CISSP CISSP Legal and Compliance 3

Question 1

What is the legal significance of a 'chain of custody' in digital forensics?

Accepted Answer

It documents the unbroken possession and handling of evidence to maintain its admissibility in court

Answer

It ensures evidence is encrypted during storage

Answer

It establishes who is responsible for incident response

Answer

It defines how long digital evidence must be retained

Question 2

Under the Computer Fraud and Abuse Act (CFAA), what element is typically required to establish unauthorized access?

Accepted Answer

Access to a protected computer without authorization or exceeding authorized access

Answer

Evidence of financial gain

Answer

Use of malware or exploit code

Answer

Data exfiltration exceeding $10,000 in value

Question 3

What does 'safe harbor' mean in the context of US-EU data transfers before Privacy Shield was invalidated?

Accepted Answer

A self-certification framework allowing US companies to transfer EU personal data by agreeing to privacy principles

Answer

A physical secure facility for data storage

Answer

An encryption standard approved for cross-border transfers

Answer

A legal immunity provision for accidental data breaches

Question 4

Which type of law in the US allows private citizens to sue for damages when their legal rights are violated?

Accepted Answer

Civil law (tort law)

Answer

Criminal law

Answer

Administrative law

Answer

Regulatory law

Question 5

What compliance framework is mandatory for organizations that process payment card data?

Accepted Answer

PCI DSS

Answer

ISO 27001

Answer

NIST CSF

Answer

SOC 2

Question 6

What is the purpose of a non-disclosure agreement (NDA) in information security?

Accepted Answer

To legally bind parties to keep sensitive information confidential and restrict its disclosure

Answer

To authorize penetration testing activities

Answer

To transfer liability for data breaches to a third party

Answer

To establish data retention requirements for employees