Risk and Compliance Management CISA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a key component of establishing a privacy program?

   • AEnsuring all personal data is stored in a single centralized database
   • BHiring an external auditor to certify the program annually
   • CPurchasing the most expensive security software available
   • DDeveloping and implementing privacy policies and procedures
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of a key risk indicator (KRI) for IT security?

   • APercentage of systems with up-to-date antivirus definitions
   • BCost of IT training per employee
   • CNumber of help desk tickets resolved per day
   • DAverage time to deploy new servers
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services firm has identified a high-risk vulnerability in its customer-facing web application that could expose credit card data. The vulnerability is in a third-party component that is no longer supported by the vendor. The firm's risk appetite is low, and the application is critical to business operations. Which of the following risk response options is the MOST appropriate given the constraints?

   • AAccept the risk because the vulnerability is in a third-party component and the firm cannot control the vendor's support lifecycle.
   • BMitigate the risk by implementing a web application firewall (WAF) and virtual patching to reduce the exploitability of the vulnerability.
   • CAvoid the risk by taking the web application offline until the third-party component can be replaced.
   • DTransfer the risk by purchasing cyber insurance to cover any losses from a potential data breach.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A global e-commerce company processes personal data of customers in the European Union (EU) and the United States. The company is designing a new marketing analytics platform that will store customer purchase history and browsing behavior. The privacy team is tasked with ensuring compliance with GDPR. Which of the following is the MOST critical requirement for the platform design?

   • AImplement data minimization by collecting only the personal data necessary for the marketing analytics purpose.
   • BObtain explicit consent from every customer before any data is collected, regardless of the processing purpose.
   • CEnsure that all personal data is stored on servers located within the EU to comply with data residency requirements.
   • DAppoint a Data Protection Officer (DPO) before the platform is deployed, as this is mandatory for all companies processing personal data.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A financial institution has implemented a risk monitoring program. The board of directors receives a quarterly risk report that includes key risk indicators (KRIs). The CRO notices that one KRI, the number of unresolved high-risk audit findings, has been steadily increasing over the past three quarters. Which of the following is the MOST appropriate action for the CRO to take?

   • AAdjust the KRI threshold to a higher level so that the trend does not trigger an alert.
   • BRemove the KRI from the report because it is no longer providing useful information.
   • CWait for the next quarter to see if the trend continues before taking any action.
   • DEscalate the trend to the board and recommend additional resources to resolve the high-risk findings.
   Reveal Solution Discussion Select an answer first