ISC2 CCSP Practice Questions with Explanations

Correct answer: D

A cloud service developer is the role responsible for creating cloud components and performing the testing and validation of services. This role focuses on the development lifecycle and quality assurance of cloud-based solutions, including design, implementation, and validation.

Why the other options are wrong:

• A. Cloud auditors review and assess security and compliance, not create components.
• B. Inter-cloud providers facilitate communication between different cloud providers.
• C. Cloud service brokers manage selection, deployment, and optimization of cloud services, not development.

Correct answer: C

Vendor documentation is the best source for information about securing a physical asset's BIOS because manufacturers provide detailed, accurate guidance specific to their hardware models, including security features, configuration options, and recommended settings.

Why the other options are wrong:

• A. Security policies provide organizational guidelines but not technical BIOS-specific details.
• B. Manual pages typically refer to software manuals, not hardware BIOS documentation.
• D. Regulations establish compliance requirements but not technical BIOS configuration details.

Correct answer: B

The value of data is not a standard component of contractual PII requirements. Contractual obligations for PII typically address scope of processing, location/storage of data, use of subcontractors, data protection measures, and breach notification, but not inherent monetary value assignments.

Why the other options are wrong:

• A. Scope of processing is a core contractual PII component defining what data operations are permitted.
• C. Location of data is essential for contractual PII, specifying where personal information is stored and processed.
• D. Use of subcontractors is a critical contractual PII element, as it affects data handling responsibility and liability.

Correct answer: B

Measured service is the NIST term for the cloud characteristic where usage is monitored, controlled, and reported, allowing customers to pay only for resources and services consumed during the period they use them, enabling transparent billing models.

Why the other options are wrong:

• A. Consumable service is not a standard cloud computing term.
• C. Billable service describes the outcome of measurement but is not the official cloud computing concept.
• D. Metered service is similar but measured service is the established NIST terminology for this characteristic.

Correct answer: D

A cloud service administrator is responsible for testing, monitoring, and securing cloud services for an organization. This role manages the operational aspects of cloud services including configuration, performance monitoring, security controls, and ongoing maintenance.

Why the other options are wrong:

• A. Cloud service integrators focus on combining and integrating cloud services, not testing and securing them.
• B. Cloud service business managers handle business aspects and strategy, not technical testing and securing.
• C. Cloud service users consume cloud services but do not test, monitor, or secure them administratively.

Correct answer: D

XML is the only data format permitted with the SOAP API. SOAP uses XML exclusively for its message structure, envelope format, and protocol definitions, making it the mandatory data format for SOAP communications.

Why the other options are wrong:

• A. HTML is a markup language for web pages, not used by SOAP.
• B. SAML is a security assertion markup language for authentication, not a SOAP data format.
• C. XSML is not a standard data format used with SOAP APIs.

Correct answer: C

XML and JSON are the most commonly used data formats with REST APIs. REST is flexible and supports multiple formats, but JSON and XML are the industry standards for REST API requests and responses due to their simplicity and broad support.

Why the other options are wrong:

• A. SAML is an authentication protocol, not a typical REST API data format.
• B. SAML is not a REST API data format; while XML is correct, SAML is not paired with it here.
• D. SAML and HTML are not the standard REST API formats; HTML is for web pages, not APIs.

Correct answer: B

Missing function-level access control refers to applications that fail to validate authorization for specific functions after initial authentication checks. An attacker can access restricted functions by directly calling them, bypassing intended access controls at the function or method level.

Why the other options are wrong:

• A. Injection attacks involve inserting malicious code into application inputs, not authorization validation failures.
• C. Cross-site request forgery tricks authenticated users into performing unwanted actions, but doesn't specifically involve missing function-level authorization.
• D. Cross-site scripting involves injecting malicious scripts into web pages, not authorization validation at the function level.

Correct answer: B

The Cloud Service Business Manager is responsible for overseeing business-related aspects including billing, purchasing, and requesting audit reports. This role bridges business and technical operations within cloud environments.

Why the other options are wrong:

• A. Cloud service users consume services but do not manage billing or audit processes.
• C. Cloud service administrators focus on technical infrastructure management, not business billing and purchasing.
• D. Cloud service integrators specialize in connecting systems and services, not financial oversight.

Correct answer: C

Hosting a key management system outside the cloud environment creates the biggest availability concern because access to encryption keys may be delayed or interrupted if external systems experience outages, directly impacting the ability to decrypt data in the cloud.

Why the other options are wrong:

• A. While confidentiality is important, it can be protected through secure transmission protocols and authentication.
• B. Portability is not primarily affected by external key management hosting.
• D. Integrity of keys can be maintained through cryptographic controls and auditing regardless of location.

Correct answer: D

Simple deletion is NOT sufficient for secure data destruction in cloud environments because deleted files often remain recoverable through various means. Cryptographic erasure, zeroing, and overwriting are certified methods that ensure data is truly irrecoverable.

Why the other options are wrong:

• A. Cryptographic erasure is a valid and approved secure destruction method.
• B. Zeroing (writing zeros to storage) is an approved secure destruction technique.
• C. Overwriting with random or specific patterns is an established secure destruction method.

Correct answer: C

Multitenancy complicates eDiscovery because data from multiple organizations is stored on shared infrastructure, making it difficult to isolate and retrieve only relevant data without accessing other tenants' information, raising both technical and legal challenges.

Why the other options are wrong:

• A. Resource pooling relates to computing resources, not specifically to data discovery challenges.
• B. On-demand self-service affects provisioning speed, not eDiscovery complexity.
• D. Measured service pertains to billing and metering, not data discovery complications.

Correct answer: C

The management plane utilizes APIs (Application Programming Interfaces) to perform administrative functions on hypervisors. APIs provide standardized, programmatic access for remote management and orchestration of virtual infrastructure.

Why the other options are wrong:

• A. While scripts may call APIs, scripts are not the primary mechanism; APIs are.
• B. RDP (Remote Desktop Protocol) is for user sessions, not hypervisor management.
• D. XML is a data format that may be used within API communications, not the primary mechanism itself.

Correct answer: B

Multiple jurisdictions is the primary compliance complication for international operations because different countries have varying legal requirements, data residency rules, privacy laws, and regulatory frameworks that organizations must navigate simultaneously.

Why the other options are wrong:

• A. Different certifications are a consequence of jurisdictional differences, not the core complication.
• C. Different capabilities vary by cloud provider and technology, not primarily a jurisdictional issue.
• D. Different operational procedures result from compliance requirements, not the fundamental complication itself.

Correct answer: D

VLAN (Virtual Local Area Network) allows for network segregation and isolation of IP spaces in cloud environments by creating logically isolated networks on shared physical infrastructure, enabling multiple tenants or applications to operate securely.

Why the other options are wrong:

• A. PLAN is not a recognized networking standard or technology.
• B. WAN (Wide Area Network) connects geographically distant networks but doesn't provide segmentation within a cloud environment.
• C. LAN (Local Area Network) covers a physical area but lacks the virtual isolation capabilities needed for cloud multitenancy.

Correct answer: B

BICSI (Building Industry Consulting Services International) is the primary standard that pertains to cabling designs and setups in data centers, providing specifications for structured cabling systems and infrastructure.

Why the other options are wrong:

• A. IDCA is not a recognized standard for data center cabling.
• C. NFPA (National Fire Protection Association) focuses on fire safety and electrical safety, not cabling design.
• D. Uptime Institute focuses on data center tier classifications and operational standards, not cabling specifications.

Correct answer: B

The Uptime Institute publishes the Tier Standard for Topology, which is the most widely recognized and commonly used standard for classifying data center design in terms of tiers (Tier I through Tier IV) and their associated topologies. This standard is industry- adopted globally for data center infrastructure classification.

Why the other options are wrong:

• A. IDCA (International Data Center Authority) is not the primary publisher of the standard data center tier classification system.
• C. NFPA (National Fire Protection Association) focuses on fire safety and electrical standards, not data center tier and topology design.
• D. BICSI (Building Industry Consulting Services International) provides standards for telecommunications infrastructure but not the primary data center tier standard.

Correct answer: D

In cloud environments, logical segregation is the primary method used to separate resources and data between multiple tenants within the same physical infrastructure. This involves virtual machines, containers, network segmentation, and access controls that create distinct logical boundaries without requiring physical separation, which is the key differentiator from traditional data centers where physical separation is more common.

Why the other options are wrong:

• A. Virtual segregation is too broad and generic; logical segregation is the specific term for the separations used in multitenancy.
• B. Security segregation describes protective measures but not the primary segregation mechanism for multitenancy separation.
• C. Physical segregation contradicts the cloud model's efficiency and is not the typical approach for multitenancy in cloud environments.

Correct answer: D

HIPAA (Health Insurance Portability and Accountability Act) is the primary United States law specifically focused on protecting the privacy and security of health records and personal health information. It establishes national standards for healthcare data privacy and breach notification.

Why the other options are wrong:

• A. Safe Harbor is a framework for data transfer between the US and EU, not specifically focused on health records.
• B. SOX (Sarbanes-Oxley Act) addresses accounting and corporate governance, not healthcare privacy.
• C. GLBA (Gramm-Leach-Bliley Act) focuses on financial institutions and financial data privacy, not health records.

Correct answer: B

KVM (Keyboard, Video, Mouse) switches provide direct local, physical access to hardware within a data center, allowing administrators to connect to servers and networking equipment for out-of-band management without relying on network connectivity.

Why the other options are wrong:

• A. SSH (Secure Shell) is a remote network protocol, not a physical access method.
• C. VPN (Virtual Private Network) is a remote network connection technology, not a local physical access tool.
• D. RDP (Remote Desktop Protocol) is a remote network protocol for accessing systems over a network, not local physical access.

Correct answer: C

In Infrastructure as a Service, the measured services are typically infrastructure-level resources such as CPU, storage, memory, and bandwidth-resources directly tied to the computational and storage capacity provisioned. The number of users is not a standard measured service metric in IaaS, as it relates more to application-level concerns and would typically be relevant in SaaS models.

Why the other options are wrong:

• A. CPU is a core measured service in IaaS, quantified by cores, frequency, or compute time.
• B. Storage is a primary measured service in IaaS, typically billed by gigabytes or terabytes used.
• D. Memory is a fundamental measured service in IaaS, quantified by GB allocated and used.

Correct answer: D

eDiscovery scope is determined by three primary criteria: possession, custody, and control. These define what data must be preserved and produced in legal discovery. Archive is not a criterion for determining eDiscovery scope, though archived data may fall under the control or possession criteria.

Why the other options are wrong:

• A. Possession is a core eDiscovery criterion defining data the organization has ownership or control over.
• B. Custody is a fundamental eDiscovery criterion defining data physically held or managed by the organization.
• C. Control is a key eDiscovery criterion defining data the organization can access or influence, even if not physically possessed.

Correct answer: C

SOX (Sarbanes-Oxley Act) is the primary United States law focused on accounting practices, financial reporting, and corporate governance. It was enacted to improve corporate accountability and financial disclosure following major accounting scandals.

Why the other options are wrong:

• A. Safe Harbor is a framework for data transfer and privacy, not accounting and financial practices.
• B. GLBA (Gramm-Leach-Bliley Act) addresses financial institutions' privacy practices, not general accounting and financial practices for all organizations.
• D. HIPAA focuses on health records and healthcare privacy, not accounting and financial practices.

Correct answer: C

Static masking creates a separate and distinct copy of production data with sensitive information masked or redacted in place. This masked copy is then used for testing and development purposes, preserving the original data structure while protecting sensitive values.

Why the other options are wrong:

• A. Dynamic masking masks data on-the-fly during queries without creating a separate copy, typically used in real-time environments.
• B. Replication is the process of copying data but does not inherently imply masking is applied to that copy.
• D. Duplication refers to creating copies of data but is not the specific term for the masking strategy described.

Correct answer: D

Structured storage is most closely associated with database-type implementations. Databases organize data in structured formats with defined schemas, tables, and relationships. Structured storage provides organized, queryable data with predefined formats, which is the defining characteristic of database systems.

Why the other options are wrong:

• A. Object storage is designed for unstructured data like images and videos, not database implementations.
• B. Unstructured storage refers to data without predefined schema, which is opposite to database requirements.
• C. Volume storage provides block-level storage but is not specifically associated with database-type implementations.

Correct answer: C

The Cloud Service Business Manager is responsible for overseeing customer relationships and managing financial transactions. This role bridges business and technical aspects, handling customer interactions, contract management, and financial processing of cloud services.

Why the other options are wrong:

• A. Cloud service manager oversees technical service delivery, not customer relationships and financial transactions.
• B. Cloud service deployment focuses on technical implementation and deployment of services.
• D. Cloud service operations manager handles day-to-day operations and technical issues, not customer relationships or financial transactions.

Correct answer: A

REST APIs depend fundamentally on HTTP (Hypertext Transfer Protocol) as their underlying communication protocol. HTTP is the protocol used for all REST API requests and responses, including GET, POST, PUT, and DELETE operations.

Why the other options are wrong:

• B. XML is a data format that may be used within REST APIs but is not the protocol they depend on.
• C. SAML is an authentication protocol, not the underlying protocol for REST APIs.
• D. SSH is a secure shell protocol used for system administration, not for REST API communication.

Correct answer: C

The Safe Harbor program was designed to enable organizations to bridge the gap between privacy laws and requirements of the United States and the European Union. It provided a framework for U.S. companies to comply with European data protection standards by self-certifying their adherence to specific privacy principles.

Why the other options are wrong:

• A. GLBA (Gramm-Leach-Bliley Act) is a U.S. financial privacy law, not a U.S.-EU bridge program.
• B. HIPAA (Health Insurance Portability and Accountability Act) is a U.S. healthcare privacy law, not a U.S.-EU agreement.
• D. SOX (Sarbanes-Oxley) is a U.S. financial accountability law, not designed for U.S.- EU privacy alignment.

Correct answer: B

The biggest benefit to leasing data center space versus building or maintaining your own is cost reduction. Leasing eliminates capital expenditures for infrastructure, reduces operational expenses for maintenance and staffing, and distributes costs across multiple tenants, making it significantly more economical for most organizations.

Why the other options are wrong:

• A. Certification benefits are available whether leasing or building your own data center.
• C. Regulatory compliance requirements exist in both leased and owned data centers.
• D. Building your own data center actually provides more control; leasing reduces control.

Correct answer: B

Trust zones are a network security measure applicable in both traditional data centers and cloud environments. Trust zones segment networks based on security levels and access controls, protecting resources by restricting traffic between different security domains regardless of infrastructure type.

Why the other options are wrong:

• A. Dedicated switches are a physical infrastructure control not readily applicable in virtualized cloud environments.
• C. Redundant network circuits rely on physical infrastructure ownership typically unavailable in cloud environments.
• D. Direct connections are infrastructure-specific controls that don't translate directly to cloud network security practices.

Correct answer: D

Portability is the aspect most negatively impacted by vendor lock-in. When customers cannot easily move their data, applications, and workloads between different cloud providers, they lose the ability to switch vendors or migrate to alternative platforms, reducing their flexibility and independence.

Why the other options are wrong:

• A. Elasticity refers to scaling resources and is not directly compromised by vendor lock- in.
• B. Reversibility involves the ability to exit a service; while related, portability directly addresses moving between vendors.
• C. Interoperability is about systems working together; vendor lock-in reduces portability more directly than interoperability.

Correct answer: B

SOAP and REST are the most commonly used APIs within cloud environments. REST is lightweight and widely used for modern cloud services, while SOAP provides enterprise- grade messaging and is still prevalent in many cloud solutions. Both are standard API approaches in cloud computing.

Why the other options are wrong:

• A. SAML is an authentication protocol, not an API commonly used in cloud environments alongside REST.
• C. XML is a data format used within APIs, not an API itself; it is not a primary cloud API choice.
• D. XML is a data format and SAML is an authentication protocol; neither are the primary APIs used in cloud environments.

Correct answer: B

ISO/IEC 27050 is the international standard specifically designed for eDiscovery processes and best practices. It provides guidelines for electronic discovery in legal and investigative contexts, covering processes such as identification, preservation, collection, processing, review, analysis, and production of electronically stored information.

Why the other options are wrong:

• A. ISO/IEC 31000 addresses risk management, not eDiscovery.
• C. ISO/IEC 19888 does not relate to eDiscovery standards.
• D. ISO/IEC 27001 is an information security management standard, not an eDiscovery standard.

Correct answer: B

A cloud service broker is an intermediary that obtains new customers and secures contracts and agreements between cloud service providers and customers. The broker acts as a facilitator, negotiating terms and establishing business relationships.

Why the other options are wrong:

• A. An inter-cloud provider connects multiple cloud providers but does not focus on customer acquisition.
• C. A cloud auditor assesses cloud services for compliance and security, not customer acquisition.
• D. A cloud service developer creates and develops cloud applications and services, not customer-facing contracts.

Correct answer: A

Forensics relates to the application of scientific methods and practices to evidence. Digital forensics specifically applies investigative and analytical techniques to digital evidence in a manner that preserves integrity and follows established scientific methodologies.

Why the other options are wrong:

• B. Methodical describes a systematic approach but is not the technical term for applying science to evidence.
• C. Theoretical refers to conceptual frameworks rather than the application of scientific methods to evidence.
• D. Measured relates to quantification or careful assessment but does not capture the concept of applying science to evidence.

Correct answer: C

The cloud service manager is responsible for the provisioning and delivery of cloud services. This role manages the overall lifecycle of cloud service delivery, ensuring services are deployed and delivered to customers according to specifications and agreements.

Why the other options are wrong:

• A. A cloud service deployment manager prepares systems for the cloud and manages deployment infrastructure, not service provisioning and delivery.
• B. A cloud service business manager oversees business aspects and strategic decisions, not day-to-day service provisioning.
• D. A cloud service operations manager administers and monitors services and manages inventory, which is operational management rather than provisioning and delivery.

Correct answer: D

The primary reason resolving jurisdictional conflicts is complicated is the lack of international authority. Different nations maintain sovereign control over their legal systems, and no single international body has enforcement authority over all jurisdictions, making it difficult to resolve disputes that cross borders.

Why the other options are wrong:

• A. While different technology standards may create challenges, they are not the primary reason jurisdictional conflicts are difficult to resolve.
• B. Costs are a secondary factor; the fundamental issue is the lack of enforcement authority.
• C. Language barriers can impede communication but are not the primary reason for jurisdictional conflict complications.

Correct answer: B

Generally Accepted Accounting Principles (GAAPs) are created and maintained by the American Institute of Certified Public Accountants (AICPA). The AICPA establishes the standards that guide accounting practices in the United States.

Why the other options are wrong:

• A. ISO/IEC creates international standards for information technology and security, not accounting principles.
• C. The PCI Council maintains Payment Card Industry Data Security Standards, not GAAPs.
• D. ISO is a generic reference; the specific organization is the AICPA, which is the authoritative body for U.S. accounting standards.

Correct answer: C

A cloud service operations manager is responsible for preparing systems for the cloud, administering and monitoring services, and managing inventory and assets. This role handles the operational aspects of cloud deployment and ongoing service management.

Why the other options are wrong:

• A. A cloud service business manager focuses on business strategy and decision- making, not operational system preparation.
• B. A cloud service deployment manager prepares systems for initial cloud deployment but does not typically handle ongoing monitoring and inventory management.
• D. A cloud service manager focuses on overall service provisioning and delivery rather than the specific operational and administrative responsibilities described.

Correct answer: B

iSCSI (Internet Small Computer Systems Interface) allows a system to use block-level storage as if it were a SAN (Storage Area Network), but it operates over TCP network traffic rather than requiring dedicated Fibre Channel infrastructure. This enables cost- effective storage networking over standard Ethernet.

Why the other options are wrong:

• A. SATA is a direct-attached storage interface used within systems, not a network protocol for block-level storage access.
• C. TLS is a security protocol for encrypting communications, not a storage protocol.
• D. SCSI is a local bus protocol for direct device communication, not a network protocol for remote block-level storage access.

Correct answer: B

iCloud, Dropbox, and OneDrive are all public cloud services accessible to the general public over the internet. Users subscribe to these services and share the underlying infrastructure with other customers. This is the defining characteristic of public cloud deployment.

Why the other options are wrong:

• A. Hybrid clouds combine public and private infrastructure, which these consumer services do not do.
• C. Private clouds are restricted to a single organization and not available to the general public.
• D. Community clouds serve specific groups with shared interests, not the general consumer market like these services.

Correct answer: A

Type 2 hypervisors (hosted hypervisors) run as an application on top of a host operating system, making their security posture dependent on the security of that underlying OS. Any vulnerabilities in the host OS can compromise the hypervisor and all VMs. Type 1 hypervisors run directly on bare metal with no intervening OS layer, providing stronger isolation and security control.

Why the other options are wrong:

• B. Type 2 hypervisors do not inherently allow users more direct functions; user access controls are still in place.
• C. Being open source does not necessarily provide less security control than Type 1; many Type 1 hypervisors are also open source.
• D. Type 2 hypervisors are not inherently exposed to the public Internet; network exposure depends on configuration, not hypervisor type.

Correct answer: A

Data classification should occur at the Create phase of the data lifecycle, when data is first generated or collected. This is when the organization determines what type of data is being created and what protection level it requires. Classification at this early stage enables appropriate handling throughout the data's entire lifecycle.

Why the other options are wrong:

• B. The Use phase is when data is actively processed; classification should already be established before this point.
• C. The Share phase requires data to already be classified to determine appropriate access controls and sharing permissions.
• D. The Store phase requires prior classification to determine proper storage security controls and retention policies.

Correct answer: B

ASHRAE guidelines specify the optimal temperature range for data centers as 64.4-80.6°F (18-27°C). This range balances equipment performance, longevity, and energy efficiency. This is the standard recommendation for maintaining proper data center operating conditions and equipment reliability.

Why the other options are wrong:

• A. 69.8-86.0°F is too warm and exceeds ASHRAE optimal guidelines; this range is acceptable but not optimal.
• C. 51.8-66.2°F is too cold and outside the ASHRAE recommended range; this can cause condensation and equipment issues.
• D. 44.6-60.8°F is far too cold and would damage equipment through condensation and thermal stress.

Correct answer: B

Hex GBL is not a recognized risk management framework. COBIT is a governance and risk management framework, ISO 31000:2009 is an international standard for risk management, and NIST SP 800-37 provides risk management guidance for information systems. Hex GBL does not exist as an established risk management framework.

Why the other options are wrong:

• A. COBIT is a legitimate IT governance and risk management framework widely recognized and used in organizations.
• C. ISO 31000:2009 is an international standard specifically designed for risk management across all types of organizations.
• D. NIST SP 800-37 is an established NIST publication providing risk management and authorization processes for federal systems.

Correct answer: B

Cross-site scripting (XSS) involves injecting untrusted scripts into web pages viewed by users. When a user's browser executes this malicious script, it runs with that user's credentials and access permissions, allowing attackers to steal session tokens, perform actions on behalf of the user, or access sensitive data.

Why the other options are wrong:

• A. Missing function level access control is about insufficient authorization checks, not about sending code to browsers for execution.
• C. Cross-site request forgery tricks users into making requests, but doesn't involve executing untrusted code sent to the browser.
• D. Injection attacks insert malicious code into data inputs, but the specific execution with user credentials and browser context defines XSS.

Correct answer: A

Object storage systems store data as objects using a key-value model. Each object is uniquely identified by a key and contains the actual data (value). This approach differs from traditional file systems or databases and enables scalability and distributed storage across multiple nodes.

Why the other options are wrong:

• B. Database storage structures data in rows, columns, and tables, which is different from object storage's key-value model.
• C. LDAP is a directory service protocol for user authentication and authorization, not an object storage mechanism.
• D. Tree structures organize data hierarchically like file systems, whereas object storage uses a flat namespace with key-value pairs.

Correct answer: A

PCI DSS (Payment Card Industry Data Security Standard) is not a US federal government regulatory system. It is an industry standard created and maintained by the PCI Security Standards Council, a consortium of payment card companies. FISMA, SOX, and HIPAA are all US federal regulations: FISMA governs federal information security, SOX addresses corporate financial accountability, and HIPAA protects healthcare data.

Why the other options are wrong:

• B. FISMA (Federal Information Security Management Act) is a US federal law requiring information security standards for federal agencies.
• C. SOX (Sarbanes-Oxley Act) is US federal legislation mandating financial reporting and internal control standards for public companies.
• D. HIPAA (Health Insurance Portability and Accountability Act) is a US federal law protecting the privacy of health information.

Correct answer: D

The United States lacks a single comprehensive national privacy law at the federal level. Instead, it has a fragmented approach with sector-specific laws (HIPAA, GLBA, COPPA, etc.) and state-level regulations. In contrast, the EU has GDPR, Germany has comprehensive data protection laws, and Russia has federal privacy legislation (Federal Law on Personal Data).

Why the other options are wrong:

• A. The EU has GDPR, a comprehensive privacy regulation at the top level of legal authority.
• B. Germany has comprehensive privacy laws including the Federal Data Protection Act (BDSG) at the national level.
• C. Russia has Federal Law on Personal Data, providing national-level privacy regulation.

Correct answer: D

The Gramm-Leach-Bliley Act (GLBA) is specifically designed to protect PII in the financial industry, requiring financial institutions to safeguard customer information and inform customers about information practices. HIPAA applies to healthcare, SOX applies to corporate governance and auditing, and Safe Harbor is a data transfer mechanism (now replaced by Standard Contractual Clauses).

Why the other options are wrong:

• A. HIPAA governs healthcare privacy, not financial industry privacy.
• B. SOX (Sarbanes-Oxley) addresses corporate governance and financial reporting, not PII protection in finance.
• C. Safe Harbor is a framework for international data transfers, not focused on financial industry PII.