Law Ethics And Security Compliance Management

Which principle of 'Ethics in Security Leadership' dictates that a manager should prioritize the safety and privacy of the user over organizational convenience?

A company is subject to HIPAA. When configuring Microsoft 365, which feature is critical to ensure that PHI (Protected Health Information) is not accidentally shared via email while meeting 'Minimum Necessary' disclosure standards?

Which TWO actions should a security manager take to ensure an organization remains compliant with the Sarbanes-Oxley (SOX) Act regarding IT controls?

An organization wants to monitor its compliance with CIS Benchmarks automatically. Which tool is best suited to provide an automated 'Compliance Score' against these benchmarks in a multi-cloud environment?

A security manager discovers that a business unit has been storing customer payment card data in a legacy on-premises application that was never brought into the PCI DSS assessment scope. The business unit argues the data is 'just for reporting.' Which action should the security manager take FIRST?

Which THREE items must be included in a 'Data Processing Agreement' (DPA) between a cloud provider and a controller under GDPR?

A company uses Microsoft Entra ID. To comply with the 'Zero Trust' requirement for 'Explicit Verification', which conditional access grant control must be enabled for all administrative access?

Which TWO aspects of the NIST Cybersecurity Framework (CSF) are most relevant when establishing a 'Compliance Program Management' function?

In a Kubernetes cluster, which policy must be configured to ensure that containers are compliant with the CIS Kubernetes Benchmark regarding 'Privileged Containers'?

A security manager is drafting the organization's acceptable use policy and wants to address the ethical expectation that employees report observed security violations. Which statement best reflects a professionally recognized ethical obligation for information security practitioners?

Which THREE components are essential for a robust 'Privacy Program' when implementing data protection by design in an cloud environment?

Which feature in Okta is essential for meeting compliance requirements regarding 'Identity Assurance' and 'Strong Authentication' mandated by financial regulations?

When conducting a compliance audit, what is the purpose of a 'Gap Analysis'?

A US-based company is processing data of German citizens. To comply with the Schrems II ruling, which contractual mechanism must they document in their vendor risk management registry?

Which TWO factors must a security officer consider when performing a 'Privacy Impact Assessment' (PIA) for a new cloud application?

A security manager at a U.S. publicly traded healthcare technology company is notified by a forensic firm that an attacker exfiltrated 40,000 patient records and also altered financial reporting data used for quarterly earnings. The security manager must decide how to sequence regulatory notifications under the HIPAA Breach Notification Rule and the SEC's material cybersecurity incident disclosure rules. Which action BEST aligns with the organization's legal and regulatory obligations?

During an internal investigation, a security manager learns that an employee copied proprietary source code to personal cloud storage before resigning. Legal counsel requests that the security team preserve evidence without tipping off the former employee. Which action best supports potential civil litigation while maintaining investigative integrity?

Which TWO controls should a manager verify to ensure 'Ethics in Security Leadership' is being practiced regarding internal whistleblower protections?

A security manager is developing an incident response plan that must comply with legal and regulatory requirements for evidence handling. The organization operates in a jurisdiction that follows common law and may need to present digital evidence in court. Which two principles must the manager ensure are followed to maintain the admissibility of digital evidence? (Choose two.)

A security manager is building a compliance monitoring program for a multinational insurer subject to state breach notification laws, the Gramm-Leach-Bliley Act, and internal audit requirements. Which TWO activities best establish continuous compliance visibility across these obligations? (Choose two.)

A security manager at a U.S. publicly traded company is preparing for the annual external financial audit. The IT team wants to grant the external auditor temporary access to the ERP system to verify access controls. Which action best satisfies both the audit requirement and security governance principles?

A security manager is asked to approve a vendor contract for a cloud service that will process regulated data. The vendor refuses any changes to its standard terms and offers only a self-attestation of security. Which action is most appropriate?

For an organization to maintain compliance with the GLBA (Gramm-Leach-Bliley Act), which mechanism within Azure Key Vault is required to demonstrate evidence of 'Key Rotation' and 'Access History'?

An organization must comply with CCPA/CPRA requirements regarding 'Right to Delete'. In a hybrid environment utilizing Google Cloud Platform, which mechanism is best suited for implementing automated lifecycle policies to satisfy deletion requests across Cloud Storage buckets?

During an internal investigation, a security manager learns that an employee may have exfiltrated proprietary source code to a personal cloud account. Legal counsel has issued a litigation hold. Which action should the security manager take to preserve evidence while respecting legal constraints?

A security manager discovers that a business unit deployed a customer analytics platform that transfers personal data from the EU to a US-based processor without a valid transfer mechanism. Executive leadership wants to continue the processing. Which action best aligns with GDPR Chapter V obligations?

A security manager at a publicly traded US retailer is preparing for the first year of SOX Section 404 IT general controls testing. The external auditor requests evidence that access to the financial reporting database is revoked within 24 hours of an employee's termination. Which control artifact best satisfies the auditor's request?

Which THREE factors must be considered during the 'Compliance Program Management' phase when evaluating whether to adopt a new cloud-based tool?

An information security manager discovers that a penetration tester, hired under a signed contract with a defined scope and rules of engagement, accessed a production database containing customer records that were explicitly excluded from the scope. The tester claims the access was accidental during a pivot. The organization is now deciding whether to pursue legal action. Which legal principle is most relevant in determining the tester's liability?

When drafting an organizational 'Acceptable Use Policy' (AUP), which element is most critical to ensure legal enforceability in a professional environment?

When managing a compliance program, what is the first step in the 'Continuous Compliance' lifecycle?

To comply with the 'Right to Explanation' under certain AI regulations, which feature in Google Vertex AI is used to provide transparency into model decision-making?

A security manager is building a compliance monitoring capability for a regulated environment. Which TWO activities are essential to demonstrate that controls remain effective between formal audits? (Choose two.)

A security manager is building a compliance monitoring capability for a multinational retailer that accepts payment cards and operates in the EU. The legal team wants assurance that the program can demonstrate ongoing adherence to both PCI DSS 4.0 and GDPR. Which approach BEST provides continuous, auditable evidence of compliance across both regimes?