Cybersecurity Governance CCOA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of cybersecurity governance?

   • ATo transfer all cybersecurity risks to external insurance providers.
   • BTo implement the most advanced security technologies available regardless of cost.
   • CTo align cybersecurity strategy and operations with the organization's business objectives and risk tolerance.
   • DTo ensure that all employees have equal access to security tools and data.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which compliance framework is specifically designed to protect cardholder data and applies to any organization that stores, processes, or transmits credit card information?

   • ASOC 2
   • BHIPAA
   • CPCI DSS
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial services firm wants to ensure that its cybersecurity program is subject to independent review and that the board receives regular updates on security posture. Which oversight mechanism would best achieve this?

   • AEstablishing an internal audit function that reports directly to the audit committee of the board.
   • BConducting an annual security awareness training for all employees.
   • CPurchasing a cyber insurance policy to cover potential losses.
   • DHaving the CISO report directly to the Chief Financial Officer.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company that processes personal data of EU citizens is subject to GDPR. The company has a data breach that exposes personal data. What is the most immediate regulatory requirement the company must fulfill?

   • ADelete all personal data that was involved in the breach.
   • BNotify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals.
   • CNotify all affected individuals immediately, regardless of the risk level.
   • DPay a fine to the supervisory authority to avoid further investigation.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A multinational company with offices in the EU and the US is updating its data handling policies. The legal team notes that the company must comply with GDPR for EU residents' personal data. What is the most direct impact of this regulatory requirement on the company's cybersecurity governance?

   • AThe company must appoint a data protection officer regardless of its size or processing activities.
   • BThe company must implement technical and organizational measures to protect personal data and ensure data protection by design and by default.
   • CThe company must obtain explicit consent for all data processing activities.
   • DThe company must store all personal data on servers located within the EU.
   Reveal Solution Discussion Select an answer first