Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Cognizant · Risk & Compliance
Practice Risk & Compliance questions specifically asked in Cognizant interviews – ideal for online test preparation, technical rounds and final HR discussions.
Questions
41
Tagged for this company + subject
Company
Cognizant
View company-wise questions
Subject
Risk & Compliance
Explore topic-wise practice
Go through each question and its explanation. Use this page for targeted revision just before your Cognizant Risk & Compliance round.
A tabletop exercise is a simulated discussion-based activity where teams walk through incident scenarios without executing technical actions. It helps evaluate roles, decision-making, and coordination under realistic conditions, improving readiness before real incidents occur.
For complete preparation, combine this company + subject page with full company-wise practice and subject-wise practice. You can also explore other companies and topics from the links below.
Automation reduces manual errors, speeds up evidence collection, and ensures consistent control enforcement. Tools now map risks to regulations, track remediation progress, and generate real-time compliance dashboards. This allows organizations to shift focus from paperwork to continuous improvement.
A cybersecurity threat is any circumstance or event with the potential to negatively impact operations or assets. It can exploit vulnerabilities and cause unauthorized access, loss of data, or system disruption. Examples include malware, insider misuse, or natural disasters that affect IT systems.
Preventive controls aim to stop incidents before they occur, such as firewalls or access controls. Detective controls identify when something happens, like intrusion detection or log monitoring. Corrective controls act after an incident to restore normal operations, such as backups or patching.
The principle of least privilege means limiting access rights to the minimum necessary. Each account, process, or device operates with the smallest set of permissions required to perform its tasks. This limits damage if credentials or systems are compromised.
Continual improvement ensures that the security management system remains effective as new risks appear and technology changes. Regular reviews, audits, and corrective actions drive updates to controls and processes. This creates a cycle of learning and adaptation that strengthens long-term resilience.
Administrative controls involve policies, procedures, and training. Technical controls are mechanisms like firewalls, encryption, and access management. Physical controls are barriers such as locks, cameras, and security guards. Together, they form layers of protection around assets.
Risk is commonly assessed based on how likely an event is to happen and how severe its consequences would be. A high-likelihood, high-impact scenario is treated as a top priority for mitigation.
Key Risk Indicators are measurable metrics that show early signs of potential problems. Examples include the number of critical vulnerabilities, time to patch, or number of failed login attempts. KRIs help organizations detect changes in risk levels and act before incidents occur.
The NIST Cybersecurity Framework organizes key security activities into five core functions. Identify builds awareness of assets and risks, Protect strengthens defenses, Detect finds anomalies, Respond manages incidents, and Recover restores systems to normal. Together, they form a complete cycle of cybersecurity management.
Purpose limitation means that personal data must be collected for clear, specific, and lawful reasons. Once the purpose is defined, the data cannot be reused for other unrelated activities. This principle prevents unnecessary data processing and reinforces individual privacy rights.
Compliance means following a specific set of laws, regulations, or standards. Security means actively protecting systems from threats. A company can meet compliance requirements and still be insecure if controls are outdated or not enforced. Compliance provides structure, while security provides actual protection.
The Sarbanes–Oxley Act requires companies to implement strong internal controls that safeguard financial data and prevent fraud. These controls ensure accuracy, transparency, and accountability in all financial statements and reports.
Global privacy frameworks share common principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity. These principles ensure that personal information is processed responsibly, securely, and only for legitimate purposes.
A data retention policy defines how long different types of data are kept and when they are securely deleted. It ensures that data is stored only as long as necessary for legal, operational, or business reasons. This practice reduces exposure and supports compliance with privacy and industry regulations.
The lessons learned phase helps teams review incident handling, identify weak spots, and improve future response strategies. Documenting findings ensures the same mistakes are not repeated, strengthening overall preparedness.
Cyber resilience is the ability of an organization to anticipate, withstand, recover from, and adapt to cyber disruptions. It combines risk management, strong defenses, recovery planning, and continuous learning to ensure essential services continue even under attack.
Misconfigured cloud storage is one of the most frequent causes of breaches. When public access is mistakenly enabled or permissions are too broad, sensitive data becomes accessible to anyone. Regular configuration checks and automated policy enforcement help prevent such exposures.
Providers undergo external audits to validate compliance with standards such as ISO 27001 or SOC 2. These reports are shared with customers as assurance that key controls are tested and verified by accredited auditors.
Contracts should specify data protection requirements, breach notification obligations, audit rights, and incident response cooperation. They should also define liability limits, termination clauses, and compliance with laws like GDPR or DPDP. Clear contractual terms ensure both sides understand and uphold security responsibilities.
Organizations use native tools like AWS Config, Azure Policy, or Google Security Command Center to track compliance. These tools continuously compare configurations against standards such as CIS benchmarks or ISO 27001. They provide alerts and automated remediation to maintain compliance posture.
AI helps identify threats faster through pattern analysis and automation. However, it also creates new vulnerabilities, such as data poisoning, adversarial inputs, and model theft. Managing AI safely requires strong data governance and ethical guidelines.
Cybersecurity contributes to ESG by ensuring ethical data handling, protecting privacy, and demonstrating accountability in technology use. Transparent governance practices help build stakeholder confidence and show that security supports broader sustainability goals.
Cyber insurance transfers part of the financial risk from security incidents to an insurer. It covers costs like breach response, legal fees, and recovery. However, it complements—not replaces—good security practices and controls. The goal is to balance prevention with financial resilience.
High-profile breaches shifted security from a technical function to a board-level priority. Companies now invest in training, automated monitoring, and resilience planning. The culture has evolved toward proactive defense, transparency, and shared accountability across business units.
In the SolarWinds attack, adversaries compromised the vendor’s software supply chain by embedding malicious code into legitimate updates. When customers installed these updates, attackers gained access to their networks. It revealed how supply-chain attacks bypass traditional perimeter defenses and emphasized the need for code integrity verification and vendor vetting.
British Airways and Marriott faced large fines because regulators found their security measures insufficient under GDPR’s data protection requirements. The rulings demonstrated how compliance obligations go beyond documentation — companies must show practical, effective safeguards for user data.
Prompt disclosure allows regulators, users, and partners to take protective actions quickly. It shows accountability and transparency in handling sensitive information. Delays in reporting can worsen harm, increase fines, and damage trust far more than the incident itself.
Auditors rely on tangible evidence such as logs, reports, screenshots, or policy documents to verify that controls work as described. Evidence must be authentic, complete, and traceable to support audit conclusions.
Audit findings are prioritized using risk assessment — considering how severe and likely each issue is. High-risk findings demand urgent attention, while low-risk items may be tracked for later remediation or monitoring.
Compliance audits focus on whether an organization follows specific rules or frameworks like GDPR or HIPAA. Risk audits take a broader view, analyzing threats, vulnerabilities, and control effectiveness. Both together provide a full security picture.
These frameworks create structure and consistency in managing security. ISO 27001 focuses on building and maintaining an information security management system, while NIST provides clear technical and process-level guidance. Both help organizations assess risks, apply controls, and continuously improve their defenses.
Qualitative analysis uses expert opinion and descriptive scales such as low, medium, or high to rate risks. Quantitative analysis converts risks into numbers, often in terms of cost or probability. Both approaches aim to prioritize what needs attention first, but one is subjective and the other is data-driven.
PCI DSS protects data related to payment cards, such as card numbers, expiration dates, and security codes. It defines a strict set of requirements for network segmentation, encryption, and access control to reduce card fraud and data breaches in the payment ecosystem.
The DPDP Act establishes principles for handling personal data digitally in India. It requires organizations to obtain user consent, process data only for specific purposes, and maintain security measures. It also introduces the concept of data fiduciaries and user rights like correction and erasure.
Most privacy laws, including GDPR and HIPAA, require organizations to report data breaches within a specific time window, often 72 hours. The goal is to minimize harm by allowing individuals to take protective action and ensuring regulatory oversight.
The NIST incident response lifecycle defines a structured process for managing incidents. It starts with preparation and moves through detection, containment, eradication, recovery, and post-incident analysis. Each phase ensures timely control, learning, and improvement for future resilience.
A Business Continuity Plan outlines how essential operations will continue if normal processes are disrupted. It includes backup systems, alternate locations, communication plans, and recovery steps to minimize downtime and protect business reputation.
A strong SLA should include security requirements like encryption standards, access control expectations, and incident response timelines. It sets measurable obligations for the provider and creates accountability for compliance and service continuity.
The CISO sets security strategy, manages risks, and ensures compliance with regulations. They bridge the gap between technical teams and executives, making sure cybersecurity supports business priorities while protecting data and reputation.
Uber’s 2016 breach showed the dangers of mishandling disclosures. Instead of reporting the breach to authorities, the company paid the attackers under a false bug bounty. It resulted in legal penalties and emphasized the ethical and legal duty of transparent incident reporting.