1.2 Architecting for Governance, Risk, and Compliance (GRC) ISSAP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of compliance audit reporting?

   • ATo identify all security weaknesses in the organization
   • BTo demonstrate compliance with relevant regulations and standards
   • CTo provide a basis for employee performance reviews
   • DTo replace the need for external audits
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company is adopting a new IoT platform. The risk assessment has identified a high likelihood of device compromise. The business is risk-averse and wants to minimize operational disruption. Which risk treatment option is most appropriate?

   • AAvoid the risk by not deploying the IoT platform.
   • BAccept the risk because the likelihood is high but impact is low.
   • CTransfer the risk by purchasing cyber insurance.
   • DMitigate by implementing strong device authentication and network segmentation.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of designing monitoring mechanisms in a GRC architecture?

   • ATo replace the need for periodic risk assessments
   • BTo automate the remediation of all identified vulnerabilities
   • CTo generate reports for senior management on a quarterly basis
   • DTo track the performance of security controls, vulnerabilities, and compliance status over time
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A software company wants to improve its vulnerability management reporting. The goal is to help executives understand risk and prioritize remediation. Which reporting approach is most effective?

   • AFocus on the total number of vulnerabilities patched each month.
   • BReport on the number of vulnerabilities by severity and the risk to critical assets.
   • CShare raw vulnerability scan results with all stakeholders.
   • DProvide a detailed list of all vulnerabilities with CVSS scores.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A hospital is implementing a new telehealth platform. The risk assessment shows a high likelihood of patient data breaches due to remote access. The hospital is risk-averse and must comply with HIPAA. The CFO is concerned about the cost of security controls. Which risk treatment strategy best balances these concerns?

   • AAccept the risk because the cost of controls is too high.
   • BAvoid the risk by not deploying the telehealth platform.
   • CTransfer the risk by purchasing cyber liability insurance.
   • DMitigate the risk by implementing multi-factor authentication and end-to-end encryption.
   Reveal Solution Discussion Select an answer first