Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Infosys · Risk & Compliance
Practice Risk & Compliance questions specifically asked in Infosys interviews – ideal for online test preparation, technical rounds and final HR discussions.
Questions
43
Tagged for this company + subject
Company
Infosys
View company-wise questions
Subject
Risk & Compliance
Explore topic-wise practice
Go through each question and its explanation. Use this page for targeted revision just before your Infosys Risk & Compliance round.
Useful KPIs include policy compliance rates, incident response time, audit closure rates, and employee awareness scores. Tracking these indicators shows whether governance processes are improving, remaining stable, or need adjustment to maintain maturity.
For complete preparation, combine this company + subject page with full company-wise practice and subject-wise practice. You can also explore other companies and topics from the links below.
Phishing attacks exploit human behavior rather than system flaws. Attackers trick users into revealing sensitive data or clicking malicious links by posing as trusted entities. These attacks depend on manipulation and persuasion rather than hacking technology directly.
Risk represents the possibility of a negative event occurring when a threat successfully exploits a vulnerability. It combines the chance of the event happening with the severity of its outcome. Managing risk means understanding what could go wrong and taking steps to reduce that likelihood or impact.
A threat is anything that can cause harm, such as malware or an insider attack. A vulnerability is a weakness that makes a system open to that threat. Risk is the potential loss or damage when the threat exploits the vulnerability. For instance, an unpatched server is a vulnerability, ransomware is the threat, and the chance of losing data is the risk.
Governance defines how security is led and controlled within an organization. It sets accountability, decision-making, and reporting structures. Good governance ensures that cybersecurity supports business goals, not just technical operations, and that responsibilities are clearly assigned across all levels.
Cybersecurity risk is usually expressed as the combination of a threat, a vulnerability, and the potential impact. It represents the possibility that a threat will exploit a weakness and cause damage. The higher the likelihood or impact, the greater the overall risk.
Residual risk is the portion of risk that still exists after security measures are in place. No control completely removes risk, so organizations must decide if the remaining level is acceptable or needs further treatment.
Organizations can avoid, transfer, mitigate, or accept risks. Avoiding removes the exposure completely, transferring moves it elsewhere such as through insurance or outsourcing, and accepting means acknowledging it as tolerable. Amplifying risk is not a valid strategy.
Cybersecurity risks are owned by the business or process owners because they understand how those risks affect operations and objectives. The security team advises and supports, but final accountability rests with those responsible for the business outcome. This ensures that risk decisions align with organizational priorities.
ISO 27001 defines how an organization should build and maintain an Information Security Management System, also known as an I S M S. It ensures that information assets are protected using a structured process of risk assessment, control selection, and continuous improvement. The standard focuses on people, processes, and technology working together to safeguard data.
The Sarbanes–Oxley Act ensures that financial information presented by companies is accurate and transparent. It requires strict internal controls, segregation of duties, and detailed audit trails to prevent fraud. In technology terms, this translates to securing financial systems and maintaining complete audit logs.
Annex A in ISO 27001 lists a structured set of security controls that help manage risks to information assets. These controls cover governance, access control, cryptography, supplier relationships, and more. Organizations select relevant controls from Annex A based on their specific risks and business context.
Most privacy laws emphasize fairness, transparency, consent, purpose limitation, data minimization, and accountability. They ensure that personal data is collected only for legitimate purposes, used responsibly, and protected from unauthorized disclosure. These shared principles form the foundation of modern privacy governance worldwide.
The GDPR protects how organizations collect, process, and store personal data of individuals in the EU. It emphasizes consent, transparency, and accountability. It gives people control over their data and requires organizations to justify every use of personal information.
PCI DSS requires strong encryption to protect cardholder data at rest and in transit. Other requirements include maintaining firewalls, enforcing access control, and monitoring all network activity to prevent unauthorized access to payment information.
Data subject rights are legal privileges granted to individuals regarding their personal data. They include the right to access, correct, delete, restrict processing, and transfer their data. These rights empower people to control how organizations handle their personal information and ensure accountability.
Organizations must ensure vendors meet the same compliance and security standards they follow. This involves conducting due diligence, signing data protection agreements, and regularly auditing vendor practices. Shared responsibility must be clearly defined to avoid compliance failures through external partners.
A cybersecurity incident is any event that compromises or could compromise data or system security. Examples include malware infections, data leaks, unauthorized access, or denial-of-service attacks. The focus is on identifying, containing, and mitigating these events quickly.
RTO defines how quickly a system must be restored after an outage. RPO defines how much data loss is acceptable, based on the last available backup. Both metrics guide the design of recovery strategies and backup schedules.
Effective communication keeps teams coordinated and reduces confusion. It ensures management, legal, and technical staff share accurate information quickly. Clear internal communication limits misinformation, while controlled external communication protects the organization’s reputation and legal standing.
Data residency ensures that information is stored and handled according to the privacy laws of the country where it originates. Some regions restrict cross-border data transfers or require local storage. Understanding these rules prevents regulatory violations and protects user trust.
Cloud governance defines policies, roles, and controls for managing cloud usage securely and efficiently. It ensures compliance with internal and regulatory requirements, prevents cost and security sprawl, and maintains visibility over cloud operations. Strong governance reduces misconfigurations and enforces accountability across teams.
An exit strategy ensures that data, systems, and operations can be safely transferred or terminated if a vendor relationship ends. It covers secure data return, deletion procedures, and transition support. Planning ahead prevents vendor lock-in and protects sensitive information when contracts close.
Organizations must vet vendors for security maturity, ensure transparency in development processes, and require timely breach reporting. Contracts should include right-to-audit clauses. Continuous security assessments and shared monitoring can prevent third-party weaknesses from becoming internal risks.
Zero Trust assumes that no network, device, or user is inherently trustworthy. Every request must be authenticated, authorized, and continuously validated. It reduces the risk of insider threats and lateral movement after compromise.
Reports to the board should translate technical risk into business language. They summarize key metrics such as incident volume, control performance, and compliance status. The goal is to show how cybersecurity supports enterprise resilience and strategy.
A positive risk culture means employees understand their security responsibilities and act proactively. Leadership supports transparency, and incidents are reported without fear. The organization values awareness, accountability, and shared responsibility for protecting information assets.
Yahoo delayed public disclosure of massive data breaches, which later affected its business valuation and triggered fines. The case underscored the importance of timely breach reporting under data protection laws and maintaining transparency with regulators and customers.
In the LinkedIn breach, attackers obtained a database of hashed passwords and cracked many of them due to weak hashing algorithms. The event stressed the importance of using modern password hashing and salting techniques to protect user credentials.
SolarWinds changed how organizations view supply-chain trust. Companies now emphasize software bill of materials, code signing, vendor audits, and continuous monitoring. It encouraged regulators to push for secure-by-design development and transparency across software ecosystems.
Auditors use sampling to review a representative subset of data. Proper sampling ensures conclusions can be drawn efficiently without missing critical trends. It’s a balance between thoroughness and practicality.
An ISO 27001 audit reviews whether the Information Security Management System (I S M S) is properly implemented and effective. It ensures continuous risk management, policy enforcement, and alignment with ISO best practices for protecting information assets.
A risk register is a detailed record that lists all identified risks, their descriptions, likelihood, impact, control measures, and assigned owners. It keeps track of the status of each risk and helps ensure accountability. The register acts as a central tool for monitoring and communicating risk throughout the organization.
CIS Controls are a set of practical and prioritized actions developed by security experts to reduce real-world threats. They cover areas such as asset management, secure configuration, continuous monitoring, and incident response. They are designed to be implementable and measurable, helping organizations quickly strengthen their security posture.
A compliance audit checks whether an organization follows applicable laws, standards, and internal policies. It reviews documentation, technical controls, and evidence to ensure that all obligations are met and controls are functioning effectively.
Digital forensics helps uncover what happened, how it happened, and who was involved. Evidence such as logs, memory dumps, and network captures are collected systematically to maintain integrity and support legal or internal investigations.
The Shared Responsibility Model defines who secures which parts of the cloud environment. The cloud provider handles the physical and core infrastructure, while the customer is responsible for securing their data, configurations, access, and workloads. This model helps clarify accountability and avoid coverage gaps.
Third-party vendors often handle sensitive information or perform critical functions. However, organizations may not have full insight into their security posture. Without continuous oversight and clear contractual obligations, these external relationships can become major risk points.
Cybersecurity governance establishes leadership direction, assigns responsibilities, and ensures that security aligns with business objectives. It connects policies, risk management, and compliance under clear accountability. Governance turns cybersecurity from a technical task into a strategic discipline.
The Equifax breach occurred because the organization failed to patch a critical vulnerability in Apache Struts even after a fix was available. Attackers exploited the flaw to access personal data of over 140 million people. It highlighted the importance of timely patching, asset inventory, and vulnerability management discipline.
A cybersecurity audit checks whether policies, controls, and practices are properly designed and functioning. It helps verify compliance with standards like ISO 27001, NIST, or local data protection laws. The outcome supports accountability and continuous improvement.
Useful metrics include mean time to detect, mean time to respond, number of incidents by severity, and recurrence rate. Tracking these indicators helps identify response bottlenecks and demonstrates overall improvement in handling incidents over time.
The CIA Triad is the foundation of cybersecurity. Confidentiality means keeping data private and accessible only to authorized users. Integrity ensures that data remains accurate and unchanged unless properly authorized. Availability ensures that systems and information are accessible when needed by legitimate users. Together, these three principles guide how we secure any information system.