Compliance, Ethics, and Culture CGEIT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A financial services firm has a culture where employees often bypass IT security controls to meet sales targets. The board has asked the IT governance team to foster a culture that supports compliance. Which strategy is most effective for cultural change?

   • AAppoint compliance champions within each business unit to model and promote compliant behavior.
   • BRedesign the sales incentive plan to remove all performance bonuses for a quarter.
   • CIncrease the severity of penalties for employees who are found to bypass controls.
   • DLaunch a one-time training program on the importance of compliance and security.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A global e-commerce company stores customer data in multiple regions. The company is subject to GDPR and must ensure that personal data of EU residents is protected. Which action is a direct obligation under GDPR?

   • AEnsure that any transfer of personal data outside the EU is based on an appropriate legal mechanism, such as Standard Contractual Clauses.
   • BImplement a data classification scheme to label all data according to its sensitivity.
   • CAppoint a Data Protection Officer (DPO) for every company that processes personal data.
   • DConduct an annual penetration test of all systems that process personal data.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A multinational retail company processes customer payment data and must comply with PCI DSS. The IT governance team is designing a compliance risk assessment. Which action best aligns with PCI DSS requirements?

   • AImplement a data loss prevention (DLP) solution that blocks all outbound transmission of cardholder data.
   • BPerform a quarterly vulnerability scan of all external-facing systems and remediate any critical findings within 72 hours.
   • CConduct an annual risk assessment that includes identifying and documenting threats and vulnerabilities that could impact cardholder data.
   • DOutsource the risk assessment to a Qualified Security Assessor (QSA) to ensure independence and avoid internal bias.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A nonprofit organization relies on donations and has a small IT budget. The IT director discovers that a donor's personal data was accidentally exposed in a data breach. The organization is not legally required to notify the donor, but the director believes it is the ethical thing to do. However, the board is concerned about reputational damage and legal liability. Which action best balances ethics and governance?

   • ADo not notify the donor because there is no legal requirement and the risk of reputational damage is high.
   • BNotify the donor and offer credit monitoring services, even though it is not legally required.
   • CNotify the donor but do not offer credit monitoring to minimize costs.
   • DConsult with legal counsel and insurance providers to assess the risks before deciding whether to notify.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following best illustrates the integration of ethics into compliance and governance processes?

   • ADelegating all ethical decisions to external consultants.
   • BIncluding a code of conduct that outlines ethical expectations as part of the compliance training program.
   • CKeeping ethics discussions separate from compliance activities to avoid confusion.
   • DFocusing compliance efforts solely on legal requirements and ignoring ethical considerations.
   Reveal Solution Discussion Select an answer first