CGEIT IT Compliance and Assurance 2

Question 1

HIPAA compliance MOST directly impacts IT governance in organizations that handle:

Accepted Answer

Protected health information (PHI) stored or transmitted electronically

Answer

HIPAA's Security Rule specifically governs IT controls over electronic protected health information, requiring encryption, access controls, and audit trails.

Question 2

An organization's IT governance framework should treat compliance MOST appropriately as:

Accepted Answer

A minimum baseline, with governance aiming to deliver additional value beyond compliance

Answer

Compliance represents the floor, not the ceiling — good IT governance meets compliance requirements while also driving value creation and strategic alignment.

Question 3

Which IT governance practice BEST demonstrates proactive compliance management?

Accepted Answer

Continuously monitoring regulatory changes and updating controls before deadlines

Answer

Proactive compliance management means staying ahead of regulatory changes and updating controls before requirements take effect, not reacting after audits.

Question 4

An IT organization is found to be SOX-compliant but experiences repeated data breaches. This MOST likely indicates:

Accepted Answer

Compliance does not guarantee adequate security controls beyond regulatory minimums

Answer

SOX compliance addresses financial reporting controls, not comprehensive cybersecurity — meeting one compliance standard does not ensure security in all areas.

Question 5

A third-party SOC 2 report PRIMARILY provides assurance about a service provider's:

Accepted Answer

Controls over security, availability, processing integrity, confidentiality, and privacy

Answer

A SOC 2 report provides independent assurance that a service provider's controls meet the Trust Services Criteria covering security, availability, and related principles.

CGEIT - Certified in the Governance of Enterprise IT Practice Test

CGEIT - Certified in the Governance of Enterprise IT Practice Test

CGEIT IT Compliance and Assurance 2