A global bank is designing a monitoring solution to detect insider threats and meet regulatory audit requirements. The solution must balance privacy concerns of employees with the need for comprehensive monitoring. Which design best achieves this balance?

Monitor only activities related to critical financial systems and data, with clear policies and notifications.

Deploy monitoring tools but do not inform employees to avoid alerting potential insiders.

Monitor all employee activity, including personal communications, to ensure no threat is missed.

Use only manual reviews of access logs without automated alerting.

A technology startup is developing a new product. The risk assessment has identified a critical vulnerability in a third-party component. The startup has limited resources and must decide whether to fix, replace, or accept the risk. The product is expected to launch in two months. Which decision is most appropriate?

Replace the third-party component with a more secure alternative, even if it delays launch.

Fix the vulnerability by applying a vendor patch, and defer a full replacement until after launch.

Accept the risk because the component is widely used and the vulnerability is unlikely to be exploited.

Ignore the vulnerability because the product is new and attackers will not target it.

What is the primary purpose of determining applicable regulatory requirements in GRC architecture?

To eliminate the need for risk assessments

To identify which regulations mandate specific controls and auditability

To create a list of all regulations that exist in the world

To ensure that the organization is compliant with all possible regulations

Which of the following is an example of a system that would likely require high assurance design?

A customer relationship management (CRM) system

An internal employee time-tracking system

A system that controls a nuclear power plant

What is the primary purpose of designing systems to support forensic investigations?

To automate the response to all security incidents

To make it easier to delete evidence after an incident

To replace the need for legal counsel during investigations

To ensure that evidence is preserved and chain of custody is maintained

Information Systems Security Architecture Professional

Domain 1Objective 2

1.2 Architecting for Governance, Risk, and Compliance (GRC) ISSAP Practice Questions (Page 6)

Part of the Governance, Risk, and Compliance (GRC) domain, which accounts for 21% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

21%of the exam

Questions 26–30

26expert · hard
A global bank is designing a monitoring solution to detect insider threats and meet regulatory audit requirements. The solution must balance privacy concerns of employees with the need for comprehensive monitoring. Which design best achieves this balance?
Select an answer first
27expert · hard
A technology startup is developing a new product. The risk assessment has identified a critical vulnerability in a third-party component. The startup has limited resources and must decide whether to fix, replace, or accept the risk. The product is expected to launch in two months. Which decision is most appropriate?
Select an answer first
28foundation · easy
What is the primary purpose of determining applicable regulatory requirements in GRC architecture?
Select an answer first
29foundation · easy
Which of the following is an example of a system that would likely require high assurance design?
Select an answer first
30foundation · easy
What is the primary purpose of designing systems to support forensic investigations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.