CompTIA Security+ Practice Test of the Day 260408

Question 1

The chief compliance officer at a regional hospital network discovers during a routine review that several departments have been storing patient records on unapproved cloud storage services for over six months. The organization is subject to strict healthcare privacy regulations, and the compliance team must now determine the potential organizational consequences of this prolonged non-compliance. Which consequence of non-compliance is MOST likely to result from the regulatory body's investigation into the unauthorized storage of protected health information?

A. Loss of license B. Fines C. Reputational damage D. Contractual impacts

Question 2

A compliance analyst at an e-commerce company receives a formal request from a customer in the European Union demanding that all personal data associated with their account be permanently removed from the company's systems. The analyst must determine the appropriate privacy principle that governs this type of request and ensure the organization responds in accordance with applicable data protection regulations. Which privacy concept does this customer's request BEST represent?

A. Data inventory and retention B. Ownership C. Right to be forgotten D. Data subject

Question 3

A security operations manager at a logistics company is implementing an automated system that continuously checks endpoint configurations against the organization's security policy baselines, flags deviations, and generates compliance reports without manual intervention. The system is designed to reduce human error and increase the speed at which non-compliant configurations are identified. Which compliance monitoring approach is the manager implementing?

A. Attestation and acknowledgement B. Internal monitoring C. Due diligence D. Automation

Question 4

An IT director at a multinational software company learns that the organization processes personal data of citizens across multiple countries, each with its own data protection legislation. The legal team advises that the company must comply with regulations at the city, state, and country level in each jurisdiction where it operates, and that some of these laws conflict with one another. Which category of privacy legal implications is the legal team primarily concerned about?

A. Global regulations B. National regulations C. Local/regional regulations D. All levels — local/regional, national, and global

Question 5

A data protection officer at an insurance company is mapping out data flows for a new claims processing system. She needs to classify the roles of each entity that interacts with policyholder data: the insurance company decides what data to collect and why, while a third-party claims adjuster processes the data strictly according to the insurance company's instructions. Which term BEST describes the role of the third-party claims adjuster in this data relationship?

A. Data subject B. Controller C. Processor D. Owner

Question 6

A GRC analyst at a defense contractor is preparing for an upcoming external audit. The auditor requires that specific personnel formally sign statements confirming that their departments have implemented all required security controls and that they have reviewed the evidence supporting compliance. This documentation must be collected before the auditor arrives on site. Which compliance monitoring activity is the analyst coordinating?

A. Due diligence/care B. Automation C. Attestation and acknowledgement D. External monitoring

Question 7

An organization's legal department informs the CISO that a recent regulatory change now requires the company to produce a detailed record of every category of personal data it collects, the purpose for each collection, where the data is stored, and the defined retention periods. The CISO must assign a team to build this comprehensive catalog. Which privacy requirement is the legal department directing the CISO to fulfill?

A. Data inventory and retention B. Right to be forgotten C. Controller vs. processor D. Data subject

Question 8

A security engineer at a mid-sized accounting firm is tasked with generating the organization's annual compliance report. The report will be submitted to the firm's board of directors and will document the current state of compliance with internal security policies, control effectiveness, and any identified gaps. This report is not being prepared for a regulator or external agency. Which type of compliance reporting is the engineer producing?

A. External compliance reporting B. Internal compliance reporting C. Due diligence reporting D. Attestation reporting

Question 9

A retail company operating in both the United States and the European Union experiences a data breach affecting customer records. The company's EU-based customers file complaints with their local data protection authority, which launches an investigation. The authority determines that the company failed to implement adequate safeguards and imposes a prohibition on the company's ability to process EU customer data until remediation is complete. Which consequence of non-compliance does this prohibition BEST represent?

A. Fines B. Sanctions C. Reputational damage D. Loss of license

Question 10

A compliance manager at a pharmaceutical company is reviewing the organization's vendor agreements after learning that a third-party laboratory processes clinical trial participant data on the company's behalf. The manager needs to ensure that the contractual terms clearly define which entity determines the purposes of data processing and which entity carries out the processing as directed. Which privacy concept must the compliance manager clarify in the vendor agreement?

A. Ownership B. Data subject C. Controller vs. processor D. Right to be forgotten

CompTIA Security+ Practice Test of the Day 260408

ByThe Test Master

Related Post

CompTIA Security+ Practice Test of the Day 260410

CompTIA Security+ Practice Test of the Day 260409

CompTIA Security+ Practice Test of the Day 260407

Leave a Reply Cancel reply

You missed

CEH v13 Domain 2.2 Practice Test 002

CEH v13 Domain 2.1 Practice Test 002

CEH v13 Domain 1.1 Practice Test 002

CEH v13 Domain 9.1 Practice Test 001