ISC Law Ethics And Security Compliance Management — Timed 10 Questions

Question 1

A security manager is conducting a third-party risk assessment using the NIST Cybersecurity Framework. Which tool in the AWS Artifact portal is most appropriate for obtaining the necessary SOC 2 Type II reports to fulfill compliance auditing requirements?

10 minute time limit — choose an answer to begin.

Accepted Answer

AWS Artifact Reports. AWS Artifact provides on-demand access to AWS compliance reports, including SOC 2 Type II, for auditing purposes.

Answer

AWS Trusted Advisor

Answer

AWS Config rules

Answer

AWS Security Hub

Question 2

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

Accepted Answer

Mandatory user acknowledgment signature. A signed acknowledgement of the AUP is necessary to establish legal evidence that the user was aware of the policy expectations.

Answer

Inclusion of the entire ISO 27001 standard

Answer

A list of blocked websites

Answer

Detailed technical specifications of the firewall

Question 3

To ensure adherence to the PCI DSS 4.0 requirement for log integrity, which configuration in a centralized SIEM like Splunk is mandatory to prevent unauthorized modification of audit logs?

Accepted Answer

Implementing WORM (Write Once Read Many) storage. PCI DSS 4.0 requires cryptographic verification or WORM storage for logs to ensure their integrity.

Answer

Utilizing Splunk Heavy Forwarders

Answer

Enabling Splunk Indexer Clustering

Answer

Configuring Role-Based Access Control (RBAC)

Question 4

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Accepted Answer

Microsoft Purview DLP policies. Data Loss Prevention (DLP) policies in Microsoft 365 can be configured to detect PHI patterns and block or encrypt emails accordingly.

Answer

Exchange Online Protection (EOP) malware filtering

Answer

Microsoft Defender for Endpoint

Answer

Retention labels in the Compliance Center

Question 5

A Chief Information Security Officer (CISO) is establishing an ethics program. Which framework provides the most comprehensive international standard for establishing an Information Security Management System (ISMS) encompassing compliance and ethical conduct?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the global standard for ISMS, which inherently includes compliance and governance management.

Answer

COBIT 2019

Answer

ITIL 4

Answer

NIST SP 800-53

Question 6

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

Accepted Answer

Cloud Storage Lifecycle Management rules. Lifecycle management policies in Cloud Storage are the standard way to automate data deletion based on specific conditions to meet privacy regulations.

Answer

Cloud IAM condition policies

Answer

VPC Service Controls

Answer

Data Loss Prevention (DLP) API scan-only mode

Question 7

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides automated assessments against industry standards, including CIS Benchmarks.

Answer

Azure Resource Graph

Answer

Microsoft Purview Data Map

Answer

Azure Network Watcher

Question 8

A multinational organization is deploying an automated compliance monitoring solution across its cloud environments. Which GDPR-related mechanism must the security manager prioritize when configuring data residency policies in Microsoft Purview to ensure automated cross-border transfer controls?

Accepted Answer

Information Protection sensitivity labels. Microsoft Purview's Data Residency controls allow for specific location-based tagging to satisfy GDPR requirements for cross-border data management.

Answer

Azure Policy definitions for Resource Group tagging

Answer

Microsoft Entra ID conditional access policies

Answer

Microsoft Defender for Cloud JIT access

Question 9

A firm must adhere to the EU's Digital Operational Resilience Act (DORA). Which activity is the primary compliance requirement for 'Third-Party Risk Management' under this regulation?

Accepted Answer

Regular threat-led penetration testing of critical third-party services. DORA requires systematic monitoring and testing of the ICT services provided by third parties, including exit strategies.

Answer

Annual user awareness training

Answer

Automated patch management reporting

Answer

Mandatory hardware-based encryption

Question 10

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

Accepted Answer

Defining the compliance scope and regulatory requirements. Identification of regulatory requirements (scope) is the foundation of any compliance program.

Answer

Performing a penetration test

Answer

Auditing existing logs

Answer

Deploying security controls