ISC Governance Risk And Compliance — 25 Questions

Question 1

To satisfy SOC2 Type II requirements regarding access lifecycle management, which TWO configurations should an architect verify within Okta for all privileged administrative accounts?

Accepted Answer

Enforce Phishing-resistant MFA (FIDO2).. SOC2 Type II compliance for privileged administrative accounts requires rigorous access controls, including strong authentication (such as phishing-resistant MFA like FIDO2/WebAuthn) and governed access provisioning/deprovisioning through automated means like group-based assignments to ensure appropriate lifecycle management and auditing.

Answer

Enable self-service password reset.

Answer

Configure password complexity to 16 characters.

Answer

Enable Just-In-Time (JIT) access requests.

Question 2

An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?

Accepted Answer

Enforce s3:RequestedRegion in a Deny statement.. To ensure compliance with GDPR data sovereignty requirements across multiple regions, AWS Service Control Policies (SCPs) can use the 's3:RequestedRegion' condition key. By enforcing a Deny statement on requests where the requested region does not match the allowed regions, architects ensure that data processing and storage operations remain confined within compliant geographic boundaries.

Answer

Enable S3 Object Lock in compliance mode.

Answer

Utilize S3 Access Points per region.

Answer

Configure S3 Cross-Region Replication with filter.

Question 3

A firm is using Terraform for Infrastructure as Code (IaC) governance. The architect wants to prevent the deployment of insecure security groups. Which tool should be integrated into the CI/CD pipeline to perform static analysis against defined security policies?

Accepted Answer

Terraform Cloud Sentinel. Checkov is an industry-standard static analysis tool that scans Terraform files for compliance and security misconfigurations.

Answer

Azure Policy for Kubernetes

Answer

AWS CloudFormation Guard

Answer

SonarQube

Question 4

When implementing a Zero Trust Architecture in Google Cloud Platform (GCP), which component is the core Policy Decision Point (PDP) used to govern access to applications based on context-aware identity and device posture?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) acts as the Policy Decision Point (PDP) and Policy Enforcement Point (PEP) to govern access to applications based on identity and context. Access Context Manager provides the attribute-based access rules, but IAP is the core component making the enforcement and decision for application access.

Answer

VPC Service Controls

Answer

Access Context Manager

Answer

Cloud Resource Manager

Question 5

An organization is migrating to Azure and must align with NIST SP 800-53 controls. Which THREE actions should the architect perform within Microsoft Defender for Cloud to facilitate continuous compliance posture management?

Accepted Answer

Enable the NIST SP 800-53 regulatory compliance standard in the Environment Settings.. Option A is correct because enabling the NIST SP 800-53 regulatory compliance standard in Microsoft Defender for Cloud's Environment Settings activates the built-in regulatory compliance dashboard, which continuously assesses resources against the NIST SP 800-53 Rev. 5 controls and surfaces compliance posture. Option B is correct because workflow automation in Defender for Cloud triggers Logic Apps on assessment findings (e.g., regulatory compliance assessments), enabling continuous notification and remediation workflows that support ongoing compliance management. Option D is correct because Azure Policy guest configuration extensions (Guest Configuration / DSC) are required to audit in-guest OS settings on VMs, which is necessary for many NIST SP 800-53 controls that Defender for Cloud's regulatory compliance standard evaluates. Option C is not correct because exporting a Log Analytics workspace to Microsoft Sentinel is a SIEM integration for detection and investigation, not a Defender for Cloud continuous compliance posture management action. Option E is not correct because assigning the Security Reader role only grants read permissions for viewing security state; it does not facilitate continuous compliance posture management itself.

Answer

Configure Log Analytics workspace to export to Sentinel.

Answer

Assign the 'Security Reader' role to the compliance auditor.

Question 6

When applying the SABSA (Sherwood Applied Business Security Architecture) framework to a new project, at which stage of the lifecycle is the 'Concept' of the architecture first aligned with business requirements?

Accepted Answer

Contextual Layer. SABSA starts at the Contextual Layer, which focuses on the business requirements and concepts.

Answer

Physical Layer

Answer

Conceptual Layer

Answer

Operational Layer

Question 7

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 8

To ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirement for secure system component configuration, which AWS native service provides a dashboard to continuously monitor and remediate misconfigurations?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates compliance findings and provides a PCI DSS standard view with automated remediation workflows.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Artifact

Question 9

An organization must maintain HIPAA compliance in a hybrid cloud. Which architecture pattern best enables strict separation of duties between the administrative team and the data encryption keys?

Accepted Answer

Client-Side Encryption with local storage. The stem asks for an architecture pattern in a hybrid cloud, but the correct option specifies an AWS-proprietary managed service (AWS CloudHSM) without specifying the cloud provider in the stem. A better approach is to refer to a vendor-neutral pattern like External Key Management (EKM) or a dedicated Hardware Security Module (HSM).

Answer

AWS CloudHSM

Answer

Azure Key Vault

Answer

AWS KMS with Multi-Region keys

Question 10

A healthcare provider is deploying a multi-tenant application on GCP. To comply with data isolation requirements, which service should the architect use to ensure traffic between VPCs is strictly governed by network policy?

Accepted Answer

Shared VPC. VPC Service Controls protect GCP services against data exfiltration, but the correct mechanism to govern traffic strictly between VPCs (especially across tenants in a multi-tenant architecture) is VPC Network Peering or Shared VPC combined with VPC Firewall Rules, or VPC Network Firewalls. VPC Service Controls do not govern direct VPC-to-VPC network traffic data planes; rather, they secure Google-managed APIs and services within a perimeter.

Answer

Cloud Interconnect

Answer

VPC Service Controls

Answer

Cloud Armor

Question 11

An organization is building a microservices architecture. To ensure compliance with GDPR, where should the data classification metadata be enforced to ensure that PII is not stored in non-compliant regions?

Accepted Answer

Database schema constraints. To ensure that PII is not stored in non-compliant regions, data classification metadata must be enforced where the data is actually handled or ingested, typically at the application level or via database schema and data loss prevention (DLP) gateways. Infrastructure tags classify resources, not the data payload itself.

Answer

Container image manifests

Answer

Application service mesh proxy tags

Answer

Infrastructure tags and cloud policy enforcement

Question 12

In the context of the CISSP-ISSAP, which governance activity involves verifying that the architecture aligns with business requirements through regular audits?

Accepted Answer

Architecture Peer Review. Architecture Peer Review is a formal governance activity where stakeholders and experts evaluate the system architecture to verify that it properly aligns with both technical and business requirements. Regular audits of architectural alignment fall under review and assessment processes.

Answer

Threat Modeling

Answer

Risk Acceptance

Answer

Compliance Monitoring

Question 13

Which THREE components are critical to implement an effective 'Security as Code' architecture?

Accepted Answer

Continuous monitoring and remediation.. Security as Code requires treating security controls, policies, and checks as versioned, testable artifacts embedded in the software delivery lifecycle. Option B (Version control for security policies) is correct because storing policies, IaC templates, and compliance rules in Git (or similar VCS) enables peer review, audit trails, rollback, and drift detection — the foundation of any 'as code' practice. Option E (Automated security testing in the pipeline) is correct because SAST, DAST, SCA, IaC scanning, and policy-as-code checks (e.g., OPA/Conftest, Checkov) must run automatically in CI/CD to catch misconfigurations and vulnerabilities before deployment. Option A (Continuous monitoring and remediation) is correct because post-deployment runtime telemetry (e.g., GuardDuty, Security Hub, Falco) plus automated response closes the loop, detecting drift and enforcing the desired security state continuously. Option C is wrong because physical security keys are a hardware authentication control, not a Security as Code component, and mandating them for all developers is neither necessary nor scalable. Option D is wrong because manual approval boards for every change contradict the automation, speed, and repeatability that Security as Code depends on.

Answer

Physical security keys for all developers.

Answer

Manual approval boards for every change.

Question 14

An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?

Accepted Answer

Azure Key Vault. Azure Key Vault managed storage account keys provide automated rotation for shared keys, aligning with security governance requirements.

Answer

Azure Policy

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Monitor

Question 15

Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?

Accepted Answer

COBIT 2019 Framework. COBIT 2019 Framework: Governance and Management Objectives is the primary document outlining business alignment.

Answer

ISO/IEC 27001

Answer

ITIL 4

Answer

NIST CSF

Question 16

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 17

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Accepted Answer

Regulatory and legal obligations.. Risk appetite must align with business goals and legal requirements to be effective.

Answer

Vendor support availability.

Answer

Technical debt of legacy systems.

Answer

The number of cloud accounts.

Question 18

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

Accepted Answer

Audit. The 'Audit' effect is specifically designed to log events without impacting the deployment action.

Answer

Deny

Answer

DeployIfNotExists

Answer

Append

Question 19

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.

Question 20

In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?

Accepted Answer

Govern. NIST CSF 2.0 (released February 2024) introduced the new 'Govern' function as its sixth core function, elevating governance from a category within Identify to a standalone function. Govern explicitly addresses organizational context, risk management strategy, roles and responsibilities, and — critically — supply chain risk management (GV.SC category). This reflects the recognition that third-party and supply chain risk must be governed at the leadership level rather than treated as a sub-activity of Identify.

Answer

Identify

Answer

Respond

Answer

Protect