A retail chain is defining its cybersecurity governance structure. The CEO wants to ensure that security decisions are made with business input and that the security strategy supports the company's growth plans. Which governance model best achieves this objective?

Outsource all security governance to an external consultant.

Establish a cross-functional security steering committee with representatives from IT, legal, and business units.

Let the IT security team make all security decisions independently.

Adopt a purely technical framework without executive oversight.

A mid-sized manufacturing company is required by its largest client to demonstrate compliance with a recognized cybersecurity framework. The company has already implemented the CIS Controls and wants to avoid duplicating efforts. The compliance officer asks which framework would allow them to leverage their existing CIS Controls work most directly for a formal certification. Which recommendation is most appropriate?

Use the CIS Controls as a self-assessment and map them to ISO/IEC 27001 for formal certification.

Implement the ISO 27002 code of practice as a standalone certification.

Adopt the NIST Cybersecurity Framework (CSF) because it is a certifiable standard.

Replace the CIS Controls with the CIS Benchmarks to meet the client's requirement.

A large enterprise with a mature security team and significant resources is adopting the CIS Controls. They have already implemented all IG1 and IG2 safeguards. According to the CIS Controls framework, what should they do next?

Replace the CIS Controls with a proprietary framework to meet advanced needs.

Stop implementing controls because IG2 is sufficient for any organization.

Implement IG3 safeguards that address advanced threats and are appropriate for organizations with substantial security resources.

Re-evaluate their implementation groups and select a different set of controls from IG1.

How do the CIS Controls support the policy development process in an organization?

By replacing the need for any organizational security policies

By automatically generating all necessary security policies without human input

By serving as a legally binding set of policies that must be adopted verbatim

By providing a set of specific, prioritized safeguards that can be referenced when creating security policies

Which of the following is a key component of cybersecurity governance?

Establishing a risk management framework and defining roles and responsibilities for security decisions

Performing daily backups of critical data

Conducting penetration tests on a quarterly basis

Configuring firewalls and intrusion detection systems

GIAC Critical Controls Certification

Domain 1Objective 1

Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 8)

Part of the Foundations and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 36–40

36application · medium
A retail chain is defining its cybersecurity governance structure. The CEO wants to ensure that security decisions are made with business input and that the security strategy supports the company's growth plans. Which governance model best achieves this objective?
Select an answer first
37application · medium
A mid-sized manufacturing company is required by its largest client to demonstrate compliance with a recognized cybersecurity framework. The company has already implemented the CIS Controls and wants to avoid duplicating efforts. The compliance officer asks which framework would allow them to leverage their existing CIS Controls work most directly for a formal certification. Which recommendation is most appropriate?
Select an answer first
38application · medium
A large enterprise with a mature security team and significant resources is adopting the CIS Controls. They have already implemented all IG1 and IG2 safeguards. According to the CIS Controls framework, what should they do next?
Select an answer first
39foundation · easy
How do the CIS Controls support the policy development process in an organization?
Select an answer first
40foundation · easy
Which of the following is a key component of cybersecurity governance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.