Question 20 A vendor stores regulated personal data yet its contract contains no audit or breach-notification terms. What should procurement require? Negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding Obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards Engage counsel to reconcile jurisdiction, preservation duties and lawful disclosure before transfer Map each record type to applicable legal duties, business purpose and defensible deletion timelines Explanation Correct Answer A:Contractual controls clarify accountability and support compliance when data processing is delegated. Incorrect Answers B:Cross-border processing obligations depend on data subjects, jurisdictions and contractual arrangements; it is relevant where a payroll service will replicate employee identifiers into a foreign jurisdiction, whereas the current facts require negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding to address the stated problem. C:This option fits a different fact pattern where investigators in two countries demand the same cloud records under conflicting orders: a technical team cannot resolve conflicting legal obligations by releasing records to whichever party asks first; the current case instead requires negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding. D:This option fits a different fact pattern where the organization is developing a retention schedule for customer requests in multiple regions: one arbitrary global period can violate both minimum-retention and data-minimization requirements; the current case instead requires negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding.
Question 21 The organization is developing a retention schedule for customer requests in multiple regions. What should drive the schedule? Inventory components and have legal and engineering review license and export-control obligations Perform a jurisdiction-specific obligations and gap assessment alongside certifications Obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards Map each record type to applicable legal duties, business purpose and defensible deletion timelines Explanation Correct Answer D:One arbitrary global period can violate both minimum-retention and data-minimization requirements. Incorrect Answers A:This option fits a different fact pattern where a product includes third-party encryption libraries with unknown redistributable licenses: software licensing and cryptographic export restrictions require evidence-based review before distribution; the current case instead requires map each record type to applicable legal duties, business purpose and defensible deletion timelines. B:For the separate situation in which a manager assumes a security certification automatically satisfies every country's privacy law, framework certification is useful evidence, not a substitute for statutory compliance analysis; here the stated problem requires map each record type to applicable legal duties, business purpose and defensible deletion timelines. C:The other scenario states that a payroll service will replicate employee identifiers into a foreign jurisdiction, where cross-border processing obligations depend on data subjects, jurisdictions and contractual arrangements; by contrast, the present case requires map each record type to applicable legal duties, business purpose and defensible deletion timelines.
Question 22 A manager assumes a security certification automatically satisfies every country's privacy law. What is the correct governance response? Negotiate appropriate privacy, security assurance, notification and audit obligations before onboarding Map each record type to applicable legal duties, business purpose and defensible deletion timelines Obtain privacy and legal assessment of lawful transfer basis, locality and applicable safeguards Perform a jurisdiction-specific obligations and gap assessment alongside certifications Explanation Correct Answer D:Framework certification is useful evidence, not a substitute for statutory compliance analysis. Incorrect Answers A:The other scenario states that a vendor stores regulated personal data yet its contract contains no audit or breach-notification terms, where contractual controls clarify accountability and support compliance when data processing is delegated; by contrast, the present case requires perform a jurisdiction-specific obligations and gap assessment alongside certifications. B:The other scenario states that the organization is developing a retention schedule for customer requests in multiple regions, where one arbitrary global period can violate both minimum-retention and data-minimization requirements; by contrast, the present case requires perform a jurisdiction-specific obligations and gap assessment alongside certifications. C:Cross-border processing obligations depend on data subjects, jurisdictions and contractual arrangements; it is relevant where a payroll service will replicate employee identifiers into a foreign jurisdiction, whereas the current facts require perform a jurisdiction-specific obligations and gap assessment alongside certifications to address the stated problem.
Question 23 Human resources suspects an employee violated an internal device policy without any alleged crime. Which process should initiate? Conduct an authorized administrative investigation consistent with employment policy and privacy constraints Escalate to designated investigators and preserve artifacts without exceeding delegated investigative authority Preserve original evidence and document requests through legal counsel and chain-of-custody processes Coordinate preservation and production with legal and compliance teams under the applicable authority Explanation Correct Answer A:Internal policy findings require appropriate authority and due process, not an automatic criminal evidence seizure. Incorrect Answers B:Investigation type and authority determine who may collect, question, or disclose evidence; it is relevant where a security analyst finds signs of theft but is not authorized to interrogate suspects, whereas the current facts require conduct an authorized administrative investigation consistent with employment policy and privacy constraints to address the stated problem. C:Editing collected records can undermine authenticity, admissibility and the investigative record; although this helps when law enforcement asks the SOC to alter server logs after collecting them, it leaves the current case's need to conduct an authorized administrative investigation consistent with employment policy and privacy constraints unresolved. D:Regulatory requests have distinct legal scope and evidence-retention requirements; although this helps when a regulator requests records relating to an ongoing investigation, it leaves the current case's need to conduct an authorized administrative investigation consistent with employment policy and privacy constraints unresolved.
Question 24 Law enforcement asks the SOC to alter server logs after collecting them. What should the SOC do? Coordinate preservation and production with legal and compliance teams under the applicable authority Suspend conflicting deletion schedules for in-scope evidence and preserve collection provenance Conduct an authorized administrative investigation consistent with employment policy and privacy constraints Preserve original evidence and document requests through legal counsel and chain-of-custody processes Explanation Correct Answer D:Editing collected records can undermine authenticity, admissibility and the investigative record. Incorrect Answers A:Regulatory requests have distinct legal scope and evidence-retention requirements; it is relevant where a regulator requests records relating to an ongoing investigation, whereas the current facts require preserve original evidence and document requests through legal counsel and chain-of-custody processes to address the stated problem. B:The other scenario states that a civil litigant serves a litigation hold covering archived messages, where a valid hold overrides routine disposal for specified material and requires defensible traceability; by contrast, the present case requires preserve original evidence and document requests through legal counsel and chain-of-custody processes. C:Internal policy findings require appropriate authority and due process, not an automatic criminal evidence seizure; it is relevant where human resources suspects an employee violated an internal device policy without any alleged crime, whereas the current facts require preserve original evidence and document requests through legal counsel and chain-of-custody processes to address the stated problem.
Question 25 A regulator requests records relating to an ongoing investigation. How should security handle scope and retention? Escalate to designated investigators and preserve artifacts without exceeding delegated investigative authority Suspend conflicting deletion schedules for in-scope evidence and preserve collection provenance Coordinate preservation and production with legal and compliance teams under the applicable authority Conduct an authorized administrative investigation consistent with employment policy and privacy constraints Explanation Correct Answer C:Regulatory requests have distinct legal scope and evidence-retention requirements. Incorrect Answers A:The other scenario states that a security analyst finds signs of theft but is not authorized to interrogate suspects, where investigation type and authority determine who may collect, question, or disclose evidence; by contrast, the present case requires coordinate preservation and production with legal and compliance teams under the applicable authority. B:A valid hold overrides routine disposal for specified material and requires defensible traceability; although this helps when a civil litigant serves a litigation hold covering archived messages, it leaves the current case's need to coordinate preservation and production with legal and compliance teams under the applicable authority unresolved. D:For the separate situation in which human resources suspects an employee violated an internal device policy without any alleged crime, internal policy findings require appropriate authority and due process, not an automatic criminal evidence seizure; here the stated problem requires coordinate preservation and production with legal and compliance teams under the applicable authority.
Question 26 A civil litigant serves a litigation hold covering archived messages. What is the priority operational action? Suspend conflicting deletion schedules for in-scope evidence and preserve collection provenance Preserve original evidence and document requests through legal counsel and chain-of-custody processes Conduct an authorized administrative investigation consistent with employment policy and privacy constraints Escalate to designated investigators and preserve artifacts without exceeding delegated investigative authority Explanation Correct Answer A:A valid hold overrides routine disposal for specified material and requires defensible traceability. Incorrect Answers B:Editing collected records can undermine authenticity, admissibility and the investigative record; although this helps when law enforcement asks the SOC to alter server logs after collecting them, it leaves the current case's need to suspend conflicting deletion schedules for in-scope evidence and preserve collection provenance unresolved. C:Internal policy findings require appropriate authority and due process, not an automatic criminal evidence seizure; this responds to the different circumstance in which human resources suspects an employee violated an internal device policy without any alleged crime, while the current case states that a civil litigant serves a litigation hold covering archived messages, calling for suspend conflicting deletion schedules for in-scope evidence and preserve collection provenance. D:Investigation type and authority determine who may collect, question, or disclose evidence; this responds to the different circumstance in which a security analyst finds signs of theft but is not authorized to interrogate suspects, while the current case states that a civil litigant serves a litigation hold covering archived messages, calling for suspend conflicting deletion schedules for in-scope evidence and preserve collection provenance.
Question 27 A security analyst finds signs of theft but is not authorized to interrogate suspects. Which boundary matters? Preserve original evidence and document requests through legal counsel and chain-of-custody processes Coordinate preservation and production with legal and compliance teams under the applicable authority Escalate to designated investigators and preserve artifacts without exceeding delegated investigative authority Suspend conflicting deletion schedules for in-scope evidence and preserve collection provenance Explanation Correct Answer C:Investigation type and authority determine who may collect, question, or disclose evidence. Incorrect Answers A:The other scenario states that law enforcement asks the SOC to alter server logs after collecting them, where editing collected records can undermine authenticity, admissibility and the investigative record; by contrast, the present case requires escalate to designated investigators and preserve artifacts without exceeding delegated investigative authority. B:The other scenario states that a regulator requests records relating to an ongoing investigation, where regulatory requests have distinct legal scope and evidence-retention requirements; by contrast, the present case requires escalate to designated investigators and preserve artifacts without exceeding delegated investigative authority. D:For the separate situation in which a civil litigant serves a litigation hold covering archived messages, a valid hold overrides routine disposal for specified material and requires defensible traceability; here the stated problem requires escalate to designated investigators and preserve artifacts without exceeding delegated investigative authority.
Question 28 A policy says privileged access requires approval, but teams each interpret approval differently. What should be added? Publish an operational hardening procedure with ordered steps, owners and rollback checks Document a time-bounded risk exception with compensating controls and authorized approval Issue enforceable access standards specifying the mandatory approver and validation criteria Assign document ownership, periodic review and version-controlled approval Explanation Correct Answer C:Standards translate policy intent into measurable requirements; an informal guideline lacks this force. Incorrect Answers A:Procedures explain repeatable execution of a standard rather than only stating a governing principle; it is relevant where an administrator cannot repeat server hardening consistently across sites, whereas the current facts require issue enforceable access standards specifying the mandatory approver and validation criteria to address the stated problem. B:Exceptions preserve governance visibility; quietly ignoring a standard creates unowned residual risk; it is relevant where a policy document mandates a control that is technically impossible for one supported legacy device, whereas the current facts require issue enforceable access standards specifying the mandatory approver and validation criteria to address the stated problem. D:Policies become stale unless accountable owners revalidate requirements and communicate revisions; although this helps when a company has no formal owner to review access policy as its services change, it leaves the current case's need to issue enforceable access standards specifying the mandatory approver and validation criteria unresolved.
Question 29 An administrator cannot repeat server hardening consistently across sites. Which documentation is missing? Assign document ownership, periodic review and version-controlled approval Separate mandatory policies and standards from advisory implementation guidelines Publish an operational hardening procedure with ordered steps, owners and rollback checks Document a time-bounded risk exception with compensating controls and authorized approval Explanation Correct Answer C:Procedures explain repeatable execution of a standard rather than only stating a governing principle. Incorrect Answers A:Policies become stale unless accountable owners revalidate requirements and communicate revisions; this responds to the different circumstance in which a company has no formal owner to review access policy as its services change, while the current case states that an administrator cannot repeat server hardening consistently across sites, calling for publish an operational hardening procedure with ordered steps, owners and rollback checks. B:For the separate situation in which employees confuse optional advice with required security rules, distinct document authority makes compliance requirements and recommended methods unambiguous; here the stated problem requires publish an operational hardening procedure with ordered steps, owners and rollback checks. D:Exceptions preserve governance visibility; quietly ignoring a standard creates unowned residual risk; although this helps when a policy document mandates a control that is technically impossible for one supported legacy device, it leaves the current case's need to publish an operational hardening procedure with ordered steps, owners and rollback checks unresolved.
Question 30 A policy document mandates a control that is technically impossible for one supported legacy device. What is the right exception route? Publish an operational hardening procedure with ordered steps, owners and rollback checks Separate mandatory policies and standards from advisory implementation guidelines Document a time-bounded risk exception with compensating controls and authorized approval Issue enforceable access standards specifying the mandatory approver and validation criteria Explanation Correct Answer C:Exceptions preserve governance visibility; quietly ignoring a standard creates unowned residual risk. Incorrect Answers A:For the separate situation in which an administrator cannot repeat server hardening consistently across sites, procedures explain repeatable execution of a standard rather than only stating a governing principle; here the stated problem requires document a time-bounded risk exception with compensating controls and authorized approval. B:Distinct document authority makes compliance requirements and recommended methods unambiguous; this responds to the different circumstance in which employees confuse optional advice with required security rules, while the current case states that a policy document mandates a control that is technically impossible for one supported legacy device, calling for document a time-bounded risk exception with compensating controls and authorized approval. D:Standards translate policy intent into measurable requirements; an informal guideline lacks this force; although this helps when a policy says privileged access requires approval, but teams each interpret approval differently, it leaves the current case's need to document a time-bounded risk exception with compensating controls and authorized approval unresolved.
