Risk and Compliance Management CISA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A large enterprise is implementing a data governance program. The data governance committee has approved a new data classification policy. The IT department is now responsible for enforcing the policy. Which of the following is the MOST critical component for the IT department to implement to ensure the policy is effective?

   • AA data stewardship program that assigns business owners to each data domain to oversee classification decisions.
   • BAutomated data classification tools that scan and label data based on predefined rules and patterns.
   • CA data quality framework that defines data accuracy, completeness, and consistency metrics.
   • DA data lifecycle management policy that defines retention and disposal schedules for each data classification level.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An organization has implemented a privacy program and appointed a Data Protection Officer (DPO). The DPO is responsible for monitoring compliance. During a routine audit, the DPO discovers that the marketing department has been collecting customer data without a lawful basis for processing. Which of the following is the MOST appropriate action for the DPO to take?

   • AIgnore the issue because the DPO is not responsible for operational decisions made by other departments.
   • BUpdate the privacy policy to reflect the new data collection practice, making it compliant.
   • CRetroactively obtain consent from the customers whose data was collected without a lawful basis.
   • DReport the issue to senior management and recommend that the data collection be stopped until a lawful basis is established.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which risk response option involves taking action to reduce the likelihood or impact of a risk?

   • ATransfer
   • BAccept
   • CAvoid
   • DMitigate
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An organization is conducting a risk assessment for a new customer relationship management (CRM) system that will store sensitive customer data. The risk team has identified several risks, including unauthorized access, data loss, and system downtime. The team is now prioritizing the risks for treatment. Which of the following is the MOST appropriate approach for prioritizing these risks?

   • APrioritize the risks based on the likelihood of occurrence, with the most likely risks addressed first.
   • BRank the risks based on the product of likelihood and impact, and then compare each risk to the organization's risk criteria.
   • CPrioritize the risks based on the ease of implementation, with the easiest risks addressed first.
   • DPrioritize the risks based on the cost of mitigation, with the lowest-cost risks addressed first.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which statement best describes the role of risk appetite in an enterprise risk management (ERM) framework?

   • AIt defines the maximum acceptable level of risk an organization is willing to take to achieve its objectives.
   • BIt is the process of identifying, assessing, and responding to risks across the enterprise.
   • CIt is the amount of risk that remains after all planned controls have been implemented.
   • DIt specifies the exact risk level that triggers mandatory mitigation actions for each identified risk.
   Reveal Solution Discussion Select an answer first