2 cissp ® Official Study Guide Eighth Edition

part of ongoing vendor governance.
Written Lab
1.
What are the key provisions of the Privacy Shield Framework agreement between the 
United States and the European Union?
2.
What are some common questions that organizations should ask when considering
outsourcing information storage, processing, or transmission?
3.
What are some common steps that employers take to notify employees of system
monitoring? 

---

154
Chapter 4 
■
Laws, Regulations, and Compliance
Review Questions
1.
Which criminal law was the first to implement penalties for the creators of viruses, worms, 
and other types of malicious code that cause harm to computer systems?
A.
Computer Security Act
B.
National Infrastructure Protection Act
C.
Computer Fraud and Abuse Act
D.
Electronic Communications Privacy Act
2.
Which law governs information security operations at federal agencies?
A.
FISMA
B.
FERPA
C.
CFAA
D.
ECPA
3.
What type of law does not require an act of Congress to implement at the federal level 
but rather is enacted by the executive branch in the form of regulations, policies, and 
procedures?
A.
Criminal law
B.
Common law
C.
Civil law
D.
Administrative law
4.
Which federal government agency has responsibility for ensuring the security of govern-
ment computer systems that are not used to process sensitive and/or classified information?
A.
National Security Agency
B.
Federal Bureau of Investigation
C.
National Institute of Standards and Technology