Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Google · Risk & Compliance
Practice Risk & Compliance questions specifically asked in Google interviews – ideal for online test preparation, technical rounds and final HR discussions.
Questions
37
Tagged for this company + subject
Company
View company-wise questions
Subject
Risk & Compliance
Explore topic-wise practice
Go through each question and its explanation. Use this page for targeted revision just before your Google Risk & Compliance round.
Plans should be tested through simulations, failover drills, and scheduled recovery exercises. Testing helps verify whether systems, backups, and communication channels perform as expected. It also highlights weaknesses that can be corrected before an actual emergency.
For complete preparation, combine this company + subject page with full company-wise practice and subject-wise practice. You can also explore other companies and topics from the links below.
Before integration, the acquiring company should conduct thorough security assessments of the target’s systems, patch levels, and access controls. All inherited data should be reviewed for compliance risks. This prevents compromised systems or weak configurations from entering the new environment unnoticed.
An attack surface includes every pathway that could allow unauthorized access or data leakage. It includes open ports, APIs, user accounts, or misconfigured services. Reducing the attack surface means closing unnecessary paths and strengthening those that must remain open.
A vulnerability is a flaw, misconfiguration, or weakness that can be abused. An exploit is the technique or tool that takes advantage of that weakness. For example, an outdated web server may have a vulnerability, and a specially crafted request is the exploit that compromises it.
The first action after identifying a security incident is containment. Containment stops the attack from spreading or causing more harm. After that comes eradication of the threat, system recovery, and a review to prevent future occurrences.
The process begins by identifying assets and their related risks. Next comes assessing how likely each risk is and what impact it could have. Based on that, you decide how to treat it — mitigate, transfer, avoid, or accept. Finally, you monitor and review because risks change as systems and threats evolve.
Human behavior often determines whether attacks succeed or fail. Awareness programs teach employees how to recognize phishing, use strong passwords, and handle data safely. Regular training turns users into active defenders rather than weak points in the system.
Risk appetite describes how much uncertainty or potential loss a company is willing to tolerate in pursuit of its objectives. Some organizations take more risk for innovation or speed, while others prefer caution and tight control. It guides decisions about which risks to mitigate and which to accept.
Mitigation means applying security measures to minimize how likely a threat is to occur or how much damage it could cause. Examples include installing patches, enabling multi-factor authentication, or improving monitoring to detect attacks earlier.
A risk matrix, also called a heat map, shows risks visually based on their likelihood and impact. It helps decision-makers focus on the most critical areas that need attention or resources.
Risks should be presented in clear, business-oriented language that highlights potential impact on operations, reputation, or finances. Charts or heat maps help visualize priorities. Communication should focus on the overall risk posture, major changes, and the effectiveness of existing controls, allowing leadership to make informed decisions.
COBIT focuses on ensuring that IT systems and processes support overall business goals. It connects management, governance, and control requirements in a single model. By applying COBIT, organizations can measure performance, reduce risk, and ensure that technology adds value rather than introducing exposure.
HIPAA protects all forms of protected health information, or P H I, that identify an individual and relate to their medical history or treatment. It applies to hospitals, insurers, and business associates, requiring safeguards for confidentiality, integrity, and availability of patient data.
NIST provides detailed technical guidance and operational practices, ISO 27001 focuses on building a management system around security, and COBIT aligns technology controls with governance and business strategy. Together, they create a layered structure that covers governance, management, and execution.
Preparing for an audit involves reviewing policies, verifying control implementation, and collecting supporting evidence such as logs and training records. Internal assessments should be done first to identify and fix gaps. All documentation must be organized and accessible to show that processes are consistent and effective.
HIPAA is built around the Privacy, Security, and Breach Notification Rules. The Privacy Rule protects patient data access, the Security Rule focuses on technical safeguards, and the Breach Notification Rule ensures prompt reporting. There is no formal 'Data Retention Rule' under HIPAA.
The CCPA gives consumers the right to know what data is collected about them, request deletion, and prevent its sale to third parties. It enhances transparency and control for individuals regarding how their personal data is monetized or shared.
A compliance gap assessment is an internal review that compares current practices against the requirements of a specific regulation or framework. It identifies where controls or policies are missing or ineffective. Addressing these gaps early helps prevent legal penalties and improves overall security posture.
Accurate record-keeping demonstrates that policies and controls are implemented effectively. It includes maintaining logs, audit trails, and data processing records. These documents serve as evidence during audits and investigations, proving compliance with laws and internal policies.
Containment prevents further spread of an attack or data loss. It may involve disconnecting compromised systems, disabling accounts, or blocking network traffic. The goal is to stop the harm quickly while preserving evidence for investigation.
A Disaster Recovery Plan focuses on rebuilding technology systems after an outage or disaster. It includes procedures for restoring servers, networks, and data backups to resume operations as quickly as possible.
A good Incident Response Plan includes clear definitions of incident types, communication protocols, team roles, and escalation paths. It should describe how incidents are detected, analyzed, contained, and reported. It also includes contact lists and predefined response procedures for critical systems.
SOC 2 Type II reports evaluate how effectively a service provider’s security, availability, confidentiality, and privacy controls operate over time. It gives customers assurance that the provider maintains strong and consistent controls for sensitive data.
Due diligence evaluates a vendor’s technical and operational controls before establishing a partnership. It ensures that the third party follows sound security practices, meets regulatory expectations, and will not introduce unmanaged risk to the organization’s ecosystem.
After onboarding, organizations should track vendor performance, review compliance certificates, and conduct periodic audits. Continuous monitoring includes checking security questionnaires, incident reports, and service changes. If issues arise, corrective actions or contract updates are required to maintain compliance.
Misconfigurations can be avoided by enforcing least-privilege access, using automated compliance checks, and applying Infrastructure as Code templates. Regular audits and monitoring for public exposure reduce the chance of human error. Security baselines and alerts ensure consistent configuration across environments.
Cybersecurity ethics ensures that professionals act with integrity, confidentiality, and fairness. Handling personal or confidential data carries moral and legal responsibilities. Ethical decision-making builds trust between users, companies, and regulators.
A strong governance framework includes leadership commitment, defined roles and responsibilities, clear policies, and regular risk reporting. It integrates compliance, incident management, and business continuity under unified oversight. Continuous review ensures it remains aligned with evolving threats and regulations.
AI-driven systems must be transparent, unbiased, and used responsibly. Ethical governance ensures that automated decisions respect privacy, fairness, and accountability. It helps avoid over-reliance on algorithms that may misclassify threats or expose sensitive information.
A misconfigured Web Application Firewall allowed an attacker to exploit a server-side request forgery vulnerability and access AWS instance metadata. This exposed customer data stored in S3 buckets. The incident showed how misconfiguration in cloud security tools can cause large-scale data exposure.
The Marriott breach involved an acquired company’s system that was already compromised. The incident demonstrated how poor security due diligence during mergers can import vulnerabilities. It reinforced the need for security assessments and integration audits when acquiring new entities or platforms.
The Equifax case highlighted the need for robust patch management, asset visibility, and strong data encryption. It showed how neglecting a single known vulnerability can lead to massive reputational and financial loss. Continuous monitoring and accountability for vulnerability closure became critical takeaways.
An audit trail shows the sequence of actions, communications, and evidence collected during the audit. It ensures transparency and enables reviewers or regulators to verify how conclusions were reached.
The risk lifecycle starts with identifying possible threats and vulnerabilities. It continues with analyzing and evaluating how likely they are and what their consequences could be. Then, appropriate controls are chosen to treat or reduce the risk. Finally, the organization monitors and reviews these risks regularly to adapt to new threats or changes in systems.
The Information Technology Act 2000 provides a legal foundation for electronic records and digital signatures in India. It also defines offenses such as hacking, data theft, and cyber fraud, establishing penalties and procedures for handling cybercrime cases.
RegTech, short for Regulatory Technology, uses automation, analytics, and machine learning to manage compliance efficiently. It helps organizations track regulatory changes, monitor risk indicators, and generate audit-ready evidence with minimal manual effort.
A nonconformance represents a deviation between what is required and what is implemented. It could be a missing control, weak procedure, or policy violation. Each nonconformance needs corrective action and follow-up verification.