I85PREP
⌘ K
ICGB study materials
ICGB study resources

ICGB practice questions

One question at a time. Build your ICGB understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Define

Under the GDPR, which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Purpose limitation Correct answer.
  2. Integrity and confidentiality
  3. Data minimisation
  4. Storage limitation

Explanation

Purpose limitation is the principle stating that personal data must be collected for specified, explicit and legitimate purposes and not further processed incompatibly. It governs the reason for collection, whereas storage limitation governs duration.

Question 2Define

A company wants to rely on consent as its lawful basis for processing employee personal data. Which characteristic is essential for that consent to be valid under the GDPR?

  1. It must be freely given, specific, informed and unambiguous Correct answer.
  2. It must be recorded in a written contract signed by the employee
  3. It must be renewed in writing every six months
  4. It must be approved by the national supervisory authority

Explanation

Valid consent under the GDPR must be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action. Because of the imbalance of power, employee consent is often problematic, but the definitional test itself is as stated.

Question 3Define

Which of the following best describes the role of a data processor under the GDPR?

  1. A party that supervises compliance within a Member State
  2. A party that receives data subjects' complaints and forwards them to the controller
  3. A party that determines the purposes and means of processing
  4. A party that processes personal data on behalf of the controller Correct answer.

Explanation

A processor processes personal data on behalf of the controller, acting on documented instructions. The controller, by contrast, determines the purposes and means of processing.

Question 4Define

What is the maximum administrative fine the GDPR allows a supervisory authority to impose for the most serious infringements?

  1. 50 million euros or 10% of total worldwide annual turnover
  2. 5% of the undertaking's annual profit in the affected Member State
  3. 10 million euros or 2% of total worldwide annual turnover
  4. 20 million euros or 4% of total worldwide annual turnover, whichever is higher Correct answer.

Explanation

For the most serious infringements, the GDPR sets the higher tier at 20 million euros or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The lower tier is 10 million euros or 2%.

Question 5Define

Which concept from EU data protection law refers to information about an identified or identifiable natural person?

  1. Anonymous data
  2. Aggregated statistics
  3. Personal data Correct answer.
  4. Pseudonymous key material

Explanation

Personal data is any information relating to an identified or identifiable natural person, the data subject. An identifiable person is one who can be identified directly or indirectly.

Question 6Define

A marketing team wants to send promotional emails to existing customers. Under the GDPR, which lawful basis is most commonly assessed for such direct marketing to existing customers where consent has not been obtained?

  1. Vital interests
  2. Legitimate interests Correct answer.
  3. Legal obligation
  4. Public task

Explanation

Legitimate interests is frequently assessed for direct marketing, subject to a balancing test and the data subject's right to object at any time. Consent remains an alternative basis, and national ePrivacy rules may add requirements.

Question 7Define

An organisation receives a data subject access request. Under the GDPR, within what period must the controller generally respond, and what extension is possible?

  1. Within 72 hours, extendable by one week
  2. Within 15 days, with no possibility of extension
  3. Within three months, with no extension allowed
  4. Without undue delay and in any event within one month, extendable by a further two months for complex requests Correct answer.

Explanation

Controllers must provide information on action taken without undue delay and at least within one month of receipt, extendable by two further months where requests are complex or numerous. The controller must inform the data subject of any extension and the reasons.

Question 8Define

Which of the following is a right introduced or strengthened by the GDPR in relation to automated decision-making?

  1. The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to exceptions Correct answer.
  2. The right to demand deletion of all data held by any third country authority
  3. The right to require a controller to use artificial intelligence for all decisions
  4. The right to receive a printed copy of every algorithm used

Explanation

The GDPR grants protection against decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the data subject, subject to specified exceptions. Safeguards such as human intervention may apply.

Question 9Define

A controller engages a cloud provider to host personal data. Which instrument is required under Article 28 of the GDPR?

  1. A written contract or other legal act binding the processor to the controller's instructions Correct answer.
  2. A certification of the processor issued by a trade association
  3. A data protection impact assessment filed with the supervisory authority
  4. A binding corporate rules approval from the European Data Protection Board

Explanation

Article 28 requires a written contract or other legal act between controller and processor that sets out the subject matter, duration, nature and purpose of processing and the processor's obligations. It must bind the processor to documented instructions.

Question 10Define

Which statement correctly describes the GDPR's accountability principle?

  1. Controllers must be able to demonstrate compliance with the data protection principles Correct answer.
  2. Controllers must publish the personal data of their data protection officers
  3. Controllers are exempt from record-keeping if they employ fewer than 250 staff in all cases
  4. Controllers must register every processing operation with the supervisory authority before starting

Explanation

Accountability requires the controller to be able to demonstrate compliance with the GDPR, for example through policies, records and assessments. It is a demonstrability obligation rather than a blanket registration duty.

Question 11Define

Which of the following is a valid transfer mechanism for sending personal data from the EU to a third country under the GDPR?

  1. A unilateral internal memo by the exporter
  2. A press release announcing the transfer
  3. An adequacy decision adopted by the European Commission Correct answer.
  4. A verbal assurance from the importer's chief executive

Explanation

An adequacy decision is one of the principal transfer tools, alongside appropriate safeguards such as standard contractual clauses and binding corporate rules, and specific derogations. It reflects a Commission determination that the country ensures an adequate level of protection.

Question 12Define

A controller discovers a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons. What must the controller generally do under the GDPR?

  1. Wait for the supervisory authority to request a report
  2. Publish the breach in the national press before investigating
  3. Notify every data subject within 24 hours in all cases
  4. Notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware Correct answer.

Explanation

Where a breach is likely to result in a risk to rights and freedoms, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Notification to data subjects is required where the breach is likely to result in a high risk.

Question 13Define

What is the main purpose of a data protection impact assessment (DPIA) under the GDPR?

  1. To certify that a controller is fully compliant for the next five years
  2. To transfer liability for processing to the processor
  3. To assess the impact of envisaged processing operations on the protection of personal data and identify mitigation measures Correct answer.
  4. To replace the need for any lawful basis for processing

Explanation

A DPIA is a risk assessment of envisaged processing, particularly where new technologies or high-risk processing are involved. It helps identify risks to rights and freedoms and the measures to address them, and may require prior consultation if risks remain high.

Question 14Define

Which body was established by the GDPR to ensure consistent application of data protection rules across the EU?

  1. The European Court of Auditors
  2. The Council of Europe Consultative Committee
  3. The European Data Protection Board Correct answer.
  4. The European Banking Authority

Explanation

The GDPR established the European Data Protection Board, composed of supervisory authority heads and the European Data Protection Supervisor. It contributes to consistent application, issues guidelines and resolves certain disputes.

Question 15Define

A retailer processes loyalty-card data to analyse shopping habits and then uses the same data to build credit-scoring profiles for third parties. Which principle is most directly engaged by this further use?

  1. Purpose limitation Correct answer.
  2. Storage limitation
  3. Lawfulness of processing of special category data
  4. Accuracy

Explanation

Reusing data for a new, incompatible purpose engages purpose limitation, which requires that further processing be compatible with the original purposes. A compatibility assessment considers factors such as the link between purposes and the context of collection.

Question 16Define

When assessing whether further processing is compatible with the original purpose, which factor does the GDPR expressly mention?

  1. The nationality of the data subject
  2. The size of the controller's marketing budget
  3. The market value of the data to the controller
  4. The existence of appropriate safeguards, including encryption or pseudonymisation Correct answer.

Explanation

The compatibility assessment includes the link between purposes, the context of collection, the nature of the data, possible consequences and the existence of appropriate safeguards such as encryption or pseudonymisation. These safeguards can support a finding of compatibility.

Question 17Define

A company appoints a data protection officer. Which statement about the DPO's position is correct under the GDPR?

  1. The DPO must be a member of the board of directors
  2. The DPO may not be an employee of the controller under any circumstances
  3. The DPO must be involved properly and in a timely manner in all issues relating to the protection of personal data Correct answer.
  4. The DPO must report directly to the chief marketing officer

Explanation

The controller and processor must ensure the DPO is involved, properly and in a timely manner, in all issues relating to the protection of personal data. The DPO must have the necessary resources and independence.

Question 18Define

Which situation requires a controller to carry out a data protection impact assessment under the GDPR?

  1. Storing a paper diary of meeting appointments
  2. Processing a small customer list for routine invoicing
  3. Sending a single transactional email to one customer
  4. A systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal effects are based Correct answer.

Explanation

A DPIA is required where processing is likely to result in a high risk, and the GDPR gives examples including systematic and extensive automated evaluation with significant effects. Routine invoicing or isolated communications do not meet that threshold.

Question 19Define

Which statement correctly distinguishes anonymisation from pseudonymisation under the GDPR?

  1. Pseudonymisation is only relevant to paper records
  2. Pseudonymised data can still be personal data because re-identification remains possible with additional information, while properly anonymised data is outside the GDPR's scope Correct answer.
  3. Both techniques automatically remove data from the GDPR's scope
  4. Anonymised data remains personal data but pseudonymised data does not

Explanation

Pseudonymisation reduces linkability but the data remains personal if re-identification is possible using additional information kept separately. Properly anonymised data cannot be linked to an identifiable person and falls outside the GDPR's material scope.

Question 20Define

A controller relies on legitimate interests. A data subject objects to the processing. What is the general consequence under the GDPR?

  1. The controller may continue unless the data subject pays a fee
  2. The objection has no effect until a court orders otherwise
  3. The controller must stop the processing unless it demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims Correct answer.
  4. The controller must delete all data immediately in every case

Explanation

On an objection to processing based on legitimate interests, the controller must cease unless it demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms, or the processing is needed for legal claims. For direct marketing, the objection is absolute.

Question 21Define

An EU controller uses a processor in a third country without an adequacy decision. The parties adopt the Commission's standard contractual clauses. Which additional step does the GDPR framework require the parties to consider?

  1. Obtaining consent from every data subject for each individual transfer
  2. Registering the clauses with the European Parliament
  3. Nothing further, because standard contractual clauses conclusively guarantee an adequate level of protection
  4. Assessing whether the law and practice of the third country impairs the effectiveness of the clauses and adopting supplementary measures where needed Correct answer.

Explanation

Following the Schrems II judgment, parties relying on transfer tools such as standard contractual clauses must assess the third country's legal framework and adopt supplementary measures where the safeguards are not effective. The clauses alone are not a conclusive guarantee.

Question 22Define

A controller wants to process biometric data for the purpose of uniquely identifying an employee. Which condition applies under the GDPR?

  1. Processing is permitted whenever the employee has signed any employment contract
  2. Processing is prohibited in the employment context without exception
  3. Biometric data is ordinary personal data with no special conditions
  4. Processing is prohibited unless a condition in Article 9(2) applies, such as explicit consent or a substantial public interest basis laid down in law Correct answer.

Explanation

Biometric data processed to uniquely identify a person is special category data, and processing is prohibited unless an Article 9(2) condition applies. In employment, explicit consent is difficult to rely on because of the power imbalance, so other conditions are often examined.

Question 23Define

Which statement best captures the relationship between the GDPR and the ePrivacy Directive for electronic marketing?

  1. ePrivacy rules apply only to public authorities
  2. The ePrivacy Directive replaces the GDPR entirely for marketing
  3. The GDPR applies only to paper marketing
  4. The GDPR and ePrivacy rules apply cumulatively, so a controller needs both a lawful basis under the GDPR and to comply with ePrivacy rules on unsolicited communications Correct answer.

Explanation

The GDPR and ePrivacy rules apply cumulatively to electronic marketing. A controller needs a lawful basis under the GDPR and must also satisfy ePrivacy requirements on unsolicited communications, which are implemented in national law.

Question 24Define

What does the GDPR require regarding records of processing activities for a controller?

  1. Records are required only for processors, not controllers
  2. Controllers must maintain a record of processing activities under their responsibility, with limited exemptions such as for certain small organisations Correct answer.
  3. Every controller must publish its records on its website
  4. Records must be destroyed after 30 days

Explanation

Controllers must maintain a record of processing activities under their responsibility, containing items such as purposes, categories of data and recipients. A narrow exemption exists for organisations with fewer than 250 employees where processing is not risky, regular or of special categories.

Question 25Define

Which of the following is an example of a data subject right that allows a person to obtain their personal data in a structured, commonly used and machine-readable format?

  1. Right to data portability Correct answer.
  2. Right to rectification
  3. Right to object
  4. Right to restriction of processing

Explanation

The right to data portability allows data subjects to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller where the processing is based on consent or contract and is automated.

Question 26Define

Under the GDPR, which term describes any information relating to an identified or identifiable natural person?

  1. Personal data Correct answer.
  2. Anonymous data
  3. Metadata
  4. Aggregated statistics

Explanation

Article 4(1) defines personal data as any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified directly or indirectly, for example by an identifier such as a name, identification number, location data or online identifier.

Question 27Define

Which legal act sets the core EU framework of rules on the protection of natural persons with regard to the processing of personal data?

  1. The ePrivacy Directive 2002/58/EC
  2. The GDPR (Regulation (EU) 2016/679) Correct answer.
  3. The NIS2 Directive
  4. The Digital Services Act

Explanation

The GDPR is the general EU regulation governing the processing of personal data and the free movement of such data. The ePrivacy Directive complements it with sector-specific rules, while NIS2 and the DSA address cybersecurity and online platform obligations rather than the general data protection framework.

Question 28Define

What does the GDPR's material scope in Article 2 primarily cover?

  1. Only processing carried out for commercial purposes
  2. Only processing of data relating to EU citizens
  3. Only processing carried out by public authorities
  4. Processing of personal data wholly or partly by automated means, and non-automated processing of data held in a filing system Correct answer.

Explanation

Article 2(1) applies the GDPR to processing of personal data wholly or partly by automated means and to non-automated processing of personal data that form part of a filing system. The regulation is not limited to public bodies, EU citizens or commercial purposes.

Question 29Define

Which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Storage limitation
  2. Purpose limitation Correct answer.
  3. Data minimisation
  4. Integrity and confidentiality

Explanation

Article 5(1)(b) sets out purpose limitation: data must be collected for specified, explicit and legitimate purposes and not further processed incompatibly. Storage limitation concerns retention periods, data minimisation concerns adequacy and necessity, and integrity and confidentiality concerns security.

Question 30Define

A German company processes personal data on servers located in Germany, but the processing concerns customers who are all resident in Brazil. Which statement about the GDPR's territorial scope is correct?

  1. The GDPR applies only if the processing is automated
  2. The GDPR applies only if the Brazilian customers consent to it
  3. The GDPR applies because the controller is established in the Union and the processing occurs in the context of that establishment Correct answer.
  4. The GDPR does not apply because no EU data subjects are affected

Explanation

Article 3(1) applies the GDPR to processing carried out in the context of the activities of an establishment of a controller or processor in the Union, regardless of where the processing takes place. The establishment criterion therefore governs, not the nationality or residence of the data subjects.

Question 31Define

A US-based online store with no EU establishment offers goods to customers in France and processes their personal data. Which provision of the GDPR most directly brings this processing within scope?

  1. Article 27, on the representative in the Union
  2. Article 3(2), the targeting criterion for offering goods or services to data subjects in the Union Correct answer.
  3. Article 3(1), the establishment criterion
  4. Article 45, on adequacy decisions

Explanation

Article 3(2) extends the GDPR to controllers not established in the Union where they offer goods or services to data subjects in the Union or monitor their behaviour. The obligation to appoint a representative under Article 27 follows from that scope; it does not itself create it.

Question 32Define

Which statement best describes the role of the controller under the GDPR?

  1. The entity that receives personal data for statistical research only
  2. The entity that processes personal data on behalf of another party
  3. The entity that supervises compliance with the GDPR at national level
  4. The entity that determines the purposes and means of the processing of personal data Correct answer.

Explanation

Article 4(7) defines the controller as the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing. The processor, by contrast, processes on behalf of the controller, and supervisory authorities oversee compliance.

Question 33Define

A hospital shares patient data with an external laboratory that analyses samples on the hospital's instructions and for the hospital's purposes. How should the laboratory be characterised?

  1. As a processor, because it processes on behalf of the hospital Correct answer.
  2. As a joint controller, because it handles the data
  3. As a supervisory authority
  4. As a data subject

Explanation

A party that processes personal data on behalf of, and on the instructions of, the controller is a processor under Article 4(8). The hospital determines the purposes and means and therefore remains the controller, with the relationship governed by an Article 28 contract.

Question 34Define

Which statement correctly describes the GDPR's one-stop-shop mechanism?

  1. A controller with cross-border processing deals primarily with one lead supervisory authority, subject to cooperation with other concerned authorities Correct answer.
  2. The European Data Protection Board issues binding permits for each cross-border processing operation
  3. Every controller must file a separate notification with each national supervisory authority before processing
  4. Cross-border processing is exempt from national supervisory oversight

Explanation

The one-stop-shop under Article 56 gives a controller or processor engaged in cross-border processing a single lead supervisory authority, which cooperates with the other concerned authorities. It simplifies supervision but does not exempt processing from oversight or require per-operation permits.

Question 35Define

A controller in Ireland processes data of customers in several EU member states from its Irish establishment. Which supervisory authority is the lead authority under the one-stop-shop?

  1. The supervisory authority of the member state where the controller's main establishment is located Correct answer.
  2. The authority of the member state where each customer resides
  3. The European Data Protection Board
  4. The European Commission

Explanation

Under Article 56, the lead supervisory authority is generally the one for the member state of the controller's main establishment in the Union. The other authorities whose data subjects are affected act as concerned authorities within the cooperation mechanism.

Question 36Define

Which of the following best describes the GDPR's approach to the principle of accountability?

  1. Accountability applies only to public authorities
  2. Accountability replaces the need to comply with the other principles
  3. Controllers must demonstrate compliance with the data protection principles and be able to prove it Correct answer.
  4. Controllers are accountable only if a data subject files a complaint

Explanation

Article 5(2) makes the controller responsible for compliance and requires it to be able to demonstrate that compliance. Accountability adds an evidential burden, such as records, policies and assessments, on top of the substantive principles.

Question 37Define

A company wants to rely on the processing of personal data for its own legitimate interests. Which step is most consistent with the GDPR before it begins processing?

  1. Rely on the legitimate interests basis without any assessment because it is self-evident
  2. Carry out and document a balancing test weighing its interests against the rights and freedoms of data subjects Correct answer.
  3. Notify every data subject individually by post
  4. Obtain prior authorisation from the European Data Protection Board

Explanation

Article 6(1)(f) permits processing based on legitimate interests only where those interests are not overridden by the rights and freedoms of the data subject. Controllers should conduct and document a balancing assessment and inform data subjects through privacy information.

Question 38Define

A controller relies on consent under the GDPR. Which statement about the validity of that consent is correct?

  1. Consent can be inferred from the data subject's failure to object
  2. Consent remains valid indefinitely once given, regardless of changes in processing
  3. Consent must be freely given, specific, informed and an unambiguous indication of the data subject's wishes Correct answer.
  4. Silence or pre-ticked boxes can constitute valid consent if the privacy notice is clear

Explanation

Article 4(11) requires consent to be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action. Recital 32 confirms that silence, pre-ticked boxes and inactivity do not constitute consent.

Question 39Define

Under the GDPR, which statement about the relationship between the controller and a processor is correct?

  1. The processor may determine the purposes of processing if it is more efficient
  2. The processor is always jointly liable with the controller for the latter's unlawful processing choices
  3. The processor must act only on documented instructions from the controller, including for transfers to a third country, unless required by Union or member state law Correct answer.
  4. The controller has no obligation to monitor the processor's compliance

Explanation

Article 28(3)(a) requires the processor to process personal data only on documented instructions from the controller, including regarding transfers, unless required to do so by law. The controller remains responsible for choosing a processor that provides sufficient guarantees and for overseeing compliance.

Question 40Define

A controller wants to introduce a new system that profiles employees to predict performance. Which combination of GDPR elements is most relevant at the design stage?

  1. A data protection impact assessment, consideration of a lawful basis and safeguards for automated decision-making Correct answer.
  2. Only obtaining consent from the works council
  3. Only a notification to the European Data Protection Board
  4. Only a transfer impact assessment under Chapter V

Explanation

Systematic profiling of employees is likely to trigger a DPIA under Article 35, and the controller must identify a lawful basis and address the safeguards for automated decision-making in Article 22. Chapter V assessments concern transfers to third countries and are relevant only if such transfers occur.

Question 41Measure

In a cyber-governance programme, the 'Measure' phase is best described as which activity?

  1. Drafting the information security policy for executive approval
  2. Assigning risk owners to newly identified enterprise risks
  3. Establishing performance indicators and collecting evidence on control effectiveness Correct answer.
  4. Selecting the security framework the organisation will adopt

Explanation

The Measure phase focuses on quantifying performance and verifying that implemented controls work as intended, using metrics, monitoring and evidence collection. Policy drafting, risk ownership assignment and framework selection belong to earlier governance activities such as direction-setting or risk assessment.

Question 42Measure

Which pair correctly distinguishes a lagging indicator from a leading indicator in a security measurement programme?

  1. Lagging: number of incidents last quarter; Leading: percentage of endpoints with current patches Correct answer.
  2. Lagging: patch compliance rate; Leading: mean time to detect intrusions
  3. Lagging: training completion rate; Leading: number of reported phishing emails
  4. Lagging: control maturity score; Leading: audit findings closed last year

Explanation

Lagging indicators report outcomes that have already occurred, such as past incident counts, while leading indicators track conditions that predict future outcomes, such as patch currency. The other pairs invert or misclassify the temporal relationship.

Question 43Measure

A governance team needs a metric that reflects how quickly the organisation contains confirmed intrusions. Which measure is most appropriate?

  1. Total count of security exceptions approved
  2. Mean time to contain security incidents Correct answer.
  3. Number of vulnerability scans performed per month
  4. Percentage of staff who completed awareness training

Explanation

Mean time to contain directly measures the elapsed time between incident confirmation and containment, capturing response effectiveness. Scan volume, training completion and exception counts measure activity or exposure rather than containment speed.

Question 44Measure

Which statement best captures the purpose of a Key Risk Indicator (KRI) in cyber governance reporting?

  1. It provides early warning that risk exposure is moving outside acceptable tolerance Correct answer.
  2. It documents the technical configuration baseline of each server
  3. It lists the regulatory obligations the organisation must satisfy
  4. It records the financial loss already incurred from past breaches

Explanation

A KRI is a forward-looking measure tied to a risk appetite threshold, signalling when exposure is trending toward or beyond tolerance. Loss records, obligation registers and configuration baselines serve different purposes and do not function as early-warning indicators.

Question 45Measure

An organisation reports '99.9% patch compliance' but suffered three breaches via unpatched internet-facing servers. What is the most likely measurement weakness?

  1. The metric used too many decimal places
  2. The metric was approved by the risk committee
  3. The metric excluded internet-facing assets or used stale scan data Correct answer.
  4. The metric was reported too frequently to the board

Explanation

A high aggregate compliance figure that coexists with exploitation suggests scope gaps, such as excluded asset classes, or outdated data that no longer reflects reality. Reporting frequency, precision and approval authority do not explain the mismatch between the metric and observed outcomes.

Question 46Measure

Which measurement approach best supports continuous control monitoring in a cloud environment?

  1. Annual third-party penetration tests of the production environment
  2. Biennial review of the information security policy set
  3. Automated configuration checks against a hardened baseline, with alerts on drift Correct answer.
  4. Quarterly manual review of a sample of server build records

Explanation

Continuous monitoring requires automated, high-frequency evaluation of configuration state against an approved baseline, with drift detection. Annual tests, quarterly sampling and biennial policy reviews are periodic and cannot provide continuous assurance.

Question 47Measure

In a security metrics hierarchy, what distinguishes a 'metric' from a 'measure'?

  1. A measure is a raw data point; a metric is a measure with defined meaning and context Correct answer.
  2. A measure covers people; a metric covers technology
  3. A measure is reported to the board; a metric stays at operational level
  4. A measure is qualitative; a metric is always quantitative

Explanation

A measure is the underlying data observation, while a metric adds definition, thresholds and interpretation so it can support decisions. The distinction is about context and meaning, not qualitative versus quantitative or organisational level.

Question 48Measure

A board asks for assurance that third-party suppliers meet contractual security requirements. Which evidence source is most direct?

  1. The internal security team's headcount allocated to vendor management
  2. Supplier audit reports and independent assurance certificates held on file Correct answer.
  3. The number of suppliers registered in the procurement system
  4. The total value of supplier contracts signed this year

Explanation

Direct assurance comes from evidence about the supplier's actual control environment, such as audit reports and independent certifications. Supplier counts, staffing levels and contract values describe the programme's scale rather than supplier control effectiveness.

Question 49Measure

Which characteristic is essential for a cyber risk metric to be considered 'actionable' by governance bodies?

  1. It is reviewed only at the annual general meeting
  2. It is linked to a decision threshold that triggers a defined response Correct answer.
  3. It is calculated using the most advanced statistical model available
  4. It is expressed as a percentage rather than a count

Explanation

Actionability means the metric connects to a tolerance or threshold so that breaching it prompts a specific decision or escalation. Sophistication, unit of expression and review frequency do not by themselves make a metric drive action.

Question 50Measure

What is the primary role of a tolerance threshold in a cyber risk appetite statement when used for measurement?

  1. It specifies the encryption standard required for data at rest
  2. It defines the boundary beyond which exposure requires escalation and treatment Correct answer.
  3. It determines the audit frequency mandated by the regulator
  4. It sets the maximum number of staff permitted in the security team

Explanation

Tolerances translate risk appetite into measurable boundaries; when a metric crosses the threshold, escalation and treatment are triggered. Encryption standards, staffing limits and audit frequency are separate control or compliance decisions.