Regulatory and Legal Compliance CCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Under the GDPR, which of the following is a valid mechanism for transferring personal data from the EU to a third country?

   • AA simple privacy policy on the company website
   • BA verbal agreement between data controllers
   • CStandard Contractual Clauses (SCCs)
   • DAn internal memorandum from the data protection officer
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A defense contractor must comply with DFARS and NIST SP 800-171. The contractor also handles export-controlled data subject to ITAR. What is the primary compliance obligation?

   • AComply with DFARS and NIST SP 800-171 for CUI, and ITAR for export-controlled data.
   • BComply only with ITAR because it is more restrictive.
   • CImplement a single set of controls that satisfies all three regulations.
   • DComply only with DFARS because it is contractually required.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a key component of a mature compliance program?

   • AA compliance program that operates independently of business goals
   • BContinuous monitoring and periodic reporting to management
   • CA static policy document that is never updated
   • DA one-time training session for all employees
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is considering whether to self-report a compliance violation to a regulatory authority. The violation is not publicly known, but the company has discovered it during an internal audit. What is the most important factor in deciding whether to self-report?

   • AThe potential for reduced penalties if the company self-reports and cooperates with the authority.
   • BThe cost of remediation versus the cost of potential fines.
   • CThe opinion of external legal counsel on the severity of the violation.
   • DThe likelihood that the violation will be discovered by the authority independently.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is required to report its compliance status to the board of directors on a quarterly basis. The CISO has implemented a compliance monitoring system. What is the most effective way to report to the board?

   • ASend a detailed technical report of all control test results.
   • BVerbally summarize the compliance status without supporting data.
   • CProvide a dashboard that shows key compliance metrics, trends, and any gaps or remediation efforts.
   • DReport only on areas that are fully compliant, to present a positive image.
   Reveal Solution Discussion Select an answer first