Under the General Data Protection Regulation (GDPR), which of the following is a legal obligation for organizations that process personal data?

Storing all personal data within the European Union

Appointing a Data Protection Officer (DPO) in all cases

Obtaining explicit consent for all data processing activities

Implementing appropriate technical and organizational measures to ensure data security

A company is developing a compliance program and wants to align it with business goals. The CISO needs to ensure that the program is effective. What is the most important element?

A comprehensive set of policies and procedures.

Executive sponsorship and clear governance structure.

Automated compliance monitoring tools.

Regular compliance training for all employees.

A compliance officer is implementing a monitoring program for a multinational company. The company has operations in the EU, US, and Asia. Which of the following is the most important consideration when designing the monitoring program?

Monitor only after a compliance breach occurs.

Focus only on the most stringent regulation to simplify monitoring.

Align monitoring metrics with the specific regulatory requirements of each jurisdiction.

Use the same set of metrics globally to ensure consistency.

A company is facing a compliance audit and has identified several gaps. The CISO has limited resources to remediate the gaps. Which gaps should be prioritized?

Gaps that are easiest to fix, to quickly reduce the number of findings.

Gaps that are most visible to the auditor, to improve the audit outcome.

Gaps that have been open the longest, regardless of risk.

Gaps that pose the highest risk to the organization and are required by multiple regulations.

What is the first step in developing an effective compliance program?

Purchasing compliance management software

Conducting a risk assessment to identify applicable regulations and gaps

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 3

Regulatory and Legal Compliance CCISO Practice Questions (Page 4)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

9concepts

Questions 16–20

16foundation · easy
Under the General Data Protection Regulation (GDPR), which of the following is a legal obligation for organizations that process personal data?
Select an answer first
17application · medium
A company is developing a compliance program and wants to align it with business goals. The CISO needs to ensure that the program is effective. What is the most important element?
Select an answer first
18expert · hard
A compliance officer is implementing a monitoring program for a multinational company. The company has operations in the EU, US, and Asia. Which of the following is the most important consideration when designing the monitoring program?
Select an answer first
19expert · hard
A company is facing a compliance audit and has identified several gaps. The CISO has limited resources to remediate the gaps. Which gaps should be prioritized?
Select an answer first
20foundation · easy
What is the first step in developing an effective compliance program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.