6.3 Validate Compliance in Accordance with Applicable Laws, Regulations, and Industry Standards ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has selected the COBIT 2019 framework for its IT governance and compliance program. During the implementation planning phase, the project manager needs to allocate resources effectively. Which resource allocation strategy is most aligned with COBIT 2019's design factors?

   • AAllocate equal resources to all COBIT 2019 processes to ensure uniform coverage.
   • BAllocate resources based on the organization's enterprise goals and the prioritized COBIT 2019 processes.
   • CAllocate resources only to processes that have failed previous audits.
   • DAllocate all resources to the IT department since COBIT is an IT framework.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A small software company with 50 employees needs to demonstrate compliance with the SOC 2 framework to win a contract with a large enterprise customer. The company has no existing compliance program. Which framework evaluation criterion is most important in this context?

   • AThe framework's focus on financial reporting controls.
   • BThe framework's requirement for annual external audits.
   • CThe framework's alignment with the company's marketing strategy.
   • DThe framework's scalability to the company's size and resource constraints.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large enterprise is considering adopting a compliance framework to address multiple regulatory requirements, including SOX, HIPAA, and GDPR. The company has a mature IT governance process based on COBIT 2019. The CISO is evaluating whether to adopt NIST CSF, ISO/IEC 27001, or a combination. Which approach best balances the need for comprehensive coverage and integration with existing processes?

   • AAdopt ISO/IEC 27001 as the primary framework and use COBIT 2019 for governance integration.
   • BContinue using COBIT 2019 exclusively and rely on its control objectives to satisfy all regulations.
   • CUse a hybrid approach: ISO/IEC 27001 for security controls, COBIT 2019 for governance, and NIST CSF for risk communication.
   • DAdopt NIST CSF as the primary framework and map all regulatory requirements to its functions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A compliance team is defining key risk indicators (KRIs) for the organization's compliance with the Health Insurance Portability and Accountability Act (HIPAA). Which KRI would most effectively provide early warning of a potential compliance failure?

   • ANumber of unauthorized access attempts to electronic protected health information (ePHI) detected in the last month.
   • BNumber of employees who completed HIPAA training in the last year.
   • CNumber of HIPAA-related complaints received from patients in the last quarter.
   • DPercentage of IT budget allocated to security tools.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When evaluating compliance frameworks, which factor should be considered to ensure the framework can be effectively implemented?

   • AThe framework's age and historical use.
   • BThe framework's compatibility with the organization's existing processes and technology.
   • CThe framework's length and number of controls.
   • DThe framework's origin and the country where it was developed.
   Reveal Solution Discussion Select an answer first