Which of the following is an example of a data asset that would be identified during asset identification?

A customer database containing personally identifiable information (PII)

An intrusion detection system (IDS) sensor

In stakeholder analysis for GRC decisions, what is the primary reason for identifying stakeholders and their interests?

To ensure that all stakeholders are satisfied with every GRC decision

To determine who should be held accountable if a security incident occurs

To understand and prioritize stakeholder interests and influence to inform GRC decisions

To create a communication plan for all stakeholders

What is the primary purpose of segregation of duties (SoD) in an organization?

To prevent conflicts of interest and reduce the risk of fraud

To ensure that all employees have equal access to systems

To simplify the IT infrastructure by consolidating roles

To reduce the number of employees needed to perform a task

A financial institution is implementing a new payment processing system. The system must enforce segregation of duties to prevent fraud. Which of the following controls are essential? (Select all that apply.)

Log all payment activities and monitor for anomalous patterns.

Implement role-based access control with mutually exclusive roles for payment creation and approval.

Use a single administrative account for all payment system administration.

Allow the same user to create and approve a payment if they are a manager.

Require two different users to approve a payment above a certain threshold.

Information Systems Security Architecture Professional

Domain 1Objective 2

1.2 Architecting for Governance, Risk, and Compliance (GRC) ISSAP Practice Questions (Page 4)

Part of the Governance, Risk, and Compliance (GRC) domain, which accounts for 21% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

21%of the exam

Questions 16–20

16foundation · easy
Which of the following is an example of a data asset that would be identified during asset identification?
Select an answer first
17foundation · easy
In stakeholder analysis for GRC decisions, what is the primary reason for identifying stakeholders and their interests?
Select an answer first
18foundation · easy
Which of the following is an example of a risk assessment artifact?
Select an answer first
19foundation · easy
What is the primary purpose of segregation of duties (SoD) in an organization?
Select an answer first
20expert · hard · select all that apply
A financial institution is implementing a new payment processing system. The system must enforce segregation of duties to prevent fraud. Which of the following controls are essential? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.