CCISO Governance, Risk & Compliance 2

Question 1

Which risk treatment option involves transferring the financial impact of a risk to a third party?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial burden of a risk to another party, such as through cyber insurance or outsourcing.

Question 2

A CISO needs to align the security program with business objectives. Which framework is MOST appropriate for mapping security controls to business goals?

Accepted Answer

COBIT 2019

Answer

COBIT 2019 is specifically designed to align IT governance, including security, with overall enterprise business objectives.

Question 3

Under GDPR, what is the maximum time frame for reporting a personal data breach to the supervisory authority after becoming aware of it?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Question 4

Which of the following BEST describes the purpose of a Statement of Applicability (SoA) in ISO 27001?

Accepted Answer

Lists applicable controls and justifies inclusions and exclusions

Answer

The SoA documents which Annex A controls are applicable, their implementation status, and the justification for including or excluding each control.

Question 5

A company operates in multiple jurisdictions with conflicting privacy laws. What is the BEST governance approach to address this?

Accepted Answer

Implement controls that satisfy the most stringent applicable regulation

Answer

Implementing the most stringent applicable controls ensures compliance across all jurisdictions while minimizing legal risk.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Governance, Risk & Compliance 2