ISC Governance Risk And Compliance Practice Test 1 — 15 Questions

Question 1

A firm is using Terraform for Infrastructure as Code (IaC) governance. The architect wants to prevent the deployment of insecure security groups. Which tool should be integrated into the CI/CD pipeline to perform static analysis against defined security policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Terraform Cloud Sentinel. Checkov is an industry-standard static analysis tool that scans Terraform files for compliance and security misconfigurations.

Answer

Azure Policy for Kubernetes

Answer

AWS CloudFormation Guard

Answer

SonarQube

Question 2

When applying the SABSA (Sherwood Applied Business Security Architecture) framework to a new project, at which stage of the lifecycle is the 'Concept' of the architecture first aligned with business requirements?

Accepted Answer

Contextual Layer. SABSA starts at the Contextual Layer, which focuses on the business requirements and concepts.

Answer

Physical Layer

Answer

Conceptual Layer

Answer

Operational Layer

Question 3

To satisfy SOC2 Type II requirements regarding access lifecycle management, which TWO configurations should an architect verify within Okta for all privileged administrative accounts?

Accepted Answer

Enforce Phishing-resistant MFA (FIDO2).. SOC2 requires strict lifecycle management and authentication assurance for privileged accounts.

Answer

Enable self-service password reset.

Answer

Configure password complexity to 16 characters.

Answer

Configure group-based assignments for all apps.

Question 4

An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?

Accepted Answer

Enforce s3:RequestedRegion in a Deny statement.. Using 's3:RequestedRegion' in an SCP allows for the restriction of bucket creation to specific geographic regions, which is a common requirement for data sovereignty.

Answer

Enable S3 Object Lock in compliance mode.

Answer

Utilize S3 Access Points per region.

Answer

Configure S3 Cross-Region Replication with filter.

Question 5

When implementing a Zero Trust Architecture in Google Cloud Platform (GCP), which component is the core Policy Decision Point (PDP) used to govern access to applications based on context-aware identity and device posture?

Accepted Answer

Access Context Manager. Access Context Manager is the policy engine in GCP that defines the context used by the BeyondCorp architecture to make access decisions.

Answer

VPC Service Controls

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Resource Manager

Question 6

An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?

Accepted Answer

Azure Key Vault. Azure Key Vault managed storage account keys provide automated rotation for shared keys, aligning with security governance requirements.

Answer

Azure Policy

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Monitor

Question 7

Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?

Accepted Answer

COBIT 2019 Framework. COBIT 2019 Framework: Governance and Management Objectives is the primary document outlining business alignment.

Answer

ISO/IEC 27001

Answer

ITIL 4

Answer

NIST CSF

Question 8

An organization is migrating to Azure and must align with NIST SP 800-53 controls. Which THREE actions should the architect perform within Microsoft Defender for Cloud to facilitate continuous compliance posture management?

Accepted Answer

Enable the NIST SP 800-53 regulatory compliance standard in the Environment Settings.. Defender for Cloud provides integrated regulatory compliance dashboards for NIST 800-53, requiring specific setup steps.

Answer

Configure Log Analytics workspace to export to Sentinel.

Answer

Assign the 'Security Reader' role to the compliance auditor.

Question 9

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 10

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 11

To ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirement for secure system component configuration, which AWS native service provides a dashboard to continuously monitor and remediate misconfigurations?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates compliance findings and provides a PCI DSS standard view with automated remediation workflows.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Artifact

Question 12

An organization must maintain HIPAA compliance in a hybrid cloud. Which architecture pattern best enables strict separation of duties between the administrative team and the data encryption keys?

Accepted Answer

AWS CloudHSM. Using an external HSM (Hardware Security Module) like AWS CloudHSM ensures that administrators of the cloud infrastructure have no access to the keys, fulfilling the separation of duties requirement.

Answer

Client-Side Encryption with local storage

Answer

Azure Key Vault

Answer

AWS KMS with Multi-Region keys

Question 13

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Accepted Answer

Regulatory and legal obligations.. Risk appetite must align with business goals and legal requirements to be effective.

Answer

Vendor support availability.

Answer

Technical debt of legacy systems.

Answer

The number of cloud accounts.

Question 14

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

Accepted Answer

Audit. The 'Audit' effect is specifically designed to log events without impacting the deployment action.

Answer

Deny

Answer

DeployIfNotExists

Answer

Append

Question 15

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.