I85PREP
⌘ K
C CLE study materials
C CLE study resources

C CLE practice questions

One question at a time. Build your C CLE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity Law and Legal Fundamentals

Under the Computer Fraud and Abuse Act, which action most directly triggers federal criminal liability for an outsider who has no authorized access to a protected computer?

  1. Purchasing a laptop that was manufactured outside the United States
  2. Intentionally accessing a protected computer without authorization and thereby obtaining information from it Correct answer.
  3. Installing a firewall on a home network to block inbound traffic
  4. Reading a publicly posted privacy policy on a company website

Explanation

The CFAA criminalizes intentional access to a protected computer without authorization, and obtaining information is one of the enumerated statutory effects that elevates the conduct. Merely reading public content or configuring one's own equipment does not involve unauthorized access to another's protected system.

Question 2Cybersecurity Law and Legal Fundamentals

A hospital employee uses credentials issued for billing work to open patient treatment records out of curiosity. Which legal theory best fits this conduct?

  1. Copyright infringement of the records database
  2. Exceeding authorized access under computer misuse law Correct answer.
  3. Breach of a software license by the hospital
  4. Trespass to chattels against the server vendor

Explanation

Authorization limited to billing purposes does not extend to treatment records, so using valid credentials for an unrelated purpose is the classic exceeding-authorized-access theory. The other theories address property, contract, or copyright interests rather than the scope of system permission.

Question 3Cybersecurity Law and Legal Fundamentals

Which statute is the primary federal law governing unauthorized access to computers and the obtaining of protected information from them?

  1. The Stored Communications Act
  2. The Computer Fraud and Abuse Act Correct answer.
  3. The Electronic Communications Privacy Act's Wiretap provisions
  4. The Digital Millennium Copyright Act

Explanation

The CFAA is the core federal computer-crime statute addressing unauthorized access and related conduct. The SCA and wiretap provisions regulate interception and disclosure of communications, and the DMCA addresses circumvention of technological protection measures.

Question 4Cybersecurity Law and Legal Fundamentals

An investigator wants to obtain a suspect's stored email from a provider. Which legal instrument is generally required under the Stored Communications Act for content less than 180 days old?

  1. An administrative subpoena
  2. A warrant supported by probable cause Correct answer.
  3. A civil discovery request
  4. A national security letter

Explanation

For stored content held 180 days or less, the SCA requires a warrant based on probable cause. Subpoenas and national security letters reach certain non-content records or older content under specified conditions, and civil discovery does not bind a third-party provider in a criminal matter.

Question 5Cybersecurity Law and Legal Fundamentals

A company's security team monitors employee keystrokes on company-owned laptops after issuing a clear written notice and obtaining signed consent. Which principle most supports the lawfulness of this monitoring?

  1. The business judgment rule
  2. The plain view doctrine
  3. Notice and consent within the employment relationship Correct answer.
  4. The third-party doctrine

Explanation

Clear notice plus consent, especially regarding employer-owned equipment, generally defeats a reasonable expectation of privacy in the monitored activity. The third-party doctrine concerns information voluntarily shared with third parties, and plain view concerns observations by government agents.

Question 6Cybersecurity Law and Legal Fundamentals

Which federal statute imposes obligations on financial institutions to safeguard customer information and respond to data security incidents?

  1. The Fair Credit Reporting Act
  2. The Family Educational Rights and Privacy Act
  3. The Gramm-Leach-Bliley Act Correct answer.
  4. The Health Insurance Portability and Accountability Act

Explanation

GLBA governs privacy and safeguarding of nonpublic personal information held by financial institutions. HIPAA covers health information, FERPA covers education records, and FCRA regulates consumer reporting.

Question 7Cybersecurity Law and Legal Fundamentals

A retailer suffers a breach exposing customer payment card data. Which industry framework most directly governs the retailer's handling of cardholder data?

  1. ISO/IEC 27001
  2. PCI DSS Correct answer.
  3. SOC 2
  4. NIST Cybersecurity Framework

Explanation

PCI DSS is the contractual industry standard that applies to entities that store, process, or transmit payment card data. The other frameworks are voluntary or assurance-based and do not specifically govern cardholder data handling.

Question 8Cybersecurity Law and Legal Fundamentals

Which concept describes the legal obligation of an organization to protect personal data it collects even absent a specific statutory command?

  1. Reasonable security Correct answer.
  2. Strict liability
  3. Absolute warranty
  4. Res ipsa loquitur

Explanation

Many jurisdictions and enforcement actions, such as FTC unfairness authority, impose a duty to maintain reasonable security commensurate with the sensitivity of the data. Strict liability and warranties are different doctrinal categories that do not describe this data-protection duty.

Question 9Cybersecurity Law and Legal Fundamentals

A state enacts a law requiring businesses to notify residents of a breach of their personal information. Which characteristic is typical of these breach notification statutes?

  1. Notification is required only after a criminal conviction
  2. Notification applies only to paper records
  3. Notification must always be made to the media first
  4. Notification is triggered by unauthorized acquisition of specified data elements Correct answer.

Explanation

Breach notification laws typically trigger on unauthorized acquisition of defined personal information such as name plus a sensitive identifier. They do not require a prior conviction, are not limited to paper, and generally direct notice to affected individuals and regulators.

Question 10Cybersecurity Law and Legal Fundamentals

Which data protection role under the GDPR describes an entity that determines the purposes and means of processing personal data?

  1. Processor
  2. Controller Correct answer.
  3. Supervisory authority
  4. Data subject

Explanation

The controller decides why and how personal data is processed, while a processor acts on the controller's instructions. The supervisory authority regulates, and the data subject is the individual whose data is processed.

Question 11Cybersecurity Law and Legal Fundamentals

A company transfers EU personal data to a US vendor relying on standard contractual clauses. Which additional analysis is most relevant after the Schrems II decision?

  1. Whether the destination country's surveillance laws undermine the safeguards and whether supplementary measures are needed Correct answer.
  2. Whether the transfer is documented in a press release
  3. Whether the data subject has a social media account
  4. Whether the vendor has a SOC 2 report

Explanation

Schrems II requires a transfer impact assessment considering third-country law and, where necessary, supplementary technical or organizational measures. A SOC 2 report and public statements do not address the legal adequacy of the destination's surveillance regime.

Question 12Cybersecurity Law and Legal Fundamentals

Which principle limits processing of personal data to what is necessary for a specified purpose under the GDPR?

  1. Data anonymization
  2. Data retention maximization
  3. Data portability
  4. Data minimization Correct answer.

Explanation

Data minimization requires that personal data be adequate, relevant, and limited to what is necessary for the stated purpose. Portability concerns providing data to the subject, and anonymization concerns removing identifiability rather than limiting collection.

Question 13Cybersecurity Law and Legal Fundamentals

A security researcher accesses a system without permission to demonstrate a vulnerability. Which legal defense is most commonly asserted to reduce or avoid liability?

  1. Lack of intent to cause harm
  2. The first sale doctrine
  3. The statute of limitations
  4. Authorization or a recognized public interest defense such as responsible disclosure Correct answer.

Explanation

Researchers typically rely on explicit authorization, such as a bug bounty program, or recognized public interest and responsible disclosure norms. Lack of intent to harm is generally not a complete defense to unauthorized access, and the first sale doctrine concerns copyright distribution.

Question 14Cybersecurity Law and Legal Fundamentals

Which legal theory allows a plaintiff to recover for unauthorized access to a computer system as interference with a property interest?

  1. Trespass to chattels Correct answer.
  2. Promissory estoppel
  3. Negligence per se
  4. Rescission

Explanation

Trespass to chattels addresses intentional interference with another's personal property, and courts have applied it to computer systems in some cases. Negligence per se, promissory estoppel, and rescission address different duties and remedies.

Question 15Cybersecurity Law and Legal Fundamentals

Which obligation does the HIPAA Security Rule impose on covered entities regarding electronic protected health information?

  1. Publish all patient records on request
  2. Encrypt every record without exception
  3. Implement administrative, physical, and technical safeguards to ensure confidentiality, integrity, and availability Correct answer.
  4. Report every access log to the public

Explanation

The Security Rule requires a set of administrative, physical, and technical safeguards for electronic protected health information. It does not mandate universal encryption without exception or public disclosure of records or logs.

Question 16Cybersecurity Law and Legal Fundamentals

A vendor processes personal data solely on documented instructions from its customer and has no independent purpose for the processing. Which role does the vendor occupy under the GDPR?

  1. Supervisory authority
  2. Joint controller
  3. Controller
  4. Processor Correct answer.

Explanation

An entity that processes data only on behalf of and on the instructions of another is a processor. A controller or joint controller determines purposes or means, and a supervisory authority is a regulator.

Question 17Cybersecurity Law and Legal Fundamentals

Which factor most strongly supports a finding that an individual has a reasonable expectation of privacy in data stored on a device?

  1. The device is owned by the employer and subject to a written monitoring policy
  2. The device is personally owned and protected by a passcode Correct answer.
  3. The data is shared with a third-party service under a public terms of use
  4. The data is posted on a public social media profile

Explanation

Personal ownership plus access controls such as a passcode supports a subjective and objectively reasonable expectation of privacy. Employer-owned devices under clear policy, public postings, and broadly shared data generally reduce that expectation.

Question 18Cybersecurity Law and Legal Fundamentals

Which authority empowers the Federal Trade Commission to bring enforcement actions against companies for unreasonable data security practices?

  1. The Securities Exchange Act of 1934
  2. The Sherman Antitrust Act
  3. The Patent Act
  4. Section 5 of the FTC Act prohibiting unfair or deceptive acts or practices Correct answer.

Explanation

The FTC uses its Section 5 unfairness and deception authority to challenge inadequate data security and misleading privacy promises. The antitrust, securities, and patent statutes address competition, securities markets, and inventions respectively.

Question 19Cybersecurity Law and Legal Fundamentals

A company's privacy policy states that it never sells customer data, but the company later sells that data. Which legal risk is most direct?

  1. Antitrust liability for monopolization
  2. Patent infringement for using the data
  3. Securities fraud for insider trading
  4. Deceptive practices liability for a misleading privacy representation Correct answer.

Explanation

A privacy promise that is contradicted by actual practice is a deceptive representation enforceable by regulators and actionable by affected parties. The other theories concern competition, trading in securities, or patented inventions.

Question 20Cybersecurity Law and Legal Fundamentals

Which requirement is central to a valid consent under the GDPR?

  1. It must be freely given, specific, informed, and unambiguous Correct answer.
  2. It must be irrevocable
  3. It must be obtained only in writing
  4. It must be implied from silence

Explanation

Valid consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action. Silence, pre-ticked boxes, and irrevocability are inconsistent with these requirements.

Question 21Cybersecurity Law and Legal Fundamentals

An organization receives a government request for customer data that appears legally defective. Which response best reflects sound legal practice?

  1. Ignore the request entirely without response
  2. Assess the request's validity and challenge or narrow it through legal process where appropriate Correct answer.
  3. Immediately disclose all requested data without review
  4. Publish the customer's data to preempt the request

Explanation

Recipients should evaluate the legal basis and scope of a government demand and may challenge or negotiate its breadth through counsel. Automatic disclosure, silent nonresponse, or public disclosure of customer data are not sound practices.

Question 22Cybersecurity Law and Legal Fundamentals

Which principle requires organizations to retain personal data no longer than necessary for the purpose of processing?

  1. Data portability
  2. Storage limitation Correct answer.
  3. Accuracy
  4. Purpose compatibility

Explanation

Storage limitation requires that identifiable data not be kept longer than necessary for the stated purpose. Portability concerns transferring data, purpose compatibility concerns reuse for new purposes, and accuracy concerns correctness of data.

Question 23Cybersecurity Law and Legal Fundamentals

Which document typically governs the relationship between a controller and a processor under the GDPR?

  1. A data processing agreement Correct answer.
  2. A service-level agreement only
  3. A non-disclosure agreement only
  4. A software license

Explanation

A data processing agreement sets out the processor's obligations, including acting on instructions, security, and sub-processor terms. An NDA, license, or SLA may complement but does not by itself satisfy the Article 28 requirements.

Question 24Cybersecurity Law and Legal Fundamentals

A jurisdiction enacts a comprehensive privacy law granting consumers rights to access, delete, and correct personal data. Which category of law does this represent?

  1. Consumer data privacy legislation Correct answer.
  2. Environmental regulation
  3. Antitrust legislation
  4. Securities regulation

Explanation

Comprehensive consumer privacy laws grant rights over personal data and impose duties on businesses that collect it. Antitrust, securities, and environmental laws regulate competition, markets, and pollution respectively.

Question 25Cybersecurity Law and Legal Fundamentals

Which concept describes the tension between an employee's privacy interests and an employer's need to protect its systems?

  1. Waiver of all employee rights
  2. Absolute immunity of employers
  3. Proportionality of monitoring Correct answer.
  4. Res judicata

Explanation

Monitoring should be proportionate to legitimate business needs, with notice and the least intrusive means appropriate to the risk. Employers do not enjoy absolute immunity, and employment does not waive all privacy rights.

Question 26Cybersecurity Law and Legal Fundamentals

Which federal law is the primary statute imposing criminal penalties for unauthorized access to protected computers and for obtaining information from them?

  1. The Computer Fraud and Abuse Act Correct answer.
  2. The Electronic Communications Privacy Act
  3. The Stored Communications Act
  4. The Wiretap Act

Explanation

The Computer Fraud and Abuse Act (CFAA) is the principal federal anti-hacking statute, criminalizing unauthorized access to protected computers and obtaining information from them. The Wiretap Act, the Stored Communications Act, and the ECPA address interception and disclosure of communications rather than unauthorized computer intrusion as such.

Question 27Cybersecurity Law and Legal Fundamentals

Under the GDPR, which lawful basis requires the data subject to be able to withdraw consent at any time as easily as it was given?

  1. Consent Correct answer.
  2. Contract performance
  3. Legal obligation
  4. Legitimate interests

Explanation

Article 7 of the GDPR provides that where processing is based on consent, the data subject has the right to withdraw it at any time, and withdrawal must be as easy as giving consent. The other lawful bases do not depend on the data subject's ongoing permission and therefore carry no withdrawal right.

Question 28Cybersecurity Law and Legal Fundamentals

A healthcare clearinghouse transmits electronic claims on behalf of providers. Under HIPAA, how is the clearinghouse classified?

  1. A plan sponsor
  2. A covered entity
  3. A business associate Correct answer.
  4. A subcontractor with no obligations

Explanation

A clearinghouse that processes nonstandard health information into standard transactions on behalf of a covered entity is a business associate under HIPAA. Business associates must comply with the applicable Security Rule provisions and sign a business associate agreement.

Question 29Cybersecurity Law and Legal Fundamentals

Which term describes the practice of configuring a system so that it collects and processes only the personal data strictly needed for a stated purpose by default?

  1. Privacy by default Correct answer.
  2. Storage limitation
  3. Purpose limitation
  4. Data minimization by design

Explanation

Privacy by default under Article 25 of the GDPR requires that, without intervention, only personal data necessary for each specific purpose is processed. Data minimization is the underlying principle, but the default-configuration obligation is expressed as privacy by default.

Question 30Cybersecurity Law and Legal Fundamentals

Which US regulator has primary enforcement authority over unfair or deceptive acts or practices affecting commerce, including deceptive privacy policies?

  1. The Consumer Financial Protection Bureau
  2. The Federal Communications Commission
  3. The Securities and Exchange Commission
  4. The Federal Trade Commission Correct answer.

Explanation

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce, and the FTC uses this authority in privacy and data security enforcement. The other agencies have sector-specific mandates rather than general deception authority.

Question 31Cybersecurity Law and Legal Fundamentals

Which legal doctrine lets a party enforce a contract term even though it did not provide fresh consideration, because it relied on the promise to its detriment?

  1. Promissory estoppel Correct answer.
  2. Rescission
  3. Specific performance
  4. Novation

Explanation

Promissory estoppel allows enforcement of a promise where the promisee reasonably relied on it to their detriment, even absent consideration. Rescission unwinds a contract, specific performance compels performance, and novation substitutes a new party or obligation.

Question 32Cybersecurity Law and Legal Fundamentals

Which type of law primarily governs relationships between private parties, such as breach of a confidentiality agreement?

  1. Constitutional law
  2. Administrative law
  3. Criminal law
  4. Civil law Correct answer.

Explanation

Civil law governs disputes between private parties and typically provides remedies such as damages or injunctions. Criminal law addresses offenses against the state, administrative law governs agency action, and constitutional law constrains government power.

Question 33Cybersecurity Law and Legal Fundamentals

Which concept describes a court's authority to hear a particular type of case, such as a federal court hearing a claim arising under a federal statute?

  1. Standing
  2. Venue
  3. Subject-matter jurisdiction Correct answer.
  4. Personal jurisdiction

Explanation

Subject-matter jurisdiction is the court's power over the category of dispute, such as federal-question or diversity jurisdiction. Venue concerns the geographic location of the suit, standing concerns the plaintiff's right to sue, and personal jurisdiction concerns authority over a party.

Question 34Cybersecurity Law and Legal Fundamentals

A company's security team discovers an intruder exfiltrating customer records. Which action best preserves evidence for potential litigation while allowing the business to continue operating?

  1. Waiting until the lawsuit is filed to begin any investigation
  2. Capturing forensic images and logs before remediation, following a documented chain of custody Correct answer.
  3. Asking employees to delete emails discussing the incident
  4. Immediately wiping the affected servers to stop the intrusion

Explanation

Forensic preservation with a documented chain of custody maintains the admissibility and integrity of evidence while remediation proceeds. Destroying or delaying collection risks spoliation sanctions and loss of key proof.

Question 35Cybersecurity Law and Legal Fundamentals

An organization receives a subpoena for customer records that is broader than the investigation appears to require. What is the most appropriate first step?

  1. Produce all records immediately to avoid contempt
  2. Notify the affected customers and publish the subpoena online
  3. Review the request with counsel and consider a timely objection or motion to quash the excess scope Correct answer.
  4. Ignore the subpoena until a court orders compliance

Explanation

A recipient should assess the subpoena's validity and scope with counsel and raise timely objections or move to quash overbroad portions rather than comply blindly or ignore it. Ignoring a lawful subpoena risks contempt, while overproduction waives objections and exposes data unnecessarily.

Question 36Cybersecurity Law and Legal Fundamentals

A vendor contract requires the vendor to notify the customer of any security incident within 24 hours. The vendor discovers a breach but waits three weeks. Which claim is strongest?

  1. Copyright infringement
  2. Antitrust violation
  3. Trespass to chattels against the vendor
  4. Breach of contract based on the notification clause Correct answer.

Explanation

Failing to meet a contractual notice deadline is a breach of the agreement, entitling the customer to contractual remedies. Trespass to chattels concerns interference with another's property, and the other theories do not fit a missed notice obligation.

Question 37Cybersecurity Law and Legal Fundamentals

Under the GDPR, a controller wants to rely on legitimate interests for a new analytics program. Which step is required before processing begins?

  1. Publish the names of all analytics recipients
  2. Obtain prior authorization from the European Data Protection Board
  3. Conduct a balancing assessment and document that the interests are not overridden by data subject rights Correct answer.
  4. Register the program with every national supervisory authority

Explanation

Relying on legitimate interests requires a documented legitimate interests assessment weighing the controller's interests against the rights and expectations of data subjects. Prior EDPB authorization, recipient publication, and universal registration are not prerequisites.

Question 38Cybersecurity Law and Legal Fundamentals

A cloud provider stores a customer's data and also analyzes it to develop its own products without the customer's instruction. What is the provider's most likely status under the GDPR?

  1. A joint controller with the customer for all processing
  2. A processor only
  3. A supervisory authority
  4. A controller for the independent analysis Correct answer.

Explanation

When a provider determines the purposes and means of processing for its own product development, it acts as a controller for that processing even if it is a processor for the customer's data. Joint controllership requires shared determination, and a provider is never a supervisory authority.

Question 39Cybersecurity Law and Legal Fundamentals

A company wants to transfer personal data from the EU to a country without an adequacy decision. Which mechanism is recognized under the GDPR for such transfers?

  1. Standard contractual clauses approved by the European Commission Correct answer.
  2. A memorandum of understanding between the two companies
  3. An internal email from the CEO
  4. A unilateral press release announcing compliance

Explanation

Standard contractual clauses approved by the European Commission are a recognized transfer mechanism under Article 46, subject to a transfer impact assessment. Unilateral statements, private memoranda, and executive emails lack legal effect for international transfers.

Question 40Cybersecurity Law and Legal Fundamentals

An employee is suspected of stealing trade secrets before joining a competitor. Which legal theory most directly prohibits misappropriation of confidential business information?

  1. The First Amendment
  2. Trademark law
  3. Trade secret law Correct answer.
  4. Securities regulation

Explanation

Trade secret law, including the Defend Trade Secrets Act and state statutes, prohibits misappropriation of confidential information that derives value from secrecy. Trademark law protects source identifiers, the First Amendment protects speech, and securities regulation governs markets.

Question 41Cybersecurity Law and Legal Fundamentals

A state breach notification statute requires notice to affected residents without unreasonable delay. Which factor most affects whether a company may delay notice?

  1. The number of press inquiries received
  2. Whether law enforcement determines that notice would impede a criminal investigation Correct answer.
  3. The company's stock price
  4. The size of the company's marketing budget

Explanation

Many breach notification statutes permit delay when a law enforcement agency determines that notice would impede a criminal investigation, often for a specified period. Financial, public relations, and budget considerations are not statutory grounds for delay.

Question 42Cybersecurity Law and Legal Fundamentals

Which principle of the OECD Guidelines and many privacy statutes requires that personal data be relevant to the purpose for which it is collected?

  1. Individual participation
  2. Security safeguards
  3. Accountability
  4. Data quality and relevance Correct answer.

Explanation

The data quality principle requires personal data to be relevant, accurate, complete, and current for the purposes of use. Accountability concerns demonstrating compliance, participation concerns individual access, and security concerns protection.

Question 43Cybersecurity Law and Legal Fundamentals

A company markets a smart home device that continuously records audio. Which legal risk is most directly implicated if the device records without proper notice?

  1. Violation of wiretap or eavesdropping laws Correct answer.
  2. Violation of securities law
  3. Violation of antitrust law
  4. Violation of bankruptcy law

Explanation

Recording conversations without consent or notice can violate federal and state wiretap and eavesdropping statutes, which impose civil and criminal liability. Antitrust, securities, and bankruptcy law do not govern surreptitious audio recording.

Question 44Cybersecurity Law and Legal Fundamentals

An organization receives a data subject access request under the GDPR. Which response best complies with Article 15?

  1. Provide only a summary of the privacy policy
  2. Provide a copy of the personal data and information about purposes, recipients, and retention, generally within one month Correct answer.
  3. Require the data subject to pay a fee in all cases
  4. Refuse all requests as burdensome

Explanation

Article 15 requires the controller to provide access to the personal data and specified information such as purposes, categories, recipients, and retention, generally within one month. Refusal, a mere policy summary, or automatic fees do not satisfy the obligation.

Question 45Cybersecurity Law and Legal Fundamentals

Which legal concept allows a government agency to obtain records from a third-party service provider without a warrant in some circumstances, though recent case law has narrowed its application?

  1. The third-party doctrine Correct answer.
  2. The exclusionary rule
  3. The fruit of the poisonous tree doctrine
  4. The plain view doctrine

Explanation

The third-party doctrine holds that information voluntarily shared with a third party may lack a reasonable expectation of privacy, though cases such as Carpenter have limited its reach for certain digital records. The exclusionary rule and related doctrines concern suppression of evidence, and plain view concerns observation of evidence.

Question 46Cybersecurity Law and Legal Fundamentals

A company discovers that a former employee retained access credentials and used them to download files after termination. Which federal statute most directly addresses this conduct?

  1. The Computer Fraud and Abuse Act Correct answer.
  2. The Sarbanes-Oxley Act
  3. The Sherman Act
  4. The Fair Credit Reporting Act

Explanation

Using credentials after authorization has been revoked can constitute unauthorized access under the CFAA, particularly where the access exceeds authorization. The FCRA governs consumer reports, Sarbanes-Oxley concerns corporate accountability and financial reporting, and the Sherman Act addresses antitrust.

Question 47Cybersecurity Law and Legal Fundamentals

A multinational company faces conflicting obligations: one jurisdiction orders disclosure of data, while another prohibits transfer. Which approach best reflects recognized legal practice?

  1. Always comply with the disclosure order without review
  2. Assess the conflict with counsel, seek clarification or challenge the order where appropriate, and document the legal basis for the chosen action Correct answer.
  3. Ignore both jurisdictions and delete the data
  4. Transfer the data to a third country without any assessment

Explanation

Conflicting legal demands require a documented, counsel-guided assessment, including efforts to narrow or challenge the order and consideration of mechanisms such as the CLOUD Act or blocking statutes. Blind compliance, deletion, or unassessed transfers create legal exposure.

Question 48Cybersecurity Law and Legal Fundamentals

Which theory of liability allows a plaintiff to recover from a company that failed to implement reasonable security measures, even without proof of intent?

  1. Fraud
  2. Negligence Correct answer.
  3. Strict products liability
  4. Intentional infliction of emotional distress

Explanation

Negligence imposes a duty of reasonable care, and failure to implement reasonable security can breach that duty without any intent to harm. Strict products liability applies to defective products, intentional infliction requires extreme intentional conduct, and fraud requires knowing misrepresentation.

Question 49Cybersecurity Law and Legal Fundamentals

An organization relies on binding corporate rules for intra-group transfers. Which statement best describes their legal function?

  1. They eliminate all GDPR obligations for the group
  2. They are equivalent to a marketing consent
  3. They apply only to transfers to public authorities
  4. They provide an approved internal framework for transfers within a corporate group, subject to supervisory authority approval Correct answer.

Explanation

Binding corporate rules are an Article 47 transfer mechanism approved by a competent supervisory authority, providing an internal framework for intra-group transfers. They do not eliminate GDPR obligations, constitute consent, or apply only to public authority transfers.

Question 50Cybersecurity Law and Legal Fundamentals

A plaintiff sues a company for intrusion upon seclusion after employees accessed a customer's private account without authorization. Which element is most essential to that claim?

  1. The company obtained a financial benefit
  2. The company published the information widely
  3. The customer suffered physical injury
  4. The intrusion was highly offensive to a reasonable person Correct answer.

Explanation

Intrusion upon seclusion requires an intentional intrusion into a private matter that would be highly offensive to a reasonable person. Financial benefit, physical injury, and broad publication are not required elements.