GRC Regulatory and Legal Compliance 2

Question 1

Under the Sarbanes-Oxley Act (SOX), which section specifically requires management to assess and report on the effectiveness of internal controls over financial reporting?

Accepted Answer

Section 404

Answer

SOX Section 404 requires management to assess internal controls over financial reporting and external auditors to attest to that assessment.

Question 2

A company operating in California collects personal data from residents. Under the California Consumer Privacy Act (CCPA), what right allows consumers to prevent the sale of their personal information?

Accepted Answer

Right to opt-out

Answer

The CCPA grants consumers the right to opt-out of the sale of their personal information to third parties.

Question 3

Which U.S. federal law establishes privacy protections for individually identifiable health information held by covered entities and business associates?

Accepted Answer

HIPAA

Answer

HIPAA (Health Insurance Portability and Accountability Act) establishes national standards to protect individually identifiable health information.

Question 4

An organization subject to PCI DSS discovers a third-party vendor processed cardholder data without a signed agreement. Which PCI DSS requirement has been violated?

Accepted Answer

Requirement 12 – Maintain an information security policy

Answer

PCI DSS Requirement 12 mandates maintaining agreements with service providers that include acknowledgment of their responsibility for cardholder data security.

Question 5

The EU General Data Protection Regulation (GDPR) requires organizations to appoint a Data Protection Officer (DPO) in which scenario?

Accepted Answer

When the core activities involve large-scale processing of special category data

Answer

GDPR mandates a DPO when core activities consist of large-scale processing of special category data or large-scale systematic monitoring of data subjects.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Regulatory and Legal Compliance 2