CISSP CISSP Legal and Compliance 1 — Questions and Answers
Question 1: Which US federal law established privacy rights and restrictions on the collection of personal data by federal agencies?
- HIPAA
- The Privacy Act of 1974 (Correct answer)
- GLBA
- FERPA
Correct answer: The Privacy Act of 1974
The Privacy Act of 1974 governs how US federal agencies collect, maintain, use, and disseminate personally identifiable information.
Question 2: Under HIPAA, what term describes organizations that handle protected health information on behalf of a covered entity?
- Data processor
- Business associate (Correct answer)
- Sub-contractor
- Data custodian
Correct answer: Business associate
A business associate is a third party that creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered entity.
Question 3: What is the primary goal of the Gramm-Leach-Bliley Act (GLBA) in the context of information security?
- To regulate healthcare data privacy
- To protect the personal financial information of consumers held by financial institutions (Correct answer)
- To establish cybersecurity standards for critical infrastructure
- To mandate breach notification for all US businesses
Correct answer: To protect the personal financial information of consumers held by financial institutions
GLBA requires financial institutions to explain how they share and protect customers' private financial information.
Question 4: Which legal concept determines which country's laws apply when a crime involves actors or systems in multiple jurisdictions?
- Data sovereignty
- Jurisdiction (Correct answer)
- Choice of law
- Extradition
Correct answer: Jurisdiction
Jurisdiction defines the legal authority of a court or government to hear cases and enforce laws, which becomes complex in cross-border cybercrime.
Question 5: What type of law in the US covers crimes committed against computer systems or using computer systems?
- Administrative law
- Civil law
- Computer crime law (e.g., CFAA) (Correct answer)
- Contract law
Correct answer: Computer crime law (e.g., CFAA)
The Computer Fraud and Abuse Act (CFAA) is the primary US federal statute criminalizing unauthorized access to computer systems.
Question 6: Which principle requires organizations to retain data only as long as necessary for its intended purpose?
- Data minimization (Correct answer)
- Data retention
- Data classification
- Data portability
Correct answer: Data minimization
Data minimization limits collection and retention to what is strictly necessary, reducing risk and compliance exposure.
CISSP CISSP Legal and Compliance 1
Which US federal law established privacy rights and restrictions on the collection of personal data by federal agencies?