ISC Governance Risk And Compliance — 10 Questions

Question 1

A firm is using Terraform for Infrastructure as Code (IaC) governance. The architect wants to prevent the deployment of insecure security groups. Which tool should be integrated into the CI/CD pipeline to perform static analysis against defined security policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Terraform Cloud Sentinel. Checkov is an industry-standard static analysis tool that scans Terraform files for compliance and security misconfigurations.

Answer

Azure Policy for Kubernetes

Answer

AWS CloudFormation Guard

Answer

SonarQube

Question 2

When applying the SABSA (Sherwood Applied Business Security Architecture) framework to a new project, at which stage of the lifecycle is the 'Concept' of the architecture first aligned with business requirements?

Accepted Answer

Contextual Layer. SABSA starts at the Contextual Layer, which focuses on the business requirements and concepts.

Answer

Physical Layer

Answer

Conceptual Layer

Answer

Operational Layer

Question 3

To satisfy SOC2 Type II requirements regarding access lifecycle management, which TWO configurations should an architect verify within Okta for all privileged administrative accounts?

Accepted Answer

Enforce Phishing-resistant MFA (FIDO2).. SOC2 requires strict lifecycle management and authentication assurance for privileged accounts.

Answer

Enable self-service password reset.

Answer

Configure password complexity to 16 characters.

Answer

Configure group-based assignments for all apps.

Question 4

An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?

Accepted Answer

Enforce s3:RequestedRegion in a Deny statement.. Using 's3:RequestedRegion' in an SCP allows for the restriction of bucket creation to specific geographic regions, which is a common requirement for data sovereignty.

Answer

Enable S3 Object Lock in compliance mode.

Answer

Utilize S3 Access Points per region.

Answer

Configure S3 Cross-Region Replication with filter.

Question 5

When implementing a Zero Trust Architecture in Google Cloud Platform (GCP), which component is the core Policy Decision Point (PDP) used to govern access to applications based on context-aware identity and device posture?

Accepted Answer

Access Context Manager. Access Context Manager is the policy engine in GCP that defines the context used by the BeyondCorp architecture to make access decisions.

Answer

VPC Service Controls

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Resource Manager

Question 6

An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?

Accepted Answer

Azure Key Vault. Azure Key Vault managed storage account keys provide automated rotation for shared keys, aligning with security governance requirements.

Answer

Azure Policy

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Monitor

Question 7

Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?

Accepted Answer

COBIT 2019 Framework. COBIT 2019 Framework: Governance and Management Objectives is the primary document outlining business alignment.

Answer

ISO/IEC 27001

Answer

ITIL 4

Answer

NIST CSF

Question 8

An organization is migrating to Azure and must align with NIST SP 800-53 controls. Which THREE actions should the architect perform within Microsoft Defender for Cloud to facilitate continuous compliance posture management?

Accepted Answer

Enable the NIST SP 800-53 regulatory compliance standard in the Environment Settings.. Defender for Cloud provides integrated regulatory compliance dashboards for NIST 800-53, requiring specific setup steps.

Answer

Configure Log Analytics workspace to export to Sentinel.

Answer

Assign the 'Security Reader' role to the compliance auditor.

Question 9

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 10

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput