A global company must comply with both GDPR and the California Consumer Privacy Act (CCPA). The compliance team notices that GDPR requires a Data Protection Impact Assessment (DPIA) for high-risk processing, while CCPA does not. How should the company handle this discrepancy?

Conduct DPIAs for all processing that meets GDPR's high-risk criteria, regardless of location.

Conduct DPIAs only for processing that is subject to both GDPR and CCPA.

Skip DPIAs for California residents because CCPA does not require them.

Adopt CCPA as the baseline for all processing to simplify compliance.

What is the primary purpose of compliance monitoring and reporting?

To guarantee that no compliance violations will ever occur

To ensure ongoing adherence to regulatory requirements and inform stakeholders

To replace the need for internal audits

To automatically remediate all compliance issues without human intervention

A financial services firm must demonstrate ongoing compliance with GDPR to its board of directors. The CISO has implemented technical controls but needs a process to provide regular assurance. What should the CISO implement?

A policy that requires all employees to sign a GDPR compliance acknowledgment.

An annual external audit report that is shared with the board.

A one-time gap assessment against GDPR requirements.

A continuous compliance monitoring program that includes automated control testing and quarterly reporting to the board.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 3

Regulatory and Legal Compliance CCISO Practice Questions (Page 10)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

9concepts

Questions 46–50

46expert · hard
A global company must comply with both GDPR and the California Consumer Privacy Act (CCPA). The compliance team notices that GDPR requires a Data Protection Impact Assessment (DPIA) for high-risk processing, while CCPA does not. How should the company handle this discrepancy?
Select an answer first
47foundation · easy
Which US federal regulation applies to educational institutions and protects the privacy of student education records?
Select an answer first
48foundation · easy
What is the primary purpose of compliance monitoring and reporting?
Select an answer first
49application · medium
A financial services firm must demonstrate ongoing compliance with GDPR to its board of directors. The CISO has implemented technical controls but needs a process to provide regular assurance. What should the CISO implement?
Select an answer first
50foundation · easy
Which regulation is specifically designed to protect financial consumers' personal information held by financial institutions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Regulatory and Legal Compliance CCISO Practice Questions (Page 10)

Questions 46–50

A global company must comply with both GDPR and the California Consumer Privacy Act (CCPA). The compliance team notices that GDPR requires a Data Protection Impact Assessment (DPIA) for high-risk processing, while CCPA does not. How should the company handle this discrepancy?

Which US federal regulation applies to educational institutions and protects the privacy of student education records?

What is the primary purpose of compliance monitoring and reporting?

A financial services firm must demonstrate ongoing compliance with GDPR to its board of directors. The CISO has implemented technical controls but needs a process to provide regular assurance. What should the CISO implement?

Which regulation is specifically designed to protect financial consumers' personal information held by financial institutions?

Keep studying — Governance, Risk, and Compliance