ISC Governance Risk And Compliance Practice Test 2 — 15 Questions

Question 1

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 2

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Accepted Answer

Regulatory and legal obligations.. Risk appetite must align with business goals and legal requirements to be effective.

Answer

Vendor support availability.

Answer

Technical debt of legacy systems.

Answer

The number of cloud accounts.

Question 3

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

Accepted Answer

Audit. The 'Audit' effect is specifically designed to log events without impacting the deployment action.

Answer

Deny

Answer

DeployIfNotExists

Answer

Append

Question 4

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.

Question 5

In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?

Accepted Answer

Govern. NIST CSF 2.0 (released February 2024) introduced the new 'Govern' function as its sixth core function, elevating governance from a category within Identify to a standalone function. Govern explicitly addresses organizational context, risk management strategy, roles and responsibilities, and — critically — supply chain risk management (GV.SC category). This reflects the recognition that third-party and supply chain risk must be governed at the leadership level rather than treated as a sub-activity of Identify.

Answer

Identify

Answer

Respond

Answer

Protect

Question 6

A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?

Accepted Answer

AWS CloudFormation Guard. CloudFormation Guard is an open-source tool that lets developers define policy-as-code to validate CloudFormation templates before deployment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 7

Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?

Accepted Answer

Centralized Governance. Centralized governance provides consistent policy enforcement, though it may be less agile than decentralized models.

Answer

Ad-hoc Governance

Answer

Federated Governance

Answer

Decentralized Governance

Question 8

Which THREE components are critical for an ISSAP architect when designing an audit trail that meets the legal requirements for non-repudiation?

Accepted Answer

Synchronized time sources (NTP).. Option A (Synchronized time sources via NTP) is correct because non-repudiation requires a trustworthy, consistent timeline across all systems; RFC 5905 NTP keeps clocks within tight tolerances so events can be correlated and their sequence proven in legal proceedings. Option B (Digitally signed logs) is correct because cryptographic signatures using asymmetric keys bind each log entry to its origin, providing integrity and authentication so a party cannot later deny having generated the record. Option C (Immutable storage such as WORM) is correct because write-once-read-many media prevents alteration or deletion of audit records after the fact, preserving evidentiary integrity required by regulations like SEC 17a-4 and HIPAA. Option D (Regular log rotation cycles) is not essential for non-repudiation; rotation is an operational housekeeping practice that manages file size and retention but does not by itself prove authenticity or prevent tampering. Option E (Local write-only hard drives) is not appropriate because local storage is not tamper-evident or independently verifiable, and 'write-only' drives do not provide the cryptographic integrity, trusted timestamping, or centralized protection that non-repudiation demands.

Answer

Regular log rotation cycles.

Answer

Local write-only hard drives.

Question 9

Which document is considered the authoritative 'System Security Plan' (SSP) for an information system undergoing a formal authorization process?

Accepted Answer

System Security Plan (SSP). The SSP is the primary document that details how security controls are met for a system.

Answer

Risk Assessment Report (RAR)

Answer

Plan of Action and Milestones (POA&M)

Answer

Authority to Operate (ATO)

Question 10

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

Accepted Answer

GitHub Advanced Security Secret Scanning. GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.

Answer

GitHub Actions

Answer

GitHub Dependabot

Answer

GitHub Codespaces

Question 11

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Accepted Answer

Data discovery and tagging tools.. Right to be forgotten requires finding and securely deleting data across potentially distributed systems.

Answer

Single Sign-On (SSO) integration.

Answer

Database audit logs.

Question 12

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

Accepted Answer

Conduct a formal risk assessment of the new service.. New cloud services require updated risk assessments and governance mapping.

Answer

Increase the organization's total headcount.

Answer

Immediately decommission the old service.

Answer

Rename the existing risk registers.

Question 13

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 14

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Accepted Answer

Kubernetes Admission Controllers. Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.

Answer

Network Policies

Answer

Kubernetes Secrets

Answer

Role-Based Access Control (RBAC)

Question 15

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

Accepted Answer

EC2 Image Builder. EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.

Answer

AWS Systems Manager

Answer

AWS Service Catalog

Answer

AWS Lambda