GRC Regulatory and Legal Compliance 5

Question 1

Which legal doctrine holds that a parent company may be liable for the compliance violations of its subsidiary?

Accepted Answer

Alter ego doctrine

Answer

The alter ego doctrine allows courts to hold a parent company liable for a subsidiary's actions when the subsidiary lacks separate identity and is merely an extension of the parent.

Question 2

Under the Payment Card Industry Data Security Standard (PCI DSS), what is the minimum password length required for system access?

Accepted Answer

12 characters

Answer

PCI DSS v4.0 requires passwords/passphrases to be a minimum of 12 characters (or if the system does not support 12 characters, a minimum length of eight characters).

Question 3

A compliance officer identifies a legal requirement that conflicts with a business objective. What is the appropriate escalation path?

Accepted Answer

Escalate to senior leadership and legal counsel to document the risk and determine a resolution

Answer

Compliance officers should escalate conflicts between legal requirements and business objectives to senior leadership and legal counsel to ensure informed decision-making and documented risk acceptance.

Question 4

Which U.S. law requires federal agencies to protect sensitive unclassified information and mandates specific safeguarding requirements for contractors handling such data?

Accepted Answer

Controlled Unclassified Information (CUI) Program under 32 CFR Part 2002

Answer

The CUI Program established under 32 CFR Part 2002 standardizes how federal agencies and contractors must identify, handle, and protect Controlled Unclassified Information.

Question 5

An organization's compliance program includes 'reasonable care' as a defense strategy. Under the U.S. Federal Sentencing Guidelines, which factor most significantly reduces the culpability score when an offense occurs?

Accepted Answer

Implementing an effective compliance and ethics program prior to the offense

Answer

Having an effective compliance and ethics program in place before the offense is the most significant mitigating factor under the Federal Sentencing Guidelines, potentially reducing the culpability score by three points.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC Regulatory and Legal Compliance 5