A financial services firm is implementing a new trade processing system. The system must prevent an individual from both initiating and approving a trade. The architecture team is designing the access control model. Which control should be implemented?

Discretionary access control where the trade initiator can grant approval rights to another user.

Attribute-based access control with a policy that allows any user to initiate and approve if they have the right attributes.

Mandatory access control based on security labels for trade data.

Role-based access control with mutually exclusive roles for trade initiation and approval.

Which of the following is a key element of an effective vulnerability management report?

A list of all vulnerabilities sorted by discovery date

A summary of vulnerabilities prioritized by risk severity

A detailed explanation of every vulnerability's technical cause

A comparison of vulnerabilities across different business units

A defense contractor is designing a system to control nuclear launch codes. The system must have the highest level of assurance and be resistant to tampering. Which design principle is most critical?

Implement a formal verification process for all critical code.

Minimize logging to reduce the attack surface.

Use a commercial off-the-shelf operating system to reduce costs.

Allow remote software updates to quickly patch vulnerabilities.

A retail company is launching an e-commerce platform. The business objective is to maximize customer trust and minimize fraud. The security architect is aligning security controls with business goals. Which approach best supports this objective?

Implement strong authentication and fraud detection, accepting some friction in user experience.

Prioritize a seamless checkout process, deferring security controls to post-launch.

Adopt a risk acceptance strategy for all identified fraud risks to avoid impacting sales.

Implement the most restrictive security controls possible, even if it reduces usability.

Information Systems Security Architecture Professional

Domain 1Objective 2

1.2 Architecting for Governance, Risk, and Compliance (GRC) ISSAP Practice Questions (Page 2)

Part of the Governance, Risk, and Compliance (GRC) domain, which accounts for 21% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

21%of the exam

Questions 6–10

6application · medium
A financial services firm is implementing a new trade processing system. The system must prevent an individual from both initiating and approving a trade. The architecture team is designing the access control model. Which control should be implemented?
Select an answer first
7foundation · easy
Which of the following is a key element of an effective vulnerability management report?
Select an answer first
8application · medium
A defense contractor is designing a system to control nuclear launch codes. The system must have the highest level of assurance and be resistant to tampering. Which design principle is most critical?
Select an answer first
9foundation · easy
Which risk treatment option involves purchasing an insurance policy to cover potential losses?
Select an answer first
10application · medium
A retail company is launching an e-commerce platform. The business objective is to maximize customer trust and minimize fraud. The security architect is aligning security controls with business goals. Which approach best supports this objective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.