6.3 Validate Compliance in Accordance with Applicable Laws, Regulations, and Industry Standards ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of communicating compliance information to senior management?

   • ATo ensure that senior management understands the organization's compliance obligations, risks, and status so they can make informed decisions and provide necessary support.
   • BTo delegate all compliance responsibilities to senior management so that the security team can focus on other tasks.
   • CTo formally warn senior management of legal consequences if they fail to act on compliance issues.
   • DTo satisfy external auditors by providing them with documentation of management's involvement.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A global technology company must comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The company is evaluating compliance frameworks to support both requirements. Which evaluation criterion is most important when selecting a framework for this dual-regulatory environment?

   • AThe framework's ability to map controls to multiple regulatory requirements.
   • BThe framework's alignment with the company's existing ITIL processes.
   • CThe framework's popularity among industry peers.
   • DThe framework's focus on technical controls only.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action best supports the operationalization of compliance controls?

   • AProviding regular training to employees on compliance policies.
   • BHiring a compliance officer.
   • CStoring compliance documentation in a secure archive.
   • DConducting an annual review of the framework.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A compliance officer is operationalizing the controls for the Payment Card Industry Data Security Standard (PCI DSS). The company has a small IT team and limited budget. Which operationalization approach is most cost-effective while maintaining compliance?

   • ADefer the implementation of non-critical controls until the next budget cycle.
   • BAutomate high-volume, repetitive controls (e.g., log monitoring) and use manual processes for low-frequency controls.
   • CImplement all PCI DSS controls as manual processes to avoid software costs.
   • DOutsource all PCI DSS compliance to a third-party provider.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A compliance manager is reviewing the quarterly compliance metrics for the ISO/IEC 27001 framework. The data shows that the percentage of controls with documented evidence has remained at 95% for three consecutive quarters, but the number of internal audit findings has increased. What is the most appropriate action for the compliance manager to take?

   • AIncrease the target for the evidence metric to 100% to drive improvement.
   • BInvestigate the audit findings to identify the root cause and determine if the current metrics are measuring the right things.
   • CConclude that the compliance program is effective because the evidence metric is high.
   • DReduce the number of internal audits to lower the number of findings.
   Reveal Solution Discussion Select an answer first