What Best Describes Researching Security Laws and Regulations?

SY0-701 By islever Editorial Last updated

Short answer

C Due diligence

Question

Which of the following best describes the practice of researching laws and regulations related to information security operations within a specific industry?
  1. Compliance reporting
  2. GDPR
  3. Due diligence Correct Answer
  4. Attestation

Key Takeaways

This question tests your ability to identify proactive legal research in GRC frameworks, commonly confused with documentation-heavy practices like attestation or compliance reporting.

Due diligence is the proactive investigation of applicable laws, regulations, and industry standards to ensure legal and operational compliance. The community unanimously agrees that researching these requirements defines due diligence rather than reactive reporting or specific regional mandates.

Common mistake: Candidates often select 'Compliance reporting' or 'Attestation' by mistakenly equating the research phase with post-implementation documentation or third-party certification processes.

Expert Analysis

Why the Answer Is Correct

Due diligence represents the proactive effort to investigate, research, and understand applicable laws, regulations, and industry standards before implementing security controls. In the context of SY0-701, this practice ensures that an organization identifies legal obligations early to effectively manage risk and avoid penalties. The question explicitly highlights the research phase, which is the foundational step of due diligence.

Why the Other Options Are Wrong

Compliance reporting involves documenting and submitting evidence of adherence after controls are already in place, rather than the initial research stage. GDPR is a specific regional data privacy regulation, not a generalized practice or methodology for legal research. Attestation requires a formal third-party validation that controls meet predefined criteria, which occurs much later in the governance lifecycle.

Community Comment Notes

Multiple contributors confirmed option C as correct, emphasizing that due diligence inherently covers the thorough investigation of legal and regulatory landscapes [1][2]. Commenters clarified that while GDPR is a well-known mandate, due diligence is the overarching process used to identify and comply with such requirements [3]. The unanimous voting pattern demonstrates strong candidate alignment with the official exam objectives regarding GRC terminology.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Focus on distinguishing proactive governance activities like due diligence and due care from reactive documentation tasks such as compliance reporting or attestation. Create flashcards for GRC vocabulary pairs, as SY0-701 consistently tests nuanced differences between similar-sounding compliance terms.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. nillie 👍 1 Answered C
    The best term to describe the practice of researching laws and regulations related to information security operations within a specific industry is: C. Due diligence Due diligence refers to the process of thoroughly investigating and ensuring that an organization's practices, especially in information security, comply with applicable laws, regulations, and industry standards. It involves identifying and understanding the legal requirements to avoid risks and ensure proper adherence to security policies.
  2. Kingamj 👍 1 Answered C
    C. Due diligence. Due diligence in the context of information security operations involves researching and understanding the laws, regulations, and standards that apply to a specific industry to ensure compliance and manage risks effectively. It’s a key practice for identifying and addressing legal and regulatory requirements related to information security.
  3. 9149f41 👍 1 Answered C
    Due diligence refers to conducting a thorough investigation and appropriate response to a situation

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide