What is the first step in developing an effective security training program?

Conducting a training needs assessment

Selecting the training delivery platform

Delivering the training to all employees

Evaluating the training's effectiveness

A user requests access to all personal data that a company holds about them. Under GDPR, what is this right called, and what must the company do?

Right to data portability; transfer the data to another organization

Right to restrict processing; stop all processing of the data

Right to erasure; delete all personal data immediately

Right of access; provide a copy of the personal data in a commonly used format

What is a key implication of the California Consumer Privacy Act (CCPA) for organizations that do business in California?

They must provide consumers with the right to access and delete their personal information

They must store all personal data within the state of California

They must obtain explicit consent before collecting any personal data

They must appoint a Data Protection Officer (DPO)

A system administrator is setting up access controls for a new application. They want to ensure that users are who they claim to be and that they can only perform actions they are permitted to do. Which two security concepts are being implemented?

Availability and non-repudiation

Data minimization and purpose limitation

Authentication and authorization

Certified in Risk and Information Systems Control

Domain 4Objective 4

Security and Privacy CRISC Practice Questions (Page 4)

Part of the Domain 4: Technology and Security domain, which accounts for 20% of the CRISC exam.

32questions here

7free pages

8concepts

20%of the exam

Questions 16–20

16foundation · easy
What is the first step in developing an effective security training program?
Select an answer first
17application · medium
A user requests access to all personal data that a company holds about them. Under GDPR, what is this right called, and what must the company do?
Select an answer first
18foundation · easy
What is a key implication of the California Consumer Privacy Act (CCPA) for organizations that do business in California?
Select an answer first
19application · medium
A system administrator is setting up access controls for a new application. They want to ensure that users are who they claim to be and that they can only perform actions they are permitted to do. Which two security concepts are being implemented?
Select an answer first
20foundation · easy
Which data protection principle requires that an organization be able to demonstrate how it complies with data protection requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.