GRC Compliance Standards & Regulatory Requirements 5

Question 1

Which compliance framework introduced the concept of 'continuous monitoring' as a key component of the Risk Management Framework (RMF)?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37 (RMF) incorporates continuous monitoring as Step 6 of its six-step process to maintain ongoing awareness of security and privacy posture.

Question 2

Under GDPR, a Data Protection Impact Assessment (DPIA) is MANDATORY when processing is likely to result in:

Accepted Answer

High risk to the rights and freedoms of natural persons

Answer

Article 35 of GDPR requires a DPIA when processing is likely to result in a high risk to the rights and freedoms of individuals, particularly for systematic profiling or sensitive data processing.

Question 3

Which Dodd-Frank Act provision created the Consumer Financial Protection Bureau (CFPB) to regulate consumer financial products?

Accepted Answer

Title X

Answer

Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act established the Consumer Financial Protection Bureau (CFPB).

Question 4

In the context of PCI DSS v4.0, what new approach was introduced alongside the traditional compliance approach?

Accepted Answer

Customized approach

Answer

PCI DSS v4.0 introduced the 'Customized Approach' as an alternative that allows organizations to achieve security objectives using their own controls rather than following prescriptive requirements.

Question 5

Which regulation governs the privacy of student education records at institutions receiving federal funding?

Accepted Answer

FERPA

Answer

FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records at federally funded educational institutions.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Compliance Standards & Regulatory Requirements 5