A mid-sized company wants to establish a compliance program that aligns with its business goals. Which of the following is the most important first step?

Train all employees on compliance policies immediately.

Purchase a GRC tool to automate compliance tracking.

Hire external consultants to write policies.

Conduct a compliance risk assessment to identify applicable regulations and gaps.

A company is implementing ISO 27001 and wants to align its compliance program with the standard. The CISO needs to ensure that the program addresses the requirements of the standard. What is the most important initial step?

Hire an external auditor to certify the company without prior preparation.

Purchase ISO 27001 compliance software to automate all requirements.

Conduct a gap analysis against ISO 27001 controls and develop a remediation plan.

Immediately implement all ISO 27001 controls to achieve certification quickly.

A financial services firm must demonstrate ongoing compliance with PCI DSS to its acquiring bank. The compliance officer wants to automate evidence collection and reporting. Which approach best supports continuous compliance monitoring?

Conduct an annual external audit and file the report with the bank.

Rely on the bank's own monitoring to ensure compliance.

Implement a governance, risk, and compliance (GRC) platform that integrates with the firm's systems to collect control evidence and generate reports.

Perform a quarterly manual review of firewall logs and submit a summary to the bank.

A financial institution is subject to both GLBA and PCI DSS. The CISO must ensure compliance with both. Which approach is most appropriate?

Implement a unified control framework that maps GLBA and PCI DSS requirements to common controls.

Treat GLBA and PCI DSS as separate programs with no overlap.

Prioritize PCI DSS because it is more specific to payment card data.

Rely on the payment processor's compliance to satisfy PCI DSS.

An EU company transfers personal data to a subsidiary in a country that has an adequacy decision from the European Commission. However, the subsidiary's government has recently passed a law allowing broad surveillance. What should the company do?

Immediately stop all transfers without further analysis.

Reassess the transfer and consider suspending it if the law undermines the level of protection.

Rely on the subsidiary's self-assessment of compliance.

Continue transferring data because the adequacy decision is permanent.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 3

Regulatory and Legal Compliance CCISO Practice Questions (Page 9)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

9concepts

Questions 41–45

41application · medium
A mid-sized company wants to establish a compliance program that aligns with its business goals. Which of the following is the most important first step?
Select an answer first
42application · medium
A company is implementing ISO 27001 and wants to align its compliance program with the standard. The CISO needs to ensure that the program addresses the requirements of the standard. What is the most important initial step?
Select an answer first
43application · medium
A financial services firm must demonstrate ongoing compliance with PCI DSS to its acquiring bank. The compliance officer wants to automate evidence collection and reporting. Which approach best supports continuous compliance monitoring?
Select an answer first
44application · medium
A financial institution is subject to both GLBA and PCI DSS. The CISO must ensure compliance with both. Which approach is most appropriate?
Select an answer first
45expert · hard
An EU company transfers personal data to a subsidiary in a country that has an adequacy decision from the European Commission. However, the subsidiary's government has recently passed a law allowing broad surveillance. What should the company do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.