IGP Compliance & Risk Management 5

Question 1

A multinational company transferring EU personal data to the US in the absence of an adequacy decision should use which approved mechanism?

Accepted Answer

Binding Corporate Rules (BCRs) or Standard Contractual Clauses (SCCs)

Answer

GDPR Chapter V allows cross-border data transfers via approved safeguards including BCRs and SCCs when no adequacy decision exists.

Question 2

Which federal law requires financial institutions to implement information security programs and protect customer financial information?

Accepted Answer

GLBA (Gramm-Leach-Bliley Act)

Answer

The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security program.

Question 3

In a risk register, the 'inherent risk' rating represents risk:

Accepted Answer

Before any controls are applied

Answer

Inherent risk is the raw or untreated risk level that exists before any controls or mitigations are applied.

Question 4

A data protection impact assessment (DPIA) under GDPR is mandatory when processing is likely to result in:

Accepted Answer

High risk to the rights and freedoms of natural persons

Answer

GDPR Article 35 requires a DPIA when processing is likely to result in a high risk to the rights and freedoms of individuals.

Question 5

Which of the following is the BEST example of a preventive compliance control?

Accepted Answer

Requiring dual authorization for large financial transactions

Answer

Preventive controls stop violations before they occur; dual authorization prevents unauthorized transactions from being processed in the first place.

(IGP) Information Governance Professional Practice Test