Exam: Chapters 113–117 · Security+ SY0-701

Chapters 113–117 Practice Exam

📝 20 scored questions ⏱️ 25-minute target 🎯 Pass threshold: 80% (16/20)

Time remaining

25:00

Part A — Multiple Choice (Questions 1–20)

Ch 113 · Business Impact Analysis

Question 1 of 20

A logistics company runs nightly backups at midnight. A ransomware attack at 4 PM destroys 16 hours of order data; recovery is performed from the previous midnight backup. The company's BIA states the order management system has an 8-hour RPO. Was the RPO violated, and what operational change is required?

A. Yes — the 16-hour data loss (midnight to 4 PM) exceeds the 8-hour RPO; to meet an 8-hour RPO, backups must run at least every 8 hours so recovery never requires more than 8 hours of data B. No — RPO measures how quickly systems must be restored, not data loss; the 16-hour gap is an RTO issue C. No — RPO violations are only assessed at the annual BIA review, not per individual incident D. Inconclusive — the RPO applies only if the lost records contained customer payment data subject to regulatory retention requirements

✅ A — RPO violated; increase backup frequency. RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time — it directly drives backup frequency. An 8-hour RPO means no more than 8 hours of data can be lost in any failure. The nightly backup created a potential loss window of up to 24 hours; in this case 16 hours were lost, which is double the 8-hour RPO. The fix: run backups every 8 hours (or less) so the most recent restore point is never more than 8 hours old. RPO is not an annual metric — it applies to every failure event.

Ch 113 · Business Impact Analysis

Question 2 of 20

A hospital's emergency department scheduling system has a 45-minute RTO. Over one quarter, the system experienced three failures: restored in 38 minutes, 52 minutes, and 41 minutes respectively. How should the IT operations team characterize RTO compliance for this period?

A. The team met the RTO — the average of 38, 52, and 41 minutes is 43.7 minutes, which is below the 45-minute objective B. The RTO was violated in the second failure (52 minutes > 45-minute RTO) — RTO compliance is evaluated per individual failure event; a single violation constitutes a breach even if the other failures were within target C. The team met the RTO — two out of three failures were within the 45-minute target, achieving 67% compliance which satisfies the objective D. RTO compliance requires a full year of data — quarterly results are insufficient to reach a compliance determination

✅ B — RTO violated once; per-failure evaluation. RTO is not measured on average — it must be met in every individual failure. The 52-minute restoration in the second failure exceeded the 45-minute RTO by 7 minutes. That is a violation, regardless of how well the other two failures went. Averaging RTO performance would allow a catastrophic 4-hour recovery to be hidden by two fast recoveries. The operations team must investigate what caused the second failure to take longer and address the root cause to prevent future violations.

Ch 113 · Business Impact Analysis

Question 3 of 20

A web server experienced 5 failures over 6 months with repair times of 1 hour, 2 hours, 2 hours, 3 hours, and 7 hours. The security team must report the MTTR to leadership to justify a request for better monitoring tools. What is the correct MTTR?

A. 7 hours — MTTR is the longest single repair time recorded, representing worst-case recovery performance for planning purposes B. 2 hours — MTTR is the median of the five repair times (middle value when sorted: 1, 2, 2, 3, 7), which eliminates the outlier's distorting effect C. 3 hours — MTTR = Total Repair Time ÷ Number of Repairs = (1+2+2+3+7) ÷ 5 = 15 ÷ 5 = 3 hours D. 15 hours — MTTR accumulates all repair time, giving the total operational repair burden across the measurement period

✅ C — MTTR = 3 hours (arithmetic mean). MTTR is always calculated as Total Repair Time divided by Number of Repairs — a straightforward arithmetic mean. Total = 1+2+2+3+7 = 15 hours; divided by 5 repairs = 3 hours. MTTR is not the maximum (that would represent only worst-case), not the median (that would exclude the 7-hour outlier that represents real operational cost), and not the sum (that would be total repair burden, not average). The 3-hour MTTR compared against the RTO tells the team whether current recovery capability meets the business requirement.

Ch 113 · Business Impact Analysis

Question 4 of 20

A database server ran for 8,760 hours (one full year) with 3 failures totaling 48 hours of downtime. A vendor proposes a replacement server with a manufacturer-rated MTBF of 3,000 hours. Based on calculated MTBF, which server offers better projected reliability?

A. Current server — MTBF = 8,760 ÷ 3 = 2,920 hours; since downtime is excluded from MTBF calculations, this figure does not require adjustment B. Current server — manufacturer MTBF ratings are conservative marketing estimates; measured field MTBF nearly always exceeds the rated value C. Cannot determine — MTBF calculations require a minimum of 3 years of operational data to be statistically meaningful D. Replacement server — MTBF = Total Uptime ÷ Number of Breakdowns = (8,760 − 48) ÷ 3 = 8,712 ÷ 3 = 2,904 hours; the current server's calculated MTBF falls below the proposed 3,000-hour rating

✅ D — Replacement server; MTBF = 2,904 hours < 3,000. The correct MTBF formula is: Total Uptime ÷ Number of Breakdowns. Uptime = Total Hours − Downtime = 8,760 − 48 = 8,712 hours. Breakdowns = 3. MTBF = 8,712 ÷ 3 = 2,904 hours. The common trap in option A is dividing total hours (not uptime) by failures — this overstates reliability by failing to exclude downtime. With a calculated MTBF of 2,904 hours versus the proposed 3,000-hour rated MTBF, the replacement offers modestly better projected reliability. Higher MTBF = longer average time between failures = more reliable.

Ch 114 · Third-party Risk

Question 5 of 20

Before a penetration test begins, a testing firm receives the following instructions: social engineering attacks against employees are not authorized; testing may only occur between 9 PM and 5 AM on weekdays; three legacy systems are explicitly excluded from all testing; and any critical finding must be reported to the security director by phone within one hour of discovery. What is the specific document that captures these specifications, and when must it be finalized?

A. Rules of engagement — this pre-engagement document specifies authorized scope, timing restrictions, excluded systems, and emergency notification procedures; it must be agreed and signed before testing begins B. Master Service Agreement (MSA) — the overarching legal framework that establishes the testing relationship and governs all project-specific details including scope and timing C. Statement of Work (SOW) — the project-specific document defining deliverables, timeline, and payment terms for this engagement under the existing MSA D. Non-disclosure agreement (NDA) — the document protecting the confidentiality of findings discovered during the engagement from disclosure to third parties

✅ A — Rules of engagement, finalized before testing begins. Rules of engagement (ROE) govern what the tester is and is not authorized to do during the assessment. Every element described — prohibited techniques (no social engineering), timing windows, out-of-scope systems, and emergency escalation contacts — is a rules of engagement element. The ROE must be finalized and signed before any testing begins because it defines the legal and operational boundaries within which the tester operates. Testing without agreed ROE creates legal risk for the tester and operational risk for the organization. The MSA is the parent legal contract; the SOW defines deliverables and payment; the ROE governs authorized conduct.

Ch 114 · Third-party Risk

Question 6 of 20

Between March and June 2020, attackers inserted a backdoor called SUNBURST into the build pipeline of the Orion network management platform. The malicious update bore a valid digital signature from the vendor and was delivered to approximately 18,000 organizations as a routine software update. What makes this attack category especially dangerous compared to a direct network intrusion against each target organization?

A. The malicious code was undetectable because SUNBURST exploited a zero-day vulnerability in Orion that the vendor had not yet identified or patched B. Attackers exploited the trust relationship between the software vendor and its customers — because the update was digitally signed and delivered through the vendor's normal update channel, it bypassed the security controls of all 18,000 organizations simultaneously through a single supply chain compromise C. SUNBURST used a man-in-the-middle technique to intercept software updates between SolarWinds and customers, allowing the attackers to modify them in transit D. The attack was enabled by SolarWinds employees who deliberately introduced the malicious code — insider threats at the vendor level automatically affect all of the vendor's customers

✅ B — Supply chain attack via trusted vendor relationship. The SolarWinds attack (2020) is the canonical supply chain attack example. Rather than attacking each of the 18,000 victim organizations individually — which would require separate intrusion campaigns — the attackers compromised the upstream software supplier's build pipeline. Because SolarWinds' digital certificate signed the update, it appeared completely legitimate. Victims installed it through normal patch management procedures, unknowingly installing a backdoor. Supply chain attacks are especially dangerous because they: (1) scale to every downstream customer in one action, (2) exploit legitimate trusted delivery mechanisms that bypass security controls, and (3) may go undetected for months because the malicious code arrives with a trusted signature.

Ch 114 · Third-party Risk

Question 7 of 20

A company contracts a payroll processing vendor to handle tax data for 8,000 employees. During contract negotiations, the vendor agrees to share annual SOC 2 Type II reports but refuses to include a right-to-audit clause, citing competitive sensitivity of their infrastructure. How should the organization evaluate this refusal?

A. The refusal is acceptable — SOC 2 Type II reports produced by independent CPA firms provide sufficient verification; a right-to-audit clause is redundant when third-party certifications are available B. The refusal is acceptable for payroll vendors specifically — right-to-audit clauses are only essential for vendors with direct network access to the organization's internal production systems C. A vendor who refuses a right-to-audit clause should be treated as a significant risk indicator — it suggests the vendor has something to hide or cannot meet independent scrutiny; the clause enables direct verification beyond the vendor's chosen audit scope and timing, which SOC 2 alone cannot provide D. The refusal is standard practice — including audit rights in vendor contracts creates legal liability exposure that most vendors legitimately and reasonably decline to accept

✅ C — Refusal is a significant risk indicator. A right-to-audit clause gives the customer the contractual right to independently verify vendor security at any time with reasonable notice. This is distinct from SOC 2: a SOC 2 report covers what the auditor examined, on the vendor's schedule, with scope the vendor agreed to. A right-to-audit clause lets the customer examine what the customer needs to examine when the customer needs to. A vendor who is genuinely confident in their security posture has no reason to refuse independent examination. Refusal is therefore a meaningful signal. Payroll vendors hold sensitive tax data for thousands of employees — this is exactly the high-value data that warrants audit rights regardless of industry conventions.

Ch 114 · Third-party Risk

Question 8 of 20

A retailer's security team runs an automated tool against their web application and receives a report identifying 31 potential security issues categorized by severity. Three months later, an external security firm actively attempts to authenticate as other users, extract customer records, and escalate privileges using those same 31 identified issues. What is the fundamental distinction between the first and second activities?

A. Both are penetration tests — the first is an automated penetration test and the second is a manual penetration test; they serve the same purpose but use different execution methods B. The first is a penetration test; the second is a security assessment because it adds exploitation attempts on top of initial vulnerability findings C. Both are vulnerability scans — the second scan simply adds human verification of automated findings to confirm whether reported vulnerabilities are actually present D. The first is a vulnerability scan (passive identification of potential weaknesses with no exploitation attempt); the second is a penetration test (active exploitation to determine whether vulnerabilities are genuinely exploitable and what damage a real attacker could achieve)

✅ D — Vulnerability scan identifies; penetration test actively exploits. A vulnerability scan uses automated tools to identify potential weaknesses and produces a categorized report — it never attempts to exploit the findings. A penetration test begins where the scan leaves off: a skilled human tester actively attempts to use identified vulnerabilities to gain unauthorized access, escalate privileges, or exfiltrate data. This answers the critical business question: "Can an attacker actually get in, and what can they reach?" Not all vulnerabilities that appear on a scan report are actually exploitable; penetration testing reveals which ones represent genuine risk. The combination — scan to find candidates, pentest to confirm exploitability — is standard security practice.

Ch 115 · Agreement Types

Question 9 of 20

Two public universities sign a document agreeing to share cybersecurity threat intelligence. The document describes the scope of information to be shared (malware indicators, phishing domains), identifies primary contacts at each institution, and states that both parties intend to act in good faith. The document specifies no financial penalties, has no fixed term, and was not filed with any legal authority. What type of agreement is this, and what is its primary limitation?

A. Memorandum of Understanding (MOU) — it documents broad mutual intent without creating legally binding obligations or financial penalties; compliance rests on good faith rather than legal enforcement B. Service Level Agreement (SLA) — it defines performance expectations for the threat intelligence sharing relationship between the two institutions C. Business Partners Agreement (BPA) — the universities are forming an operational partnership governed by BPA provisions covering shared purpose and joint decision-making D. Non-Disclosure Agreement (NDA) — the sensitive nature of threat intelligence makes this a confidentiality agreement regardless of the absence of formal legal language

✅ A — MOU; limited to good-faith compliance. An MOU documents intent and shared goals without creating a binding legal contract. The identifying features are all present: describes intent (not mandatory obligations), no financial penalties, no fixed term, not legally filed. MOUs are appropriate for government-to-government and interagency relationships where formal contracting is impractical or unnecessary, and where both parties have reputational or mission-driven motivation to comply without legal compulsion. The key limitation is exactly that: a party can walk away from an MOU without legal consequence. For relationships where performance guarantees matter, a formal contract with financial penalties (an SLA or MOA) is required instead.

Ch 115 · Agreement Types

Question 10 of 20

A company's cloud disaster recovery contract specifies: 99.95% uptime for recovery infrastructure, failover initiation within 15 minutes of a declared disaster, full system restoration within 4 hours, and a 20% service credit for any month where declared-disaster response times are missed. Which type of agreement best describes these terms, and what is the defining characteristic?

A. Master Service Agreement (MSA) — the overarching legal framework governing the entire disaster recovery relationship between the organization and the cloud provider B. Service Level Agreement (SLA) — it defines specific, measurable performance thresholds with financial consequences (service credits) for failure to meet those standards; the defining characteristic is the combination of measurable commitments and contractual penalties C. Business Partners Agreement (BPA) — the joint disaster recovery operation constitutes a partnership requiring BPA-level governance provisions D. Statement of Work (SOW) — it defines the specific deliverables of the disaster recovery engagement under the parent MSA

✅ B — SLA; measurable standards with financial penalties. A Service Level Agreement is identified by two characteristics present here: (1) specific, measurable performance standards (99.95% uptime, 15-minute failover initiation, 4-hour full restoration) and (2) financial consequences for non-performance (20% service credit). SLAs are the appropriate mechanism whenever the organization needs contractually enforceable guarantees about service performance. The distinction from an MSA: the MSA establishes the foundational relationship terms; SLAs define specific performance obligations within that relationship. An MSA can exist without any SLA; an SLA typically operates under an MSA.

Ch 115 · Agreement Types

Question 11 of 20

A startup plans to present its proprietary AI algorithm to three potential investors simultaneously. All three will receive identical confidential technical documentation. Rather than negotiating three separate bilateral agreements, the startup's attorney recommends a single agreement that legally binds all three investors under identical confidentiality terms at the same time. What type of NDA is this, and why is it preferable in this scenario?

A. Three separate bilateral NDAs — this is legally stronger because each investor is bound by an individually enforceable agreement; a single multi-party document creates ambiguity about individual obligations B. A unilateral NDA signed by all three investors — because only the startup is disclosing confidential information, this remains a unilateral agreement regardless of how many parties sign it C. A multilateral NDA — a single agreement binding three or more parties simultaneously; preferable here because it is more efficient than three bilateral agreements and ensures all investors operate under identical confidentiality terms from the same execution date D. An NDA cannot legally cover multiple receiving parties simultaneously — the startup must execute separate bilateral agreements with each investor individually

✅ C — Multilateral NDA; efficient and simultaneous binding. NDAs come in three types: unilateral (one party discloses, one receives), bilateral (both parties disclose to each other), and multilateral (three or more parties bound under a single agreement). The multilateral NDA is the correct tool when one disclosing party needs to bind multiple receiving parties simultaneously. Its advantages over three bilateral NDAs: executed once instead of three times, all investors bound from the same date with identical terms, and no risk of inconsistency between separate agreements. Option B misidentifies this as unilateral — while the startup is the only discloser, the document structure (single agreement binding 3+ parties) is what defines it as multilateral.

Ch 115 · Agreement Types

Question 12 of 20

A security consulting firm has a long-term Master Service Agreement with a client. The client now needs an urgent web application assessment and a separate cloud configuration review. Instead of drafting a new MSA, the client issues two new documents — one per project — each referencing the existing MSA and specifying scope, deliverables, timeline, and payment for that specific engagement. What are these two documents, and what role does the MSA play?

A. Contract addendums — the MSA is formally modified each time new project scope is added to the engagement B. Service Level Agreements — the MSA established performance standards that each project-specific SLA applies to its respective engagement C. Memoranda of Understanding — the MSA is the formal contract and MOUs document the intent and scope for each individual project D. Work Orders / Statements of Work (SOWs) — the MSA is the legal framework establishing standard terms (payment, IP ownership, liability, dispute resolution) that apply to all engagements; SOWs translate the MSA framework into concrete project-specific scope, deliverables, and payment without renegotiating foundational terms each time

✅ D — SOWs under a parent MSA; avoids renegotiating foundational terms. The MSA + SOW model is the standard structure for long-term professional services relationships: the MSA is signed once and establishes all fundamental terms (payment conditions, intellectual property, liability caps, governing law, dispute resolution). Each time a specific project is needed, a SOW (also called a Work Order) is issued under the MSA — it specifies scope, deliverables, timeline, and payment for that engagement without reopening the foundational legal terms. This dramatically speeds project initiation; the client and consulting firm negotiate scope and price, not legal frameworks, for each new project. The MSA is the governance layer; SOWs are the operational layer.

Ch 116 · Compliance

Question 13 of 20

A credit union offering checking accounts, savings accounts, car loans, and mortgage services receives a regulatory letter requiring: a comprehensive information security program, a written information security plan, a designated employee to coordinate the program, and privacy notices informing customers how their financial data is shared. Which regulation mandates these specific requirements?

A. GLBA (Gramm-Leach-Bliley Act) — applies to financial institutions and requires security programs protecting customer financial data, written security plans, program coordinators, and customer privacy notices disclosing data sharing practices B. HIPAA — extends to financial institutions when they process health-related payment or insurance claim information on behalf of covered entities C. SOX (Sarbanes-Oxley Act) — requires all financial institutions to implement internal IT controls over customer financial data reporting systems D. PCI DSS — applies to all organizations that hold or process customer financial data regardless of organization type or industry

✅ A — GLBA; applies to all financial institutions. The Gramm-Leach-Bliley Act (1999) applies to financial institutions — banks, credit unions, insurers, mortgage brokers, and related entities. Its Safeguards Rule requires: a written information security program, designation of an employee(s) to coordinate it, risk assessments, and controls protecting customer financial data. Its Privacy Rule requires privacy notices to customers explaining how their nonpublic personal information is collected and shared. The credit union matches this profile exactly. SOX applies to publicly traded companies (not credit unions). PCI DSS applies to payment card processing, not general financial services. HIPAA applies to health information, not financial data.

Ch 116 · Compliance

Question 14 of 20

A Chief Compliance Officer's annual report categorizes the company's security activities in two groups: Group 1 — quarterly access reviews, monthly vulnerability scans of all internal servers, annual security training for employees, and 24/7 SIEM monitoring; Group 2 — annual security questionnaires sent to all vendors, review of the cloud provider's SOC 2 report, and an annual on-site security assessment of the top 10 vendors by revenue. Which correctly categorizes these activity groups?

A. Both groups represent due care — the organization is diligently managing its overall security posture across internal and external relationships B. Group 1 = due care (internal activities demonstrating responsible security management of the organization's own operations); Group 2 = due diligence (external activities verifying that third-party organizations also meet security requirements) C. Group 1 = due diligence (the organization is diligently managing internal risks); Group 2 = due care (demonstrates careful, thorough vendor selection and oversight) D. Both groups represent due diligence — each activity is part of the organization's systematic risk management program and both require ongoing investigation to maintain

✅ B — Due care = internal; due diligence = external verification of third parties. Due care refers to the reasonable security practices an organization implements for its own operations — the internal standard of care. Access reviews, vulnerability scans, training, and SIEM monitoring all demonstrate that the organization is managing its own security obligations responsibly. Due diligence refers to the investigation and evaluation of external parties — verifying that vendors, partners, and suppliers also meet security standards. Sending questionnaires, reviewing SOC 2 reports, and conducting on-site vendor assessments are all due diligence activities. Memory aid: due care = internal operations; due diligence = external evaluation. A complete compliance program requires both.

Ch 116 · Compliance

Question 15 of 20

A hospital billing clerk accessed a celebrity patient's medical records 47 times over three months with no treatment-related justification. The clerk knew each access was improper — there was no clinical reason to view this patient's records — but never shared the records with anyone and received no financial benefit. The access was driven entirely by curiosity. Which HIPAA criminal penalty tier applies?

A. The unknowing tier (up to $50,000 and 1 year imprisonment) — because the clerk did not actually disclose the records to anyone, the violation is treated as if the clerk did not fully know they were violating HIPAA B. The commercial gain tier (up to $250,000 and 10 years imprisonment) — any unauthorized PHI access without legitimate clinical justification constitutes malicious harm under the highest HIPAA criminal tier C. The false pretenses tier (up to $100,000 and 5 years imprisonment) — the clerk knew each access was improper (that is false pretenses by definition) but lacked commercial intent or intent to harm, placing the violation in the middle criminal tier D. No criminal penalty applies — HIPAA criminal liability requires actual disclosure of PHI to a third party; unauthorized internal viewing without disclosure is only subject to civil fines

✅ C — False pretenses tier ($100K, 5 years). HIPAA criminal penalties operate in three tiers based on intent. Unknowing tier: the violator did not know they were violating HIPAA ($50K, 1yr). False pretenses tier: the violator knew the access was improper but without commercial motive ($100K, 5yr). Commercial gain / malicious harm tier: the violator accessed or disclosed PHI to sell it, for personal financial gain, or to cause harm ($250K, 10yr). The clerk knew each of the 47 accesses was improper — that is the definition of "under false pretenses." But curiosity without financial gain or intent to harm doesn't reach the highest tier. Criminal liability applies to unauthorized access regardless of whether records were shared — access itself is the violation.

Ch 116 · Compliance

Question 16 of 20

A fintech company's automated compliance dashboard reports 98.7% patch compliance across 3,200 servers and 99.2% MFA enrollment, and the internal security team has zero flagged incidents for the quarter. The CEO argues: "Our metrics are excellent — we don't need the cost of an external compliance audit this year; our automated tools produce objective, unbiased data." What is the fundamental flaw in this reasoning?

A. Automated compliance dashboards are prohibited under SOX and HIPAA; these regulations explicitly require manual compliance reviews conducted by certified compliance officers B. Automated tools only cover patch and MFA compliance; external auditors evaluate a broader range of controls that internal dashboards cannot monitor C. The CEO is partially correct — automated tools can substitute for external audits when key compliance metrics consistently exceed 95% thresholds D. External audits provide independence that automation cannot replace — automated tools only measure what they are configured to measure; an independent auditor examines whether the tools are correctly configured, whether unmeasured controls exist, and whether the metrics accurately represent actual compliance posture; familiarity bias means internal teams systematically miss what they are not looking for

✅ D — Automation cannot provide independence. The CEO's error is conflating objectivity with independence. Automated tools are objective within their configured scope — but that scope is defined by the security team itself. An independent external auditor examines things the internal team may not have thought to measure, tests whether the monitoring tools are correctly configured (a tool that miscounts compliant patches provides objectively wrong data), and brings external benchmarks from assessing many other organizations. Familiarity bias is the specific risk: internal teams stop noticing gaps they've seen so often they're used to them. External auditors provide a fresh perspective that no amount of internal automation can replicate. This is why compliance frameworks mandate independent external review.

Ch 117 · Privacy

Question 17 of 20

A social media platform (headquartered in Ireland) uses a California-based advertising analytics company to analyze user behavior and serve targeted ads. The platform decides what user data is collected, for what advertising purposes, and for how long. The analytics company processes user behavioral data according to the platform's specifications without independently determining the purpose or use of that data. Under GDPR, what roles do these two organizations hold?

A. The social media platform is the data controller (determines the purpose and means of processing; primary GDPR accountability); the analytics company is the data processor (processes data on the controller's behalf under the controller's instructions; bound by a data processing agreement) B. The analytics company is the data controller because it directly processes the user behavioral data and manages the technical infrastructure; the social media platform is the data owner C. Both are data controllers because both organizations have technical access to user behavioral data and both benefit from the processing D. The social media platform is the data owner (an internal business classification role); the analytics company is the data controller because it manages the technical infrastructure and processing operations

✅ A — Platform = controller; analytics company = processor. Under GDPR, the data controller is the entity that determines the purpose (why the data is processed) and the means (how it is processed). The social media platform decides what to collect, why, and for how long — that is the controller. The analytics company processes data per the platform's specifications without independently deciding the purpose — that is the processor. The controller holds primary GDPR accountability and cannot fully delegate that accountability to processors. The processor must be bound by a Data Processing Agreement (DPA) under GDPR Article 28. Physical custody of the data (option B's logic) does not determine controller vs. processor status — purpose and means determination does.

Ch 117 · Privacy

Question 18 of 20

A former customer of an online bank submits a GDPR erasure request (right to be forgotten). The account was closed 4 years ago, there is no pending legal dispute, no outstanding debt, and no regulatory retention obligation applicable to this customer's records. The bank deletes the records from its active customer database but leaves them in 7-year monthly backup archives and in a behavioral analytics data warehouse. Is the erasure request fulfilled?

A. Yes — deleting records from the active production database satisfies the right to erasure requirement; backup archives are outside the operational scope of routine data management B. No — the right to erasure requires deletion from ALL storage locations where the personal data exists, including backup archives and secondary data stores; the data remains in the bank's custody through the archives and analytics warehouse, meaning it has not actually been erased C. Yes — the 7-year backup retention is a separate regulatory requirement that supersedes individual GDPR erasure requests; the bank correctly balanced competing legal obligations D. Partially — only the analytics warehouse copy violates the erasure request; backup archives are always exempt from GDPR right to erasure requirements

✅ B — Erasure must cover all storage locations. The GDPR right to erasure (Article 17) requires an organization to delete personal data from all systems where it exists — not just the primary production database. The data minimization principle requires that personal data not be retained longer than necessary for its original purpose. When no retention obligation exists, backup archives and analytics warehouses are equally subject to the erasure requirement because the data remains in the organization's custody and is still being "processed" (stored is a form of processing under GDPR). Option C's logic would only apply if a genuine regulatory retention obligation covered this specific customer's records — the scenario explicitly states there is no such obligation. Incomplete erasure maintains regulatory exposure.

Ch 117 · Privacy

Question 19 of 20

A Japanese e-commerce company sells electronics to customers in Austria, Belgium, and Sweden, collecting names, addresses, credit card details, and browsing history from those customers. Following a data breach, a German data protection authority initiates an investigation. The company's legal team argues that GDPR applies only to companies physically located in EU member states and that a Japanese company is therefore exempt. Is this argument correct?

A. Yes — GDPR jurisdiction is limited to organizations with registered business addresses within EU member states; a Japanese company with no EU office is outside GDPR's territorial scope B. Yes — GDPR enforcement authority is limited to domestic jurisdiction; a foreign company can only be subject to its home country's data protection laws C. No — GDPR has extraterritorial scope under Article 3; it applies to any organization anywhere in the world that processes personal data of EU residents in connection with offering goods or services to them, regardless of where the organization is located D. No — but only the credit card data falls under GDPR; names and browsing data are covered by standard international e-commerce data protection frameworks rather than EU-specific regulation

✅ C — GDPR applies extraterritorially to any org processing EU residents' data. GDPR Article 3 establishes extraterritorial scope: it applies to any organization that processes personal data of EU residents in connection with offering goods or services to them, regardless of the organization's physical location. The Japanese e-commerce company actively sells to Austrian, Belgian, and Swedish customers — it is offering goods to EU residents and collecting their personal data in that connection. All of the collected data types (names, addresses, credit card details, browsing history) qualify as personal data under GDPR's broad definition. The company must comply with GDPR for those customers' data. Fines can reach 4% of global annual turnover — the non-EU location does not reduce the penalty.

Ch 117 · Privacy

Question 20 of 20

A ransomware attack simultaneously encrypts 23 servers across multiple data centers. Within 15 minutes, the security team identifies which of the 23 servers held personal data subject to GDPR notification requirements, the accountable business data owner for each affected dataset, and the sensitivity classification of each server's contents. This rapid scoping was made possible by a single document that had been prepared and maintained in advance. Which document provided this information?

A. Business Continuity Plan (BCP) — it inventories all critical systems and their interdependencies to support recovery prioritization after a disaster or major incident B. Incident Response Plan (IRP) — it documents which systems hold sensitive data so incident responders can prioritize containment of the most critical assets C. Risk Register — it catalogues all known risks associated with each server, including data sensitivity and accountability, to support risk treatment decisions D. Data inventory (data map) — it catalogs all personal data by type, storage location, data owner, sensitivity classification, and retention period; this document provides all the information needed to determine GDPR notification obligations, accountable stakeholders, and regulatory reporting scope during breach response

✅ D — Data inventory (data map). A data inventory (also called a data map, or Records of Processing Activities under GDPR Article 30) is the authoritative reference for breach response scoping. It documents: what personal data exists, where it is stored (every system, including backups and secondary stores), who the accountable data owner is, what sensitivity classification applies, and what retention period governs the data. Without it, incident responders must conduct time-consuming manual discovery under pressure during an active incident. With a current data inventory, the team can immediately answer the three breach notification questions: Is personal data subject to GDPR notification affected? Who is accountable? What was the scope? BCPs focus on recovery operations; IRPs guide response procedures; risk registers track risks — none of these catalog personal data locations comprehensively.

Part B — Scenario Questions (unscored — self-assess)

Ch 113–115 · Scenario

Scenario Question A

A mid-sized e-commerce company relies on a SaaS provider for its order management platform. The company's BIA defines a 1-hour RTO and a 15-minute RPO for the order management system. During a power failure at the SaaS provider's data center, the order management platform is offline for 4 hours and 20 minutes. Investigation reveals: (1) the most recent backup available for restoration was 2 hours old at the time of failure; (2) the SaaS contract contains an uptime guarantee but no RTO or RPO commitment; (3) the power failure originated at a colocation facility that the SaaS provider used — a dependency the e-commerce company was unaware of; and (4) the SaaS provider refuses to provide documentation of the colocation vendor's security controls, citing confidentiality.

Address: (1) Which BIA metrics were violated and by how much? (2) What contract terms should the company require in a renegotiated SaaS agreement, and what agreement types are appropriate for each requirement? (3) What type of third-party risk does the unknown colocation vendor represent, and how does the vendor's refusal to provide documentation factor into the risk assessment?

1. BIA metric violations:

RTO violated: The 1-hour RTO was exceeded by 3 hours and 20 minutes. The platform was offline for 4 hours 20 minutes against a 1-hour maximum. This represents a 260-minute violation of the business's stated downtime tolerance.

RPO violated: The 15-minute RPO was exceeded by 1 hour and 45 minutes. The most recent backup was 2 hours old at failure, meaning up to 2 hours of order data was potentially lost — 7.75× the acceptable 15-minute data loss limit. To meet a 15-minute RPO, backups must run every 15 minutes or continuous replication must be used.

2. Contract terms and agreement types required:

SLA additions needed: The renegotiated SLA must include explicit RTO and RPO commitments matching the company's BIA: maximum 1-hour restoration time (RTO) and 15-minute maximum data loss (RPO), with financial penalties (service credits) when these are violated. The current uptime-only SLA does not protect the company's recovery objectives.

Right-to-audit clause (in the MSA): The company must negotiate a right-to-audit clause giving it the contractual right to verify the SaaS provider's security controls — and require the provider to extend equivalent audit rights for any material subcontractors such as colocation facilities. This belongs in the Master Service Agreement as a perpetual provision.

Supply chain disclosure requirement: The contract should require the SaaS provider to disclose all material third-party dependencies (colocation vendors, infrastructure subcontractors) and notify the company of changes to those dependencies. Unknowing dependency on an undisclosed colocation facility is precisely the supply chain risk that contract terms must address.

3. Third-party risk — colocation vendor:

Risk type: This is a supply chain risk — the e-commerce company's service is dependent on a vendor's vendor that it had no knowledge of, no contractual relationship with, and no visibility into. The failure of the colocation facility propagated through the SaaS provider to the e-commerce company without warning.

Refusal to provide documentation: A vendor who refuses to share security control documentation for their own infrastructure should be treated as a significant risk indicator. The analogous principle applies: a vendor comfortable with independent verification has nothing to hide. This refusal means the e-commerce company cannot assess whether the colocation facility represents an acceptable risk — it must either negotiate audit-right provisions through the SaaS provider's contract or treat the undisclosed and unverifiable dependency as elevated risk. Ongoing vendor monitoring must account for these hidden infrastructure dependencies.

Ch 116–117 · Scenario

Scenario Question B

A pharmaceutical company runs clinical trials involving 12,000 participants across 8 EU countries. The company uses a third-party data analytics vendor to process trial outcome data. A ransomware attack encrypts three servers. During incident response, the team discovers: (1) the company has never maintained a data inventory — responders cannot determine which servers held participant personal data subject to GDPR notification; (2) the analytics vendor's last security assessment was 4 years ago; (3) employees with access to participant data were never trained on GDPR data handling obligations; and (4) trial participants were never informed their data would be shared with an analytics vendor.

Address: (1) Categorize each gap as a due care failure or due diligence failure and explain why. (2) What GDPR data roles do the pharmaceutical company and analytics vendor hold, and what documentation must exist between them? (3) What GDPR obligations arise from the breach and the undisclosed data sharing with the analytics vendor?

1. Categorizing each compliance gap:

No data inventory (due care failure): Maintaining a data inventory is an internal security management obligation — it is the organization's responsibility to know where its own data lives. The inability to identify which servers held personal data means the organization cannot determine its own GDPR breach notification obligations. This is a failure to exercise reasonable internal security practices.

Analytics vendor assessment 4 years ago (due diligence failure): Due diligence requires ongoing evaluation of third parties who process the organization's data. A single assessment 4 years ago does not reflect the vendor's current security posture, especially given how quickly the threat environment and vendor infrastructure change. Ongoing vendor monitoring is a due diligence obligation, not a one-time event.

No employee GDPR training (due care failure): Training employees with access to personal data on their GDPR obligations is an internal security management responsibility. Employees who don't understand data handling requirements represent a compliance risk within the organization's own operations — this is a due care gap.

Participants never informed of analytics vendor sharing (GDPR transparency failure / due care): GDPR requires that data subjects be informed of the purposes for which their data is processed and any third parties with whom it is shared. Failure to provide this transparency is a breach of the controller's direct GDPR obligations — an internal compliance failure (due care).

2. GDPR data roles and required documentation:

The pharmaceutical company is the data controller — it determines the purpose (clinical trial) and means of processing participant personal data, and holds primary GDPR accountability for that data.

The analytics vendor is a data processor — it processes trial outcome data on the pharmaceutical company's behalf, under the company's instructions, without independently determining the purpose.

GDPR Article 28 requires a Data Processing Agreement (DPA) between the controller and processor. The DPA must specify: the subject matter and duration of processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, the controller's obligations and rights, and security obligations binding the processor. If no DPA exists, this is itself a GDPR violation.

3. GDPR obligations arising from the breach and undisclosed sharing:

Breach notification: Under GDPR Article 33, the pharmaceutical company (as controller) must notify the supervisory authority (in the relevant EU member states) within 72 hours of becoming aware of the breach — if the breach is likely to result in a risk to individuals' rights and freedoms. The inability to determine which servers held personal data due to the absent data inventory directly impairs this 72-hour assessment.

Data subject notification: If the breach is likely to result in a high risk to participants' rights and freedoms, GDPR Article 34 requires notification to the affected data subjects (trial participants) without undue delay.

Remediation of undisclosed sharing: Trial participants had a right to be informed their data would be shared with an analytics vendor (transparency obligation under GDPR Articles 13/14). The company must update its privacy notices, potentially obtain fresh consent or establish another valid legal basis for the processing, and consider whether the undisclosed sharing constitutes a separate GDPR violation reportable to supervisory authorities. Fines can reach 4% of global annual turnover for serious transparency violations.

← Back to Study Hub

—

Pass threshold: 80% (16 / 20 correct)

← Back to Study Hub

Exam: Business Continuity & Compliance