CSS Risk Management & Compliance 4

Question 1

Under the COSO ERM framework, which component involves defining the desired culture and setting the tone at the top regarding risk?

Accepted Answer

Governance and Culture

Answer

The 'Governance and Culture' component of COSO ERM 2017 establishes the organization's tone, values, and oversight structures that shape risk management.

Question 2

An organization discovers that a contractor has been sharing confidential client data without authorization. Under GDPR, this organization is MOST likely liable as a:

Accepted Answer

Data controller

Answer

The organization that determines the purposes and means of processing personal data is the data controller, and remains responsible for ensuring contractors (processors) comply with GDPR.

Question 3

A key risk indicator (KRI) is BEST described as:

Accepted Answer

A leading metric that signals increasing risk exposure before an incident

Answer

KRIs are forward-looking metrics that provide early warning signals of rising risk levels, allowing proactive management before an event materializes.

Question 4

The Children's Online Privacy Protection Act (COPPA) restricts the online collection of personal information from children under what age?

Accepted Answer

13

Answer

COPPA prohibits websites and online services from collecting personal information from children under 13 without verifiable parental consent.

Question 5

In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

Accepted Answer

The maximum tolerable downtime before significant harm occurs

Answer

The RTO specifies the maximum acceptable time allowed to restore a business process or system after a disruption before the impact becomes unacceptable.

(CSS) Certified Senior Specialist Practice Test

(CSS) Certified Senior Specialist Practice Test

CSS Risk Management & Compliance 4