GRC Regulatory and Legal Compliance 2

Question 1

Under the Sarbanes-Oxley Act (SOX), which section specifically requires management to assess and report on the effectiveness of internal controls over financial reporting?

Accepted Answer

Section 404

Answer

Section 302

Answer

Section 401

Answer

Section 802

Question 2

A company operating in California collects personal data from residents. Under the California Consumer Privacy Act (CCPA), what right allows consumers to prevent the sale of their personal information?

Accepted Answer

Right to opt-out

Answer

Right to erasure

Answer

Right to portability

Answer

Right to correction

Question 3

Which U.S. federal law establishes privacy protections for individually identifiable health information held by covered entities and business associates?

Accepted Answer

HIPAA

Answer

FERPA

Answer

GLBA

Answer

COPPA

Question 4

An organization subject to PCI DSS discovers a third-party vendor processed cardholder data without a signed agreement. Which PCI DSS requirement has been violated?

Accepted Answer

Requirement 12 – Maintain an information security policy

Answer

Requirement 3 – Protect stored cardholder data

Answer

Requirement 6 – Develop secure systems

Answer

Requirement 7 – Restrict access to cardholder data

Question 5

The EU General Data Protection Regulation (GDPR) requires organizations to appoint a Data Protection Officer (DPO) in which scenario?

Accepted Answer

When the core activities involve large-scale processing of special category data

Answer

When processing data of more than 500 individuals

Answer

When annual revenue exceeds €10 million

Answer

When operating in more than two EU member states

Question 6

Which regulatory framework governs export controls on dual-use items, software, and technology from the United States?

Accepted Answer

Export Administration Regulations (EAR)

Answer

Foreign Corrupt Practices Act (FCPA)

Answer

International Traffic in Arms Regulations (ITAR)

Answer

Office of Foreign Assets Control (OFAC) sanctions

Question 7

A financial institution must implement a Customer Identification Program (CIP) as part of its Bank Secrecy Act obligations. What is the primary purpose of the CIP?

Accepted Answer

To verify the identity of customers opening accounts

Answer

To detect and report suspicious transactions

Answer

To maintain records of large cash transactions

Answer

To screen customers against OFAC sanctions lists