cloud tool meets regulatory requirements and to support audits, so their availability is a core compliance consideration. Option C is correct because data residency determines where data is stored and processed, which directly affects adherence to laws such as GDPR or other jurisdictional privacy mandates. Option D is correct because the tool must align with the organization's existing security and privacy policies to avoid introducing control gaps or policy violations. Option A is not relevant because marketing budget does not affect regulatory compliance or control effectiveness. Option E is not relevant because a vendor's social media following has no bearing on compliance, security, or privacy obligations.

Answer

The tool's marketing budget

Answer

The number of social media followers of the vendor

Question 14

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

Accepted Answer

A formal documented non-retaliation policy. Whistleblower protection requires anonymity and a non-retaliation policy.

Answer

Automatic termination for all suspected security policy violations

Answer

Mandatory disclosure of employee salaries

Answer

Public posting of all employee disciplinary files

Question 15

An information security manager discovers that a penetration tester, hired under a signed contract with a defined scope and rules of engagement, accessed a production database containing customer records that were explicitly excluded from the scope. The tester claims the access was accidental during a pivot. The organization is now deciding whether to pursue legal action. Which legal principle is most relevant in determining the tester's liability?

Accepted Answer

The tester may be liable under computer misuse laws because access exceeded the defined scope, regardless of intent.. The tester's actions exceeded the contractual scope, which defines the boundaries of authorized access. Computer misuse laws typically penalize access that exceeds authorization, and intent is not always a required element for liability. The organization should assess the specific statute and the tester's conduct, but the unauthorized access to excluded systems is the key factor in determining potential liability.

Answer

The tester is immune from liability because the organization granted initial access to the network, making all subsequent access impliedly authorized.

Answer

The tester is protected by the 'authorized access' defense because a contract existed, even if the specific system was out of scope.

Answer

The tester's liability is determined solely by whether the organization suffered actual financial loss from the access.