Domain-1

Alyssa is responsible for her organization’s security awareness program. She is concerned that changes in technology may make the content outdated. What control can she put in place to protect against this risk?

• Gamification
• Computer-based training
• Content reviews
• Live training

Gavin is creating a report to management on the results of his most recent risk assessment. In his report, he would like to identify the remaining level of risk to the organization after adopting security controls. What term best describes this current level of risk?

• Inherent risk
• Residual risk
• Control risk
• Mitigated risk

Francine is a security specialist for an online service provider in the United States. She recently received a claim from a copyright holder that a user is storing information on her service that violates the third party’s copyright. What law governs the actions that Francine must take?

• Copyright Act
• Lanham Act
• Digital Millennium Copyright Act
• Gramm Leach Bliley Act

FlyAway Travel has offices in both the European Union (EU) and the United States and transfers personal information between those offices regularly. They have recently received a request from an EU customer requesting that their account be terminated. Under the General Data Protection Regulation (GDPR), which requirement for processing personal information states that individuals may request that their data no longer be disseminated or processed?

• The right to access
• Privacy by design
• The right to be forgotten
• The right of data portability

After conducting a qualitative risk assessment of her organization, Sally recommends purchasing cybersecurity breach insurance. What type of risk response behavior is she Recommending?

• Accept
• Transfer
• Reduce
• Reject

Which one of the following elements of information is not considered personally identifiable information that would trigger most United States (U.S.) state data breach laws?

• Student identification number
• Social Security number
• Driver’s license number
• Credit card number

Renee is speaking to her board of directors about their responsibilities to review cyberse- curity controls. What rule requires that senior executives take personal responsibility for information security matters?

• Due diligence rule
• Personal liability rule
• Prudent man rule
• Due process rule

Henry recently assisted one of his co-workers in preparing for the CISSP exam. During this process, Henry disclosed confidential information about the content of the exam, in violation of Canon IV of the Code of Ethics: “Advance and protect the profession.” Who may bring ethics charges against Henry for this violation?

• Anyone may bring charges.
• Any certified or licensed professional may bring charges.
• Only Henry’s employer may bring charges.
• Only the affected employee may bring charges.

Wanda is working with one of her organization’s European Union business partners to facil- itate the exchange of customer information. Wanda’s organization is located in the United States. What would be the best method for Wanda to use to ensure GDPR compliance?

• Binding corporate rules
• Privacy Shield
• Standard contractual clauses
• Safe harbor

Yolanda is the chief privacy officer for a financial institution and is researching privacy requirements related to customer checking accounts. Which one of the following laws is most likely to apply to this situation?

• GLBA
• SOX
• HIPAA
• FERPA