Information Governance CGEIT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the context of information governance, what is the typical relationship between a policy and a standard?

   • APolicies and standards are interchangeable terms with no practical difference.
   • BA standard is optional guidance, while a policy is a mandatory rule.
   • CA policy is a high-level statement of intent, while a standard provides specific mandatory requirements to support that policy.
   • DA standard is a broad principle, while a policy is a detailed procedure for daily operations.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multinational corporation is defining decision rights for its customer database. The marketing department wants to use the data for a new analytics project, but the privacy officer has concerns about the use of personal data. The corporation's governance policy states that the privacy officer has the final say on any use of personal data. What is the most appropriate action for the marketing department?

   • ASubmit the analytics project to the privacy officer for review and approval before proceeding.
   • BAsk the IT department to anonymize the data so the privacy officer's approval is not needed.
   • CProceed with the analytics project, since marketing is the primary user of the customer database.
   • DEscalate the issue to the CEO, since the analytics project is strategically important.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of assigning decision rights for information assets?

   • ATo ensure that all decisions are made by the IT department.
   • BTo eliminate the need for escalation processes.
   • CTo allow any employee to make decisions about any information asset.
   • DTo clarify who has the authority to make decisions about the information, such as classification and access.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which role is typically responsible for implementing the technical controls that protect information assets?

   • AInformation owner
   • BData subject
   • CInformation custodian
   • DChief Information Officer (CIO)
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A global bank operates in multiple jurisdictions with conflicting data retention laws. One jurisdiction requires customer transaction records to be kept for 10 years, while another requires deletion after 5 years. The bank's current policy mandates a single global retention period of 7 years. An auditor has flagged this as non-compliant. What is the most appropriate governance response?

   • ADevelop jurisdiction-specific retention schedules that comply with each local law, and document the rationale for each.
   • BAdopt the least restrictive retention period (5 years) globally to minimize storage costs.
   • CAdopt the most restrictive retention period (10 years) globally to ensure compliance in all jurisdictions.
   • DRetain the 7-year global policy and rely on the bank's legal team to negotiate with regulators.
   Reveal Solution Discussion Select an answer first