Regulatory and Legal Compliance CCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company suffers a data breach involving personal data of EU residents. The CISO must decide whether to notify the supervisory authority within 72 hours. The breach is low-risk, but the company is unsure if it meets the threshold for notification. What should the CISO do?

   • ANotify the supervisory authority immediately regardless of risk, to avoid any penalty for late notification.
   • BConduct a risk assessment to determine the likelihood and severity of impact on individuals, and notify if the risk is not low.
   • CNotify only if the breach involves financial data, as other personal data is lower risk.
   • DWait until the investigation is complete and then decide whether to notify.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a typical output of a compliance risk assessment?

   • AA marketing plan for the organization
   • BA list of all employees and their job titles
   • CA detailed network diagram of the organization
   • DA list of compliance gaps and associated risk levels
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a potential consequence of non-compliance with data protection regulations such as GDPR?

   • AAutomatic revocation of the organization's business license
   • BImmediate imprisonment of the Chief Information Security Officer
   • CFines of up to 4% of annual global turnover or €20 million, whichever is higher
   • DLoss of all intellectual property rights
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has implemented a compliance monitoring program, but the board is concerned that the program is not providing actionable insights. The CISO needs to improve the program. What should the CISO do first?

   • AHire an external consultant to review the compliance program.
   • BIncrease the frequency of compliance audits to gather more data.
   • CDefine key risk indicators (KRIs) and key performance indicators (KPIs) that align with the company's risk appetite and compliance objectives.
   • DImplement a new compliance software platform.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is considering adopting a compliance framework to manage multiple regulatory obligations. The company is a small business with limited resources. Which framework would be most appropriate to start with?

   • AISO 27001 certification immediately.
   • BAdopt the most comprehensive framework, such as NIST SP 800-53, without tailoring.
   • CNIST Cybersecurity Framework (CSF) as a baseline, then map to specific regulations.
   • DA custom framework developed from scratch.
   Reveal Solution Discussion Select an answer first