Risk and Compliance Management CISA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of data classification?

   • ATo assign a level of sensitivity to data so that appropriate handling requirements can be applied
   • BTo reduce the amount of data stored by the organization
   • CTo determine the storage location for all data
   • DTo ensure data is accessible to all employees
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization's IT risk committee meets quarterly to review risk status. The CISO wants to provide a concise, forward-looking view of emerging risks to the committee. Which of the following would be the MOST effective approach for the CISO to use?

   • ADistribute the latest risk register with all identified risks and their current risk ratings, sorted by impact.
   • BPresent a dashboard of key risk indicators (KRIs) that track leading indicators, such as the number of unpatched critical systems and the rate of failed access attempts.
   • CSummarize the results of the latest vulnerability scan and list the top 10 vulnerabilities by CVSS score.
   • DProvide a detailed report of all risk assessment findings from the past year, including historical loss data and incident trends.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A healthcare organization is implementing a data classification policy. The policy defines four classification levels: Public, Internal, Confidential, and Restricted. The organization stores patient records (Restricted), employee HR data (Confidential), and marketing materials (Public). The IT department is configuring a new file-sharing system. Which of the following is the MOST appropriate configuration for handling Restricted data?

   • AEncrypt the data at rest but allow broad access to simplify collaboration.
   • BRestrict access to a limited group of authorized users and enable audit logging for all access and modifications.
   • CStore the data in a separate system that is not connected to the network to prevent any access.
   • DAllow all employees to access the data but require them to sign a confidentiality agreement.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of a key risk indicator (KRI) in risk monitoring?

   • ATo document the results of risk assessments for audit purposes
   • BTo measure the performance of IT processes against service level agreements
   • CTo provide an early warning signal that a risk may be increasing
   • DTo determine the financial value of IT assets
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of a data handling requirement that would apply to highly sensitive data?

   • AAccess granted to all employees by default
   • BDeletion after 30 days regardless of legal requirements
   • CEncryption of data at rest and in transit
   • DPublic posting on the organization's website
   Reveal Solution Discussion Select an answer first