Legal, Regulatory and Contractual Requirements CISM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A software development company is engaging a third-party vendor to perform penetration testing on its production application. The contract includes a clause that the vendor will not be liable for any damages resulting from the testing. The information security manager is concerned about this clause. What is the most appropriate action?

   • ANegotiate the clause to limit liability to damages caused by the vendor's negligence or willful misconduct.
   • BRequire the vendor to sign a non-disclosure agreement (NDA) to protect the company's data.
   • CCancel the penetration test and conduct it internally to avoid the liability issue.
   • DAccept the clause because penetration testing is inherently risky and the vendor should not be held liable.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the PRIMARY objective of a compliance management process in information security governance?

   • ATo achieve a single certification that covers all compliance needs
   • BTo ensure the organization continuously meets all applicable legal, regulatory, and contractual requirements
   • CTo transfer compliance responsibilities to external auditors
   • DTo minimize the cost of compliance by adopting a reactive approach
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A bank is required to comply with both PCI DSS and local banking regulations. The information security manager is designing a compliance monitoring process. Which approach is most effective for ensuring ongoing compliance with both sets of requirements?

   • AConduct separate annual audits for each regulation to ensure independent verification.
   • BDocument all compliance activities in a policy manual and update it annually.
   • CRely on the annual self-assessment questionnaire (SAQ) required by PCI DSS.
   • DImplement a continuous monitoring program that tracks key security controls and alerts on deviations.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a legal requirement that an information security manager should consider when developing security governance?

   • AA data protection law that mandates breach notification to affected individuals
   • BA company policy requiring employees to use strong passwords
   • CAn industry best practice recommending annual penetration testing
   • DA contractual clause requiring the organization to maintain cyber insurance
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the PRIMARY purpose of assessing the impact of legal, regulatory, and contractual requirements on information security governance?

   • ATo determine the resources and controls needed to achieve compliance
   • BTo decide whether to accept or avoid each requirement
   • CTo document all requirements for external auditors
   • DTo compare the organization's security posture with competitors
   Reveal Solution Discussion Select an answer first