A company must demonstrate ongoing compliance with GDPR to its board of directors. The CISO wants to implement a monitoring and reporting mechanism. Which approach is most effective?

Rely on the legal team to report compliance status annually without technical input.

Conduct a one-time compliance audit and present the results to the board.

Implement automated compliance monitoring tools that continuously assess controls and generate periodic reports for the board.

Wait for a regulatory inspection to identify compliance gaps.

A company is found to be non-compliant with a data protection regulation. The regulator is deciding on the penalty. The company has a compliance program, but it was not fully effective. Which factor is most likely to reduce the penalty?

The company voluntarily reported the issue, cooperated with the investigation, and took steps to remediate the non-compliance.

The company has a large market share and can afford the fine.

The company has a strong social media presence.

The company's legal team is well-known and respected.

A company is considering whether to self-report a data breach to the regulator. The breach affected a small number of individuals, but the company is unsure if it meets the reporting threshold. What is the best course of action?

Do not report because the number of individuals is small

Report all breaches regardless of risk

Conduct a risk assessment to determine if the breach poses a risk to individuals

Report the breach only if the media finds out

A company suffers a data breach that exposes personal data of EU residents. The supervisory authority initiates an investigation and finds that the company had not implemented appropriate technical measures. What is the most likely consequence?

The company will be required to delete all personal data it holds, regardless of legal obligations.

The company's executives will be personally liable and face criminal prosecution.

The company may face administrative fines up to €20 million or 4% of global annual turnover, whichever is higher.

The company will receive a warning and a grace period to fix the issue without any fine.

A company wants to automate compliance monitoring for multiple regulations. It has limited budget and staff. Which approach is most effective?

Outsource compliance monitoring to a third-party auditor

Implement a GRC tool that maps controls to multiple regulations

Use manual spreadsheets for tracking compliance

Hire additional compliance staff

EC-CouncilAssociate C|CISO

Domain 1Objective 3

Regulatory and Legal Compliance ACCISO Practice Questions (Page 2)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 6–10

6application · medium
A company must demonstrate ongoing compliance with GDPR to its board of directors. The CISO wants to implement a monitoring and reporting mechanism. Which approach is most effective?
Select an answer first
7expert · hard
A company is found to be non-compliant with a data protection regulation. The regulator is deciding on the penalty. The company has a compliance program, but it was not fully effective. Which factor is most likely to reduce the penalty?
Select an answer first
8expert · hard
A company is considering whether to self-report a data breach to the regulator. The breach affected a small number of individuals, but the company is unsure if it meets the reporting threshold. What is the best course of action?
Select an answer first
9application · medium
A company suffers a data breach that exposes personal data of EU residents. The supervisory authority initiates an investigation and finds that the company had not implemented appropriate technical measures. What is the most likely consequence?
Select an answer first
10expert · hard
A company wants to automate compliance monitoring for multiple regulations. It has limited budget and staff. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.