Pass ISC CISSP Exam in First Attempt Guaranteed!

Cheap storage does not justify excessive personal-data collection or indefinite retention. The proposal would not be defensible for this case.

This is appropriate for a later condition (The product later introduces legitimate optional analytics based on consent.), but it does not directly resolve the initial need. The new use requires a lawful basis and meaningful control, rather than retroactive expansion of original collection.

This response addresses a different condition: An online service detects exposure of personal information stored for customers in multiple countries, and the incident scope is not yet confirmed. The present case requires the measure described by Restrict collection to justified purposes and minimum necessary attributes under an approved privacy notice.

This is a limitation elsewhere: A cloud team plans to place regulated customer files in a foreign storage region without consulting the legal function. It does not explain the deficiency of the specified proposed approach.

This explains a later shift in requirements (The product later introduces legitimate optional analytics based on consent.), not the failure of the current proposal.

This is an advantage of another design (Assess transfer restrictions, residency commitments and lawful transfer mechanisms before deployment.), not the particular flaw of Retain every collected attribute indefinitely because storage cost is low.

This demonstrates controls in another circumstance: A software integrator receives proprietary source code under an NDA but wants to distribute it broadly to subcontractors.

This other observation is relevant to: An online service detects exposure of personal information stored for customers in multiple countries, and the incident scope is not yet confirmed. In the current case, the assessed requirement is: A marketing team collects detailed identity attributes from visitors that are unnecessary to provide the requested service. The organization has now implemented this response: Restrict collection to justified purposes and minimum necessary attributes under an approved privacy notice. Which observation would MOST directly demonstrate that the security objective was met.

An approved change without an executed test cannot prove operating effectiveness. The needed evidence is A data inventory and sampling prove each collected field has a documented justified use and retention schedule.

This is the appropriate response to the original situation: Purpose limitation and minimization reduce privacy and breach exposure. It does not directly meet the new condition.

This remains inappropriate: Cheap storage does not justify excessive personal-data collection or indefinite retention.

This is a record of how the initial safeguard would be checked, not an action implementing the newly requested condition: A data inventory and sampling prove each collected field has a documented justified use and retention schedule.

This is appropriate for a later condition (A subcontractor's access ends after a project cancellation.), but it does not directly resolve the initial need. Contract termination changes the permitted recipients and disposition requirements.

This response addresses a different condition: A cloud team plans to place regulated customer files in a foreign storage region without consulting the legal function. The present case requires the measure described by Validate license and contractual sublicensing rights and restrict disclosure to approved parties.

An NDA or deployment license does not inherently authorize sublicensing or publication. The proposal would not be defensible for this case.

This concerns a later and different need: A subcontractor's access ends after a project cancellation. Contract termination changes the permitted recipients and disposition requirements.

The proposed control fits another scenario: A marketing team collects detailed identity attributes from visitors that are unnecessary to provide the requested service. It does not directly address this scenario's primary requirement.

An NDA or deployment license does not inherently authorize sublicensing or publication.

This other observation is relevant to: A cloud team plans to place regulated customer files in a foreign storage region without consulting the legal function.

An approved change without an executed test cannot prove operating effectiveness. The needed evidence is A distribution register records authorized recipients, permissions and revocation obligations.

This demonstrates controls in another circumstance: An online service detects exposure of personal information stored for customers in multiple countries, and the incident scope is not yet confirmed.

This is appropriate for a later condition (Police issue a valid warrant concerning the same conduct.), but it does not directly resolve the initial need. Criminal process has evidentiary and legal requirements distinct from internal HR review.

This response addresses a different condition: A security team receives a civil-litigation discovery request for archived communications tied to a contractual dispute. The present case requires the measure described by Coordinate with HR and counsel to preserve relevant records under the authorized administrative investigation scope.

Overbroad collection can violate privacy, legal and employment obligations. The proposal would not be defensible for this case.

This explains a later shift in requirements (Police issue a valid warrant concerning the same conduct.), not the failure of the current proposal.

This is an advantage of another design (Refer the request to counsel and preserve responsive information under a controlled legal hold.), not the particular flaw of Have investigators secretly search all personal accounts and devices without authority.

This is a limitation elsewhere: A security team receives a civil-litigation discovery request for archived communications tied to a contractual dispute. It does not explain the deficiency of the specified proposed approach.

This other observation is relevant to: A food distributor has not identified which supplier integrations it needs to fulfill time-sensitive orders after a site outage.

An approved change without an executed test cannot prove operating effectiveness. The needed evidence is A documented legal hold and audit trail identify authorized collection scope and evidence custody.

This demonstrates controls in another circumstance: A security team receives a civil-litigation discovery request for archived communications tied to a contractual dispute.

This remains inappropriate: Overbroad collection can violate privacy, legal and employment obligations.

This is a record of how the initial safeguard would be checked, not an action implementing the newly requested condition: A documented legal hold and audit trail identify authorized collection scope and evidence custody.

This is the appropriate response to the original situation: An internal personnel inquiry requires lawful scope, evidence protection and appropriate employee privacy handling. It does not directly meet the new condition.