SDI Regulatory Compliance & Legal Framework 3

Question 1

A service desk team in the US handles calls for EU residents. Which regulation most directly governs how personal data about those EU callers must be handled?

Accepted Answer

GDPR

Answer

GDPR has extraterritorial reach and applies to processing of personal data of EU residents regardless of where the processing organization is located.

Question 2

Under software asset management (SAM) best practices, what is the primary legal risk of deploying more software licenses than purchased?

Accepted Answer

Vendor audit findings leading to back-payments and penalties

Answer

Under-licensing exposes organizations to vendor audits that can result in significant back-payments for unpaid licenses plus contractual penalties.

Question 3

Which framework provides a set of controls specifically designed to protect information security and is frequently referenced in compliance audits alongside ISO 20000?

Accepted Answer

ISO/IEC 27001

Answer

ISO/IEC 27001 defines requirements for an information security management system (ISMS) and is commonly audited in parallel with ISO 20000 for IT service management compliance.

Question 4

FERPA primarily restricts the disclosure of educational records and applies directly to service desks operating in which sector?

Accepted Answer

Higher education institutions

Answer

FERPA (Family Educational Rights and Privacy Act) protects student educational records and applies to schools, colleges, and universities that receive federal funding.

Question 5

A service desk outsources ticket processing to a third-party vendor in another country. Under GDPR, this vendor is classified as a:

Accepted Answer

Data processor

Answer

A third party that processes personal data on behalf of and under instruction from another organization is a data processor under GDPR.

(SDI) Service Desk Institute Certifications Practice Test

(SDI) Service Desk Institute Certifications Practice Test

SDI Regulatory Compliance & Legal Framework 3