Risk and Compliance Management CISA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of risk prioritization in the IT risk assessment process?

   • ATo rank risks so that resources can be focused on the most significant ones
   • BTo determine the likelihood and impact of each risk
   • CTo select the most appropriate risk response for each risk
   • DTo identify all potential risks that could affect the organization
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which privacy principle, as outlined in the OECD guidelines, requires that personal data be collected only for specified, explicit, and legitimate purposes?

   • AIndividual participation
   • BPurpose specification
   • CSecurity safeguards
   • DData minimization
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large organization is implementing a data governance program. The program includes data stewardship, data quality, and data lifecycle management. The organization has a mix of structured and unstructured data across multiple systems. Which of the following is the MOST critical challenge for the data governance program to address?

   • AAutomating data quality checks to ensure accuracy and completeness of data.
   • BEstablishing data retention and disposal policies for all data types.
   • CImplementing a data catalog to inventory all data assets across the organization.
   • DDefining clear data ownership and accountability for each data domain.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of data governance?

   • ATo maximize the amount of data collected from customers
   • BTo store all data in a single database for easy access
   • CTo ensure that data is managed as a valuable organizational asset
   • DTo eliminate the need for data security controls
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational corporation is implementing an ERM framework aligned with ISO 31000. The board has set a risk appetite that is 'moderate' for operational risks but 'low' for compliance risks. During a risk assessment, the IT department identifies a new cloud service that would reduce operational costs but introduces a compliance risk because the service provider stores data in a country without adequate data protection laws. The IT department proposes accepting the risk because the cost savings are significant. Which of the following is the MOST appropriate action for the risk manager?

   • AMitigate the risk by requiring the cloud provider to sign a data processing agreement that includes standard contractual clauses.
   • BEscalate the proposal to the board with a recommendation to accept the risk, highlighting the cost savings and the residual risk.
   • CAccept the proposal because the operational cost savings are significant and the risk is within the moderate operational risk appetite.
   • DReject the proposal because the compliance risk exceeds the board's low appetite for compliance risks, regardless of cost savings.
   Reveal Solution Discussion Select an answer first