Compliance and Regulations MCQ 60 Tests With Answers (2026)

Incorrect·B: Type I assesses the design of controls at a specific point in time; Type II evaluates the operating effectiveness of those controls over a sustained period (typically 6–12 months)

A SOC 2 Type I report provides an auditor's opinion on whether the controls are suitably designed at a single point in time. A Type II report covers a period (usually 6–12 months) and assesses whether those controls were not only designed correctly but also operated effectively throughout that review period. Type II is significantly more valuable to enterprise clients as it demonstrates sustained performance.

Incorrect·C: A validation tool intended to assist eligible merchants and service providers in self-evaluating their compliance with PCI-DSS requirements

The PCI-DSS SAQ is a reporting tool used by merchants and service providers below Level 1 thresholds to self-assess their compliance. There are multiple SAQ variants (SAQ A, B, C, D, etc.) depending on how an organisation processes card payments. For example, SAQ A applies to card-not-present merchants that have fully outsourced cardholder data functions, while SAQ D is the most comprehensive for merchants storing cardholder data.

Incorrect·B: It extends the ISO 27001 framework to explicitly include requirements and guidance for establishing a Privacy Information Management System (PIMS)

ISO/IEC 27701:2019 is a privacy extension to ISO 27001 and ISO 27002. It extends the ISMS to include a Privacy Information Management System (PIMS), providing specific controls for Personal Identifiable Information (PII) processing. It maps closely to GDPR requirements, allowing organisations to align their ISO 27001 certification with GDPR compliance efforts for Controllers and Processors.

Incorrect·D: An entity that processes personal data exclusively on behalf of, and following the instructions of, the Data Controller

Under GDPR Article 4(8), a Data Processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller. The Processor acts under the Controller's instructions and may not process data for its own purposes. A cloud hosting provider that stores customer data is a classic example of a Processor, while the company using that cloud host is the Controller.

Incorrect·C: The creation of a dedicated privacy regulatory agency known as the California Privacy Protection Agency (CPPA)

The CPRA (effective January 1, 2023) significantly amended and expanded the CCPA. Its most notable structural addition was the creation of the California Privacy Protection Agency (CPPA) — the first dedicated state-level privacy enforcement agency in the US. The CPPA has independent rulemaking authority and enforcement powers, addressing a major criticism of the CCPA, which was enforced solely by the California Attorney General.

Incorrect·A: Protect

The "Protect" function in NIST CSF covers the safeguards needed to ensure delivery of critical infrastructure services. Its categories include Identity Management and Access Control (PR.AC), Awareness and Training (PR.AT), Data Security (PR.DS), Information Protection Processes and Procedures (PR.IP), Maintenance (PR.MA), and Protective Technology (PR.PT). The "Identify" function focuses on asset management and risk assessment, not protection.

Incorrect·C: ISO 27001 defines the mandatory requirements for an ISMS against which a company is certified; ISO 27002 provides a supplementary code of practice and guidance for implementing those controls

ISO/IEC 27001 is the certifiable standard specifying the requirements (using "shall") for establishing an ISMS — organisations are audited and certified against it. ISO/IEC 27002 (updated to 93 controls in 2022) is a reference guideline providing implementation guidance ("should") for the Annex A controls referenced in ISO 27001. You can be certified against 27001 but not 27002; the two are designed to be used together.

Incorrect·D: The requirement that certain digital data must be physically stored and processed within the borders of a specific country

Data residency is a legal and regulatory requirement mandating that data about a country's residents must be collected, processed, and/or stored within that country's borders. Countries like Russia (Federal Law No. 242-FZ), China (PIPL), and India (PDPB) have data localisation requirements. This creates compliance complexity for multinational organisations using centralised cloud environments.

Incorrect·C: To provide a certifiable, prescriptive framework that unifies multiple existing regulations (HIPAA, NIST, ISO) specifically tailored for the healthcare industry

HITRUST CSF is a healthcare-focused certifiable framework that harmonises requirements from over 40 regulations and standards including HIPAA, NIST, ISO 27001, PCI-DSS, and HITECH. It provides a prescriptive, risk-based control catalogue that scales based on an organisation's size, risk profile, and the type of data processed. HITRUST certification is widely recognised as a gold standard for demonstrating security in the healthcare and health-tech sectors.

Incorrect·B: A contractual clause that grants a client or regulatory body the explicit authority to formally examine a vendor's internal security controls and records

A "Right to Audit" clause in a vendor contract grants the client (or a regulatory body on the client's behalf) the authority to conduct or commission a formal review of the vendor's security practices, controls, and records. This clause is critical for organisations that outsource processing of sensitive regulated data (e.g., PHI under HIPAA, cardholder data under PCI-DSS) and need to verify vendor compliance independently.

Incorrect·C: The legacy Payment Application Data Security Standard (PA-DSS)

The PCI Software Security Framework (SSF), introduced in 2019, replaced the PA-DSS (Payment Application Data Security Standard), which was retired in October 2022. PA-DSS was a framework for ensuring commercially available payment applications do not store prohibited data and support compliance. The SSF modernised this with the Secure Software Standard (for general software security) and the Secure Software Lifecycle (SLC) Standard (for development vendor maturity).

Incorrect·B: To require management and the external auditor to explicitly report on the adequacy of the company's internal controls over financial reporting

SOX Section 404 requires that the annual report of publicly traded companies include an internal control report assessing the effectiveness of internal controls over financial reporting (ICFR). For large accelerated filers, the external auditor must also independently attest to management's assessment. IT General Controls (ITGCs) — covering access, change management, operations, and development — are a major audit focus because financial systems rely entirely on IT infrastructure.

Incorrect·D: The designated individual or role within an organization ultimately responsible for ensuring a particular security measure is effectively designed, implemented, and operating

A Control Owner is the designated person (e.g., a manager, system administrator, or process owner) accountable for ensuring a specific internal control is properly designed, consistently implemented, and functioning as intended. During audits, control owners are interviewed and asked to provide evidence (logs, screenshots, policies) that their assigned controls are operating effectively. Clear control ownership is required by SOX, ISO 27001, and SOC 2.

Incorrect·A: It significantly expands the scope of critical sectors covered, introduces stricter incident reporting timelines, and enforces direct accountability for senior management

NIS2 (Directive 2022/2555), effective October 2024, substantially expands the original 2016 NIS Directive. It extends coverage to 18 critical sectors (vs. the original 7), introduces a 24-hour early warning and 72-hour detailed incident reporting requirement, mandates supply chain risk management, imposes direct personal liability on senior management for non-compliance, and sets a minimum fine of €10 million or 2% of global turnover.

Incorrect·A: Completing an annual on-site assessment conducted by a certified Qualified Security Assessor (QSA) and submitting a Report on Compliance (RoC)

PCI-DSS Level 1 merchants (processing over 6 million Visa or Mastercard transactions per year, or any merchant that has suffered a breach) must undergo an annual on-site security assessment performed by a PCI SSC-certified Qualified Security Assessor (QSA). The QSA produces a detailed Report on Compliance (RoC). Level 1 organisations also require a quarterly network scan by an Approved Scanning Vendor (ASV).

Incorrect·B: It establishes the mandatory benchmark for evaluating and validating the effectiveness of cryptographic hardware and software modules used by government agencies

FIPS 140 (Federal Information Processing Standard 140) is published by NIST and mandated by the US federal government for validating cryptographic modules used to protect sensitive but unclassified information. FIPS 140-2 defines four security levels; FIPS 140-3 (aligned with ISO/IEC 19790:2012) superseded it in 2019. Any encryption module used in a federal system or FedRAMP environment must be FIPS 140 validated.

Incorrect·C: A legally binding contract mandating that third-party vendors properly safeguard PHI when providing services to a covered entity

A Business Associate Agreement (BAA) is a mandatory HIPAA contract (45 CFR §164.308(b)) between a HIPAA Covered Entity (e.g., hospital, insurer) and a Business Associate (any third-party vendor that creates, receives, maintains, or transmits PHI on their behalf). The BAA legally obligates the vendor to implement appropriate safeguards for PHI, report breaches, and comply with HIPAA's Security and Privacy Rules. Cloud providers like AWS, Google, and Azure offer HIPAA BAAs.

Incorrect·D: To formally document which of the Annex A controls have been implemented, which have been excluded, and the business justification for those decisions

The Statement of Applicability (SoA) is a mandatory document in ISO 27001 (Clause 6.1.3). It lists all 93 Annex A controls (ISO 27001:2022), states whether each is applicable or excluded, provides the justification for exclusions (e.g., a software company may exclude physical media controls if irrelevant), and references the policies or procedures implementing each included control. The SoA is a core audit artefact and must be approved by senior management.

Incorrect·B: It requires organizations to progress through sequential tiers of security practices, proving that advanced processes are not just documented but institutionalized and measured

The maturity model concept (originating from CMMI) acknowledges that security capability matures over time in progressive stages. CMMC 2.0 has three levels: Level 1 (Foundational — 17 basic practices, annual self-assessment), Level 2 (Advanced — 110 practices aligned with NIST SP 800-171, third-party assessment), and Level 3 (Expert — 110+ practices from NIST SP 800-172, government-led assessment). Higher levels require practices to be institutionalized, measured, and continuously improved — not just documented.

Incorrect·D: The General Data Protection Regulation (GDPR)

GDPR Article 35 formally mandated Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals' rights and freedoms — particularly for large-scale processing of special category data, systematic monitoring of public spaces, or novel technologies. DPIAs must be conducted before processing begins and must describe the processing, assess necessity and proportionality, and identify the measures to address identified risks.

Incorrect·B: It requires financial organizations and their critical ICT third-party providers to establish comprehensive capabilities to withstand, respond to, and recover from all types of ICT-related disruptions and threats

DORA (Regulation 2022/2554), applicable from January 2025, establishes a uniform EU-wide ICT risk management framework for financial entities (banks, insurers, investment firms, crypto-asset service providers) and their critical ICT third-party providers (CTPPs). Key pillars include ICT risk management, incident classification and reporting, digital operational resilience testing (including threat-led penetration testing for significant entities), and ICT third-party risk management through Register of Information and oversight of CTPPs.

Incorrect·C: It mandates the implementation of advanced proactive threat hunting capabilities and the strict management of Advanced Persistent Threats (APTs) outlined in NIST SP 800-172

CMMC 2.0 Level 3 (Expert) is designed for contractors handling the most sensitive Controlled Unclassified Information (CUI) and aligns with NIST SP 800-172 "Enhanced Security Requirements for Protecting CUI." It adds ~24 advanced requirements on top of Level 2's 110 NIST SP 800-171 practices, specifically designed to counter Advanced Persistent Threats (APTs) with enhanced threat hunting, incident response, and configuration management capabilities. Assessments are conducted by the Defense Contract Management Agency (DCMA).

Incorrect·D: It invalidated the EU-US Privacy Shield, placing the burden on companies to conduct Transfer Impact Assessments (TIAs) and rely heavily on Standard Contractual Clauses (SCCs) for transatlantic data flows

In Data Protection Commissioner v. Facebook Ireland (C-311/18, July 2020), the Court of Justice of the EU (CJEU) invalidated the EU-US Privacy Shield adequacy decision because US surveillance laws (FISA Section 702, EO 12333) do not provide equivalent EU privacy protections. Companies must now rely on Standard Contractual Clauses (SCCs) supplemented by Transfer Impact Assessments (TIAs) to justify international data transfers. The EU-US Data Privacy Framework (DPF, 2023) is the current adequacy mechanism, though subject to ongoing legal challenge.

Incorrect·A: Consolidating and mathematically mapping overlapping requirements from multiple regulations (e.g., NIST, ISO, HIPAA) into a single, unified control set to eliminate redundant audit efforts

Compliance cross-walking (or control mapping) is the process of identifying and mapping equivalent or overlapping requirements across multiple regulatory frameworks into a unified control library. For example, NIST SP 800-53 AC-2 (Account Management) maps to ISO 27001 Annex A 8.2, PCI-DSS Requirement 7, and HIPAA §164.312(a)(1). By implementing one strong control that satisfies multiple frameworks simultaneously, organisations dramatically reduce audit preparation time, cost, and duplication — the core value of GRC platforms and OSCAL.

Incorrect·C: Within four business days of the company determining that the cybersecurity incident is material

The SEC's Cybersecurity Disclosure Rules (effective December 2023) require public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining that the incident is "material" — meaning a reasonable investor would consider it important. Critically, the clock starts at the materiality determination, not the incident discovery. The rules also require annual disclosure of cybersecurity risk management, strategy, and governance on Form 10-K.

Incorrect·D: FedRAMP High applies to systems where the loss of confidentiality, integrity, or availability would result in severe or catastrophic adverse effects on organizational operations, assets, or individuals (incorporating ~421 NIST controls)

FedRAMP is tiered based on FIPS 199 impact levels. FedRAMP Moderate (~325 controls) covers systems where a breach would have serious adverse effects. FedRAMP High (~421 controls) is required for systems handling government law enforcement, emergency services, healthcare, financial data, and other areas where a breach would cause severe or catastrophic harm. Only a handful of cloud providers have achieved FedRAMP High authorization, including AWS GovCloud and Microsoft Azure Government. All must use FIPS 140-validated cryptography.

Incorrect·B: The introduction of the "Customized Approach," allowing organizations to meet the objective of a requirement using alternative, innovative methods without filing a formal Compensating Control Worksheet

PCI-DSS v4.0 (released March 2022, mandatory from March 2025) introduced the "Customized Approach" as an alternative to the traditional "Defined Approach." Under the Customized Approach, a mature organisation can design and implement its own security controls to meet the stated objective of a requirement, rather than following the prescriptive defined controls. This requires extensive documentation in a Customized Approach Objective, detailed testing procedures approved by a QSA, and is intended for organisations with sophisticated risk management capabilities.

Incorrect·C: The principle that data collection and sharing must strictly conform to the expected norms and boundaries of the specific environment in which it was originally collected

Contextual integrity, a concept introduced by philosopher Helen Nissenbaum, holds that privacy is violated not simply by sharing data, but by sharing data in a way that violates the contextual norms under which it was originally disclosed. For example, sharing a patient's diagnosis with their treating physician is appropriate; sharing it with a marketing firm is not, regardless of whether technical consent was obtained. This concept increasingly informs advanced GDPR enforcement decisions and Privacy by Design methodologies.

Incorrect·D: It replaces the previous "harm threshold" with a strict presumption that a breach has occurred unless the covered entity can definitively demonstrate a low probability that the PHI has been compromised

The HIPAA Omnibus Rule (2013) significantly strengthened breach notification under the HITECH Act. It replaced the previous "risk of harm" threshold (which had allowed organisations to avoid reporting by arguing no harm would result) with a strict "probability of compromise" standard. Under this standard, any impermissible use or disclosure of PHI is presumed to be a breach requiring notification unless the covered entity can demonstrate — through a four-factor risk assessment — that there is a low probability the PHI has been compromised.

Incorrect·A: The module must possess physical tamper-response mechanisms that automatically zeroize plaintext cryptographic keys upon detecting physical intrusion

FIPS 140-3 (ISO/IEC 19790) Security Level 3 requires physical tamper-response and zeroization mechanisms — the module must actively detect physical intrusion attempts (e.g., probing, drilling) and automatically zeroize (erase to zero) all plaintext cryptographic keys and critical security parameters upon detection. Level 2 only requires evidence of tampering (tamper-evident seals) without the active zeroization response. Hardware Security Modules (HSMs) used in banking, PKI, and government environments commonly achieve Level 3 or higher.

Incorrect·B: They must undergo a rigorous conformity assessment, establish robust risk management systems, and ensure high-quality training data to mitigate algorithmic bias before market deployment

The EU AI Act (2024/1689, applicable from August 2026 for high-risk systems) classifies AI into four risk tiers. High-risk AI (e.g., systems used in critical infrastructure, education, employment, credit scoring, law enforcement) must comply with obligations including: technical documentation, conformity assessment (self or third-party), CE marking, registration in the EU database, a risk management system throughout the lifecycle, data governance and quality measures for training datasets, human oversight capabilities, and accuracy and robustness standards.

Incorrect·C: To provide a standardized, machine-readable data format (XML, JSON, YAML) for representing security controls, baselines, and system security plans to automate compliance assessments

OSCAL (Open Security Controls Assessment Language) is a NIST-developed standard that enables the machine-readable representation of security control frameworks (catalogues), control baselines, system security plans (SSPs), assessment plans, and assessment results. By digitising compliance artefacts — previously stored in unstructured Word/Excel documents — OSCAL enables automation of FedRAMP package generation, continuous monitoring, and multi-framework control mapping using tools that consume XML, JSON, and YAML formats.

Incorrect·D: The risk that generalized, mapped controls fail to satisfy the highly specific, nuanced technical mandates of a stringent, individual regulation like PCI-DSS

A Unified Compliance Framework (UCF) maps common controls across multiple regulations — reducing redundancy and audit fatigue. However, a critical risk is "control dilution" or "false equivalence": the UCF's generalised mapping of a control may satisfy the spirit of multiple standards but fail to meet the highly prescriptive, technically specific requirements of a demanding individual regulation. For example, a generic UCF encryption control may not specify the exact FIPS 140-validated algorithm required by PCI-DSS Requirement 3.5 or FedRAMP. GRC teams must perform supplemental control gap analyses for each stringent regulation.

Incorrect·A: The number of controls was reduced from 114 to 93, and they were reorganized into four broader themes (Organizational, People, Physical, Technological) rather than 14 specific domains

ISO/IEC 27001:2022 (replacing the 2013 version) restructured Annex A controls: the count was reduced from 114 controls across 14 domains to 93 controls organized into 4 themes — Organizational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls). While some controls were merged, 11 new controls were added covering areas including threat intelligence, cloud security, ICT readiness for business continuity, data masking, web filtering, and secure coding. The Statement of Applicability (SoA) remains mandatory.

Incorrect·B: To establish a mandatory security baseline for financial institutions specifically to secure their local infrastructure connecting to the global SWIFT financial messaging network

Following the 2016 Bangladesh Bank heist ($81M stolen via fraudulent SWIFT messages), SWIFT launched the Customer Security Programme (CSP) with the CSCF. The framework defines mandatory and advisory security controls for members' SWIFT local infrastructure (Swift Secure Zone) — including network segmentation, malware protection, credential management, and application hardening. Members must annually self-attest (or provide an independent assessment) against the current CSCF version, with SWIFT increasingly mandating third-party attestations for higher-risk members.

Incorrect·C: The "Carve-out" method excludes the subservice organization's controls from the audit scope, while the "Inclusive" method tests and includes the subservice organization's controls directly in the report

When a SOC 2 service organisation relies on a subservice organisation (e.g., AWS for hosting), the SOC 2 audit must address those dependencies. The "Carve-out" method excludes the subservice org's controls from the scope, leaving clients to obtain the subservice org's own SOC report for assurance. The "Inclusive" method includes the subservice org's relevant controls within the primary SOC 2 report scope, requiring the auditor to test those controls directly — a more rigorous but logistically complex approach.

Incorrect·D: It fundamentally conflicts with the GDPR's "Right to be Forgotten," as the cryptographic structure of a blockchain makes it practically impossible to delete or alter historical personal data

GDPR Article 17 grants data subjects the "Right to Erasure" (Right to be Forgotten), requiring organisations to delete personal data upon request under certain conditions. Blockchain's fundamental immutability — where blocks are cryptographically chained in an append-only ledger — makes it practically impossible to delete specific historical records without breaking the chain's integrity. Current legal workarounds include storing only hashed or encrypted references on-chain (with keys stored off-chain and deletable), or using permissioned blockchains with access controls, though none fully resolve the tension.

Incorrect·A: The International Traffic in Arms Regulations (ITAR)

ITAR (International Traffic in Arms Regulations), administered by the US Department of State under the Arms Export Control Act, controls the export and import of defense-related articles, services, and technical data listed on the US Munitions List (USML). Violations carry severe criminal penalties (up to 20 years in federal prison, $1M per violation). ITAR compliance is critical for aerospace, defence, and tech companies — even storing ITAR-controlled technical data on a foreign national's workstation may constitute an "export." Complements EAR (Export Administration Regulations) for dual-use items.

Incorrect·B: To provide an auditor's opinion on the fair presentation and suitability of the design of controls at a specific point in time, without testing their operational effectiveness over a period

SSAE 18 (Statement on Standards for Attestation Engagements No. 18), published by the AICPA, governs service organisation reporting (replacing SSAE 16/SAS 70). An SSAE 18 Type 1 report (AT-C 205 or AT-C 320) provides an auditor's opinion on whether the service organisation's system description is fairly presented and whether controls were suitably designed at a specific date — no testing of operational effectiveness. Type 2 covers a period and includes testing. SOC 1, SOC 2, and SOC 3 reports are all issued under SSAE 18 / ISAE 3402 frameworks.

Incorrect·C: The cloud provider retains full responsibility for securing the physical infrastructure, hypervisor, and operating system, while the customer is responsible for the application logic and data

In a PaaS model (e.g., AWS Elastic Beanstalk, Google App Engine, Azure App Service), the cloud provider secures everything from the physical data centre up to and including the operating system and runtime environment — data centre security, hardware, hypervisor, OS patching. The customer is responsible for the application code, application-level configurations, identity and access management for their app, and the data stored within it. This contrasts with IaaS (where the customer also manages the OS) and SaaS (where the provider manages almost everything).