A law enforcement agency is designing a system to store evidence from cybercrime investigations. The system must maintain chain of custody and be admissible in court. The agency also wants to allow multiple investigators to access the evidence. Which design is most appropriate?

Use a write-once, read-many (WORM) storage with cryptographic hashing and strict access controls.

Store evidence on a shared network drive with no access controls to facilitate collaboration.

Allow investigators to edit evidence files to add annotations, with a full audit trail.

Use a cloud storage service without additional security controls.

Which of the following is an example of a stakeholder with high influence but low interest in GRC decisions?

A chief executive officer (CEO) who is briefed on major risks but not involved in daily security operations

A regulatory auditor who reviews compliance annually

A customer who uses the company's online services

A security analyst who monitors alerts daily

What is the primary purpose of incorporating risk assessment artifacts, such as risk registers and threat models, into architecture decisions?

To satisfy regulatory requirements for risk assessments

To replace the need for ongoing risk monitoring

To inform architecture decisions with a clear understanding of risks and threats

To document that a risk assessment was performed

A healthcare organization is designing a monitoring solution to ensure compliance with HIPAA. The solution must detect unauthorized access to patient records and provide evidence for audits. Which monitoring design best meets these requirements?

Encrypt patient records at rest to protect data confidentiality.

Implement a firewall to block external access to the patient record database.

Log all access to patient records and use a SIEM to alert on anomalous access patterns.

Conduct quarterly vulnerability scans of the network.

Which characteristic is most important for a compliance audit report?

It is concise and fits on one page

It highlights only the positive aspects of compliance

It contains accurate and verifiable evidence of control effectiveness

It is written in technical language for IT staff

Information Systems Security Architecture Professional

Domain 1Objective 2

1.2 Architecting for Governance, Risk, and Compliance (GRC) ISSAP Practice Questions (Page 3)

Part of the Governance, Risk, and Compliance (GRC) domain, which accounts for 21% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

21%of the exam

Questions 11–15

11expert · hard
A law enforcement agency is designing a system to store evidence from cybercrime investigations. The system must maintain chain of custody and be admissible in court. The agency also wants to allow multiple investigators to access the evidence. Which design is most appropriate?
Select an answer first
12foundation · easy
Which of the following is an example of a stakeholder with high influence but low interest in GRC decisions?
Select an answer first
13foundation · easy
What is the primary purpose of incorporating risk assessment artifacts, such as risk registers and threat models, into architecture decisions?
Select an answer first
14application · medium
A healthcare organization is designing a monitoring solution to ensure compliance with HIPAA. The solution must detect unauthorized access to patient records and provide evidence for audits. Which monitoring design best meets these requirements?
Select an answer first
15foundation · easy
Which characteristic is most important for a compliance audit report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.