1.2 Architecting for Governance, Risk, and Compliance (GRC) ISSAP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following best illustrates the concept of business objective alignment in GRC?

   • AAdopting encryption for customer data to meet a business goal of expanding into markets with strict data protection laws
   • BPurchasing a new firewall because the current one is end-of-life
   • CChoosing a cloud provider based solely on the lowest cost
   • DImplementing a multi-factor authentication system because it is a best practice
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of segregation of duties?

   • AThe same person who writes a check also reconciles the bank statement
   • BThe person who develops code also deploys it to production
   • CThe person who requests a purchase is different from the person who approves it
   • DThe same person who approves a purchase also processes the payment
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A multinational corporation is defining its GRC architecture. The CISO wants to prioritize security investments, while the CFO is concerned about cost, and the legal team emphasizes regulatory compliance. Which stakeholder should have the most influence on the final GRC architecture decisions?

   • AThe CISO, because security is the primary focus of GRC.
   • BThe legal team, because compliance is a legal obligation.
   • CA balanced representation of all stakeholders, with decisions based on risk and business impact.
   • DThe CFO, because budget constraints ultimately determine what is feasible.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of a regulatory requirement that mandates specific controls?

   • AA data protection regulation requiring encryption of personal data in transit
   • BA company policy requiring password changes every 90 days
   • CA best practice recommendation from a security framework
   • DA vendor's terms of service for a cloud product
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial institution is preparing for a regulatory audit. The auditor requires evidence that security controls are operating effectively. Which report should the institution prepare?

   • AA report showing the results of control testing and monitoring activities.
   • BA report of the organization's risk assessment methodology.
   • CA report listing all security policies and procedures.
   • DA report of all security incidents from the past year.
   Reveal Solution Discussion Select an answer first