Risk and Compliance Management CISA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A mid-sized organization is establishing a privacy program to comply with new data protection regulations. The organization has limited resources and has not previously had a formal privacy function. Which of the following is the MOST effective first step for the organization to take?

   • AImplement technical controls, such as encryption and access controls, to protect personal data.
   • BConduct a data inventory and mapping exercise to identify what personal data is collected, where it is stored, and how it flows through the organization.
   • CAppoint a Data Protection Officer (DPO) and delegate all privacy responsibilities to this role.
   • DDevelop and publish a comprehensive privacy policy that outlines the organization's data handling practices.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An organization decides to purchase cyber insurance to cover potential losses from a data breach. Which risk response option does this represent?

   • AMitigate
   • BAvoid
   • CTransfer
   • DAccept
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A multinational organization is subject to both GDPR and the California Consumer Privacy Act (CCPA). The organization is designing a new customer data platform that will collect personal data from EU and California residents. The privacy team is evaluating the requirements. Which of the following is the MOST appropriate approach to ensure compliance with both regulations?

   • AApply the stricter of the two regulations to all personal data, regardless of the data subject's location.
   • BApply GDPR to EU residents and CCPA to California residents, treating them as separate data populations.
   • CConsult legal counsel to determine which regulation takes precedence and apply only that one.
   • DApply CCPA to all data because it is the more recent regulation and reflects current best practices.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which role is typically responsible for the day-to-day management of data quality and metadata for a specific data domain?

   • ADatabase administrator (DBA)
   • BChief information officer (CIO)
   • CData steward
   • DData protection officer (DPO)
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Under the GDPR, which of the following is a legal basis for processing personal data?

   • AThe data subject has given consent to the processing for one or more specific purposes
   • BThe data is publicly available on the internet
   • CThe data processor has been contracted to process the data
   • DThe data controller has a legitimate business interest in maximizing profits
   Reveal Solution Discussion Select an answer first