Due Care and Due Diligence: CC Practice Questions

Question 1

A regulator asks an organization to demonstrate how leadership stays informed about emerging threats and evolving compliance obligations that affect its systems. The security team must select an activity that reflects this responsibility. Which activity best shows this ongoing responsibility?

Conducting recurring assessments to identify new risks and regulatory changes Applying vendor security patches on a fixed monthly maintenance schedule Reviewing incident response steps whenever a security event has been reported Enforcing the acceptable use policy across all employee workstations daily

Correct Answer: Conducting recurring assessments to identify new risks and regulatory changes

Recurring assessments continuously identify new threats and regulatory changes, giving leadership the ongoing awareness needed to stay informed and adapt governance and compliance efforts.

Applying patches on a fixed schedule is operational maintenance, not threat and compliance awareness. Enforcing acceptable use policy addresses daily behavior control, not emerging risk monitoring. Reviewing incident response steps after an event is reactive and event-driven, not a proactive ongoing effort to track evolving obligations.

Key concept: continuous risk and compliance monitoring as a leadership governance responsibility.

Question 2

Which body of law most commonly serves as the reference point for judging whether an organization exercised due care and due diligence after a security incident?

Tort law and the prudent person standard Administrative law and the regulatory penalty schedule Criminal law and the reasonable suspicion rule Contract law and the vendor liability clause

Correct Answer: Tort law and the prudent person standard

Tort law, through the prudent person standard, is the framework courts use to determine whether an organization acted as a reasonable, careful entity would when protecting assets and data, making it the basis for judging due care and due diligence.

Contract law only governs obligations agreed between parties, not general negligence. Criminal law addresses offenses against the state and requires proof beyond a reasonable doubt, not civil negligence standards. Administrative law concerns regulatory compliance and penalties, not the reasonableness of an organization's conduct.

Key concept: negligence and the prudent person standard under tort law.

Question 3

Which legal or professional standard is most closely associated with the ongoing effort of gathering information and researching risks before making a decision?

Due diligence Due care Prudent person rule Reasonable assurance

Correct Answer: Due diligence

Due diligence is correct because it refers to the ongoing process of gathering information and researching risks to make an informed decision before acting.

Due care is wrong because it describes actually taking the reasonable actions to protect assets, not the investigative research beforehand. The prudent person rule is a broader standard of acting responsibly, not specifically about investigation. Reasonable assurance relates to control effectiveness and confidence levels, not information gathering.

The key concept tested is the distinction between due diligence (research and investigation) and due care (implementation and action).

Due Care and Due Diligence

CC - Due Care and Due Diligence Example Questions

Question 1

Question 2

Question 3

Begin Your Cybersecurity Career

Other Domain 1: Security Principles concepts