What is the primary characteristic of a high assurance system?

It is the easiest system to maintain

It is the least expensive system to operate

It is the fastest system available

It provides enhanced security and auditability for critical functions

Which activity is the primary purpose of asset identification in the context of GRC architecture?

To create a comprehensive inventory of data, systems, and infrastructure that require protection

To satisfy regulatory requirements for asset tagging

To assign a unique identifier to each asset for tracking purposes only

To determine the monetary value of every asset for insurance purposes

A multinational bank is deploying a new customer-facing mobile banking application. The bank operates in the EU and must comply with GDPR. The architecture team is designing the data flow and storage. Which requirement must be incorporated into the architecture to ensure GDPR compliance?

Obtain explicit consent from every user before collecting any personal data.

Store all personal data exclusively within the EU and never transfer it outside.

Encrypt all personal data at rest and in transit using AES-256.

Implement appropriate technical and organizational measures to protect personal data and ensure lawful processing.

Which of the following is an example of a monitoring mechanism used to track compliance status?

An automated tool that continuously checks system configurations against a security baseline

A risk assessment performed annually

A vulnerability scan performed once before a system goes live

Information Systems Security Architecture Professional

Domain 1Objective 2

1.2 Architecting for Governance, Risk, and Compliance (GRC) ISSAP Practice Questions (Page 7)

Part of the Governance, Risk, and Compliance (GRC) domain, which accounts for 21% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

12concepts

21%of the exam

Questions 31–35

31foundation · easy
What is the primary characteristic of a high assurance system?
Select an answer first
32foundation · easy
Which of the following is a risk treatment option?
Select an answer first
33foundation · easy
Which activity is the primary purpose of asset identification in the context of GRC architecture?
Select an answer first
34application · medium
A multinational bank is deploying a new customer-facing mobile banking application. The bank operates in the EU and must comply with GDPR. The architecture team is designing the data flow and storage. Which requirement must be incorporated into the architecture to ensure GDPR compliance?
Select an answer first
35foundation · easy
Which of the following is an example of a monitoring mechanism used to track compliance status?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.