ISC Governance Risk And Compliance Practice Test 2 — 15 Questions

Question 1

In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?

Accepted Answer

Govern. NIST CSF 2.0 added the 'Govern' function, which specifically includes Supply Chain Risk Management (SCRM) and governance strategy.

Answer

Identify

Answer

Respond

Answer

Protect

Question 2

A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?

Accepted Answer

AWS CloudFormation Guard. CloudFormation Guard is an open-source tool that lets developers define policy-as-code to validate CloudFormation templates before deployment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 3

Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?

Accepted Answer

Centralized Governance. Centralized governance provides consistent policy enforcement, though it may be less agile than decentralized models.

Answer

Ad-hoc Governance

Answer

Federated Governance

Answer

Decentralized Governance

Question 4

Which THREE components are critical for an ISSAP architect when designing an audit trail that meets the legal requirements for non-repudiation?

Accepted Answer

Synchronized time sources (NTP).. Non-repudiation requires evidence of identity and content integrity that cannot be challenged.

Answer

Regular log rotation cycles.

Answer

Local write-only hard drives.

Question 5

A healthcare provider is deploying a multi-tenant application on GCP. To comply with data isolation requirements, which service should the architect use to ensure traffic between VPCs is strictly governed by network policy?

Accepted Answer

VPC Service Controls. VPC Service Controls provides a security perimeter that prevents data exfiltration and enforces strict network boundary compliance in GCP.

Answer

Cloud Interconnect

Answer

Shared VPC

Answer

Cloud Armor

Question 6

An organization is building a microservices architecture. To ensure compliance with GDPR, where should the data classification metadata be enforced to ensure that PII is not stored in non-compliant regions?

Accepted Answer

Infrastructure tags and cloud policy enforcement. Enforcing classification at the infrastructure level (e.g., tags or resource policies) allows automated tools to restrict data placement.

Answer

Database schema constraints

Answer

Container image manifests

Answer

Application service mesh proxy tags

Question 7

Which document is considered the authoritative 'System Security Plan' (SSP) for an information system undergoing a formal authorization process?

Accepted Answer

System Security Plan (SSP). The SSP is the primary document that details how security controls are met for a system.

Answer

Risk Assessment Report (RAR)

Answer

Plan of Action and Milestones (POA&M)

Answer

Authority to Operate (ATO)

Question 8

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

Accepted Answer

GitHub Advanced Security Secret Scanning. GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.

Answer

GitHub Actions

Answer

GitHub Dependabot

Answer

GitHub Codespaces

Question 9

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Accepted Answer

Data discovery and tagging tools.. Right to be forgotten requires finding and securely deleting data across potentially distributed systems.

Answer

Single Sign-On (SSO) integration.

Answer

Database audit logs.

Question 10

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

Accepted Answer

Conduct a formal risk assessment of the new service.. New cloud services require updated risk assessments and governance mapping.

Answer

Increase the organization's total headcount.

Answer

Immediately decommission the old service.

Answer

Rename the existing risk registers.

Question 11

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 12

In the context of the CISSP-ISSAP, which governance activity involves verifying that the architecture aligns with business requirements through regular audits?

Accepted Answer

Compliance Monitoring. Compliance Monitoring is the governance activity that ensures the implemented system remains aligned with business requirements and regulatory standards.

Answer

Threat Modeling

Answer

Risk Acceptance

Answer

Architecture Peer Review

Question 13

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Accepted Answer

Kubernetes Admission Controllers. Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.

Answer

Network Policies

Answer

Kubernetes Secrets

Answer

Role-Based Access Control (RBAC)

Question 14

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

Accepted Answer

EC2 Image Builder. EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.

Answer

AWS Systems Manager

Answer

AWS Service Catalog

Answer

AWS Lambda

Question 15

Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?

Accepted Answer

COBIT. COBIT is specifically designed to bridge the gap between IT and business requirements in large-scale enterprises.

Answer

ITIL

Answer

NIST RMF

Answer

ISO/IEC 27005