Scenario practice questions

A global retailer's GRC team is preparing for an external audit of its compliance program. The auditor requests evidence that the program's governing body has reviewed and approved the risk appetite and tolerance levels within the last twelve months. Which activity satisfies this request?

Trap 1: The enterprise risk register showing current risk scores against…

The risk register shows how risks compare to thresholds, but it does not prove that the governing body reviewed and approved the appetite and tolerance levels. Registers are operational tools updated by risk owners. While useful for monitoring, they are not governance approval records. The scenario requires evidence of governing body approval within the last twelve months, which the register alone cannot provide.

Trap 2: The internal audit report on risk management process effectiveness

An internal audit report evaluates process effectiveness but is not the governing body's approval of risk appetite. Audit reports are assurance products issued by the audit function, not governance decisions. The auditor requesting evidence would not accept an audit report as proof of governing body approval. The scenario calls for a record of review and approval by the governing body itself.

Trap 3: The chief information security officer's annual attestation of the…

A CISO attestation speaks to the security program's status but does not show that the governing body reviewed and approved risk appetite and tolerance levels. Attestations are typically management assertions, not governance approvals. The auditor's request is specifically about governing body approval, so a management attestation does not satisfy the evidence requirement even if it references risk management activities.

A
The enterprise risk register showing current risk scores against appetite thresholds
Why it fails: The risk register shows how risks compare to thresholds, but it does not prove that the governing body reviewed and approved the appetite and tolerance levels. Registers are operational tools updated by risk owners. While useful for monitoring, they are not governance approval records. The scenario requires evidence of governing body approval within the last twelve months, which the register alone cannot provide.
B
The internal audit report on risk management process effectiveness
Why it fails: An internal audit report evaluates process effectiveness but is not the governing body's approval of risk appetite. Audit reports are assurance products issued by the audit function, not governance decisions. The auditor requesting evidence would not accept an audit report as proof of governing body approval. The scenario calls for a record of review and approval by the governing body itself.
C
The risk committee's meeting minutes record approval of the risk appetite statement
Meeting minutes are the formal record that a governing body reviewed and approved the risk appetite and tolerance levels. They provide dated, auditable evidence of governance oversight. The scenario specifically asks for evidence that the governing body approved the appetite within the last twelve months, which the minutes directly demonstrate. This is the standard artifact auditors expect for governance approval.
D
The chief information security officer's annual attestation of the security program
Why it fails: A CISO attestation speaks to the security program's status but does not show that the governing body reviewed and approved risk appetite and tolerance levels. Attestations are typically management assertions, not governance approvals. The auditor's request is specifically about governing body approval, so a management attestation does not satisfy the evidence requirement even if it references risk management activities.

Question 2hardmulti select

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Trap 1: Providing the system administrator with a larger office.

A larger office is a facilities or ergonomic change that mitigates no identified security risk, so it cannot compensate for an unimplemented control. It is tempting because improving an administrator's working environment sounds like a personnel safeguard, and would be correct if the missing control concerned workplace conditions affecting secure operations.

Trap 2: Installing a new air conditioning unit in the server room.

Air conditioning addresses availability and environmental control, not substitution for a failed security control, so it is an operational safeguard rather than a compensating control. It is tempting because physical cooling genuinely mitigates overheating risk, and would be correct when the unavailable control concerns server room temperature or hardware protection.

A
Segmenting the system into a separate, isolated network zone.
Network segmentation isolates the affected system into a separate zone, restricting lateral movement and exposure. This compensates where a required control cannot be implemented exactly, reducing risk through containment rather than the original control mechanism.
B
Providing the system administrator with a larger office.
Why it fails: A larger office is a facilities or ergonomic change that mitigates no identified security risk, so it cannot compensate for an unimplemented control. It is tempting because improving an administrator's working environment sounds like a personnel safeguard, and would be correct if the missing control concerned workplace conditions affecting secure operations.
C
Implementing enhanced logging and monitoring of the affected component.
Enhanced logging and monitoring compensates by increasing detection and audit visibility over the affected component, offsetting residual risk when the required control cannot be implemented exactly. It provides compensating oversight rather than preventing the underlying weakness directly.
D
Installing a new air conditioning unit in the server room.
Why it fails: Air conditioning addresses availability and environmental control, not substitution for a failed security control, so it is an operational safeguard rather than a compensating control. It is tempting because physical cooling genuinely mitigates overheating risk, and would be correct when the unavailable control concerns server room temperature or hardware protection.
E
Requiring multi-factor authentication for all administrative access.
Requiring multi-factor authentication for administrative access compensates for weak or absent privileged-account controls by adding a second verification factor, so a stolen password alone cannot grant admin rights. It satisfies the stem's constraint that the original control cannot be implemented exactly as required, substituting layered authentication for the missing safeguard.

Question 3mediummultiple choice

A financial services firm is embedding risk management into its GRC program. The CISO wants a technique that expresses risk in monetary terms so that the board can compare a database breach scenario against the cost of additional controls. Which approach should the GRC practitioner recommend?

Trap 1: A control self-assessment questionnaire distributed to business…

Self-assessments gather opinions about control design and operation. They produce attestations and gap lists, not dollar values. While useful for identifying weaknesses, they cannot express the breach scenario or the control cost in financial terms, so they fail the board's comparison requirement.

Trap 2: A risk heat map plotting likelihood against impact using…

Heat maps communicate relative priority visually and are excellent for triage, but their axes are ordinal. A red cell does not tell the board whether mitigating the risk saves two million or twenty million dollars. Monetary comparison requires a quantitative method, which a heat map does not provide.

Trap 3: Qualitative risk scoring using a five-point likelihood and impact…

Qualitative scales rank risks relative to one another but do not produce monetary values. A board comparing a breach scenario against control costs needs a common currency, and ordinal labels such as high or medium cannot be subtracted from a budget line. This method answers which risk is worse, not how much worse in dollars.

A
A control self-assessment questionnaire distributed to business process owners
Why it fails: Self-assessments gather opinions about control design and operation. They produce attestations and gap lists, not dollar values. While useful for identifying weaknesses, they cannot express the breach scenario or the control cost in financial terms, so they fail the board's comparison requirement.
B
A risk heat map plotting likelihood against impact using color-coded cells
Why it fails: Heat maps communicate relative priority visually and are excellent for triage, but their axes are ordinal. A red cell does not tell the board whether mitigating the risk saves two million or twenty million dollars. Monetary comparison requires a quantitative method, which a heat map does not provide.
C
Qualitative risk scoring using a five-point likelihood and impact scale
Why it fails: Qualitative scales rank risks relative to one another but do not produce monetary values. A board comparing a breach scenario against control costs needs a common currency, and ordinal labels such as high or medium cannot be subtracted from a budget line. This method answers which risk is worse, not how much worse in dollars.
D
Quantitative risk analysis using annualized loss expectancy and single loss expectancy
Annualized loss expectancy multiplies single loss expectancy by the annualized rate of occurrence, yielding a dollar figure per year. That figure can be directly compared with the annual cost of a proposed control, enabling a return-on-security-investment comparison. This is precisely the monetary framing the board requested.

Question 4mediummultiple choice

A healthcare organization must protect electronic protected health information (ePHI) in a new cloud-based patient portal. The security team decides to implement a control that renders data unreadable to unauthorized parties even if the storage media is compromised. Which of the following best describes this type of control?

Trap 1: Network segmentation isolating the patient portal from the…

Network segmentation reduces the attack surface and limits lateral movement but does not protect data confidentiality if the storage media itself is accessed. It is a preventive control for network threats, not a data-at-rest protection mechanism. Thus, it does not satisfy the scenario's need.

Trap 2: Security awareness training for all employees handling ePHI

Security awareness training is an administrative control that helps reduce human error but does not technically prevent unauthorized reading of data on compromised media. It cannot enforce confidentiality at the data layer. Therefore, it is not the appropriate control for this technical requirement.

Trap 3: Role-based access control (RBAC) limiting access to authorized…

RBAC restricts who can access data but does not render the data unreadable if the underlying storage media is compromised. An attacker with physical or logical access to the storage could bypass RBAC and read plaintext data. Therefore, RBAC alone does not meet the requirement of protecting data when media is compromised.

A
Network segmentation isolating the patient portal from the corporate network
Why it fails: Network segmentation reduces the attack surface and limits lateral movement but does not protect data confidentiality if the storage media itself is accessed. It is a preventive control for network threats, not a data-at-rest protection mechanism. Thus, it does not satisfy the scenario's need.
B
Security awareness training for all employees handling ePHI
Why it fails: Security awareness training is an administrative control that helps reduce human error but does not technically prevent unauthorized reading of data on compromised media. It cannot enforce confidentiality at the data layer. Therefore, it is not the appropriate control for this technical requirement.
C
Data encryption at rest using AES-256
Encryption at rest with AES-256 ensures that ePHI stored in the cloud remains unreadable without the decryption keys, directly addressing the risk of media compromise. It is a technical control that protects confidentiality and satisfies HIPAA encryption addressable implementation specifications. This is the most effective control for the stated scenario.
D
Role-based access control (RBAC) limiting access to authorized clinicians
Why it fails: RBAC restricts who can access data but does not render the data unreadable if the underlying storage media is compromised. An attacker with physical or logical access to the storage could bypass RBAC and read plaintext data. Therefore, RBAC alone does not meet the requirement of protecting data when media is compromised.

Question 5hardmultiple choice

A multinational corporation is deploying a new encryption solution for data at rest across its global data centers. The security team must ensure that encryption keys are managed securely and can be recovered in case of disaster. Which of the following is the most appropriate key management practice?

Trap 1: Use a single static encryption key across all data centers to…

A single static key increases risk: if compromised, all data everywhere is exposed. It also lacks rotation, violating best practices. While simple, it is insecure and does not support disaster recovery well. Therefore, it is not appropriate.

Trap 2: Store encryption keys on the same server as the encrypted data for…

Storing keys with the data defeats the purpose of encryption because if the server is compromised, both data and keys are exposed. It also complicates recovery if the server fails. This practice is insecure and not appropriate for a multinational corporation.

Trap 3: Allow each department to manage its own encryption keys…

Decentralized key management can lead to inconsistent policies, weak controls, and difficulties in recovery and auditing. It increases the risk of key loss or misuse. For a multinational corporation, a centralized approach is more secure and manageable, so this is not the best practice.

A
Use a single static encryption key across all data centers to simplify management
Why it fails: A single static key increases risk: if compromised, all data everywhere is exposed. It also lacks rotation, violating best practices. While simple, it is insecure and does not support disaster recovery well. Therefore, it is not appropriate.
B
Store encryption keys on the same server as the encrypted data for simplicity
Why it fails: Storing keys with the data defeats the purpose of encryption because if the server is compromised, both data and keys are exposed. It also complicates recovery if the server fails. This practice is insecure and not appropriate for a multinational corporation.
C
Use a centralized key management system (KMS) with automated key rotation and secure backup
A centralized KMS with automated rotation and secure backup ensures keys are managed consistently, rotated regularly, and recoverable after a disaster. It provides strong access controls and auditing. This practice meets both security and availability requirements, making it the best choice.
D
Allow each department to manage its own encryption keys independently
Why it fails: Decentralized key management can lead to inconsistent policies, weak controls, and difficulties in recovery and auditing. It increases the risk of key loss or misuse. For a multinational corporation, a centralized approach is more secure and manageable, so this is not the best practice.

Question 6mediummultiple choice

A healthcare payer's GRC team is building a new compliance program for a recently acquired subsidiary that processes protected health information. Executive leadership wants assurance that the program's scope, authority, and reporting lines are formally documented and approved before any control testing begins. Which artifact should the GRC practitioner produce FIRST to satisfy this expectation?

Trap 1: A control testing schedule covering all systems in the subsidiary

A testing schedule is an operational artifact that presupposes an approved scope, control inventory, and governance structure. Producing it before the program charter exists would create testing activity without documented authority or defined boundaries. Testing schedules are typically developed after the program's scope, risk assessment approach, and control framework have been formally approved by leadership.

Trap 2: A statement of applicability mapping HIPAA requirements to…

A statement of applicability maps requirements to controls, which is an implementation-level artifact. It assumes the program scope and governance model are already established. While useful for HIPAA alignment, it does not document program authority, executive sponsorship, or reporting relationships, which are the specific expectations stated in the scenario before control testing begins.

Trap 3: A risk register listing the subsidiary's top information security…

A risk register is valuable, but it is a risk management output that should be produced within an approved program framework. Without a charter defining who owns risk decisions, how risks are escalated, and what risk criteria apply, the register lacks governance context. The scenario specifically asks for documented scope, authority, and reporting lines before testing, which the register does not provide.

A
A control testing schedule covering all systems in the subsidiary
Why it fails: A testing schedule is an operational artifact that presupposes an approved scope, control inventory, and governance structure. Producing it before the program charter exists would create testing activity without documented authority or defined boundaries. Testing schedules are typically developed after the program's scope, risk assessment approach, and control framework have been formally approved by leadership.
B
A compliance program charter defining mandate, scope, roles, and reporting relationships
A compliance program charter is the foundational governance document that formally establishes the program's authority, scope, roles, responsibilities, and reporting lines. Because leadership wants documented and approved structure before control testing, the charter is the logical first deliverable. It provides the mandate that later artifacts such as risk assessments and control matrices depend upon for legitimacy and resource allocation.
C
A statement of applicability mapping HIPAA requirements to implemented controls
Why it fails: A statement of applicability maps requirements to controls, which is an implementation-level artifact. It assumes the program scope and governance model are already established. While useful for HIPAA alignment, it does not document program authority, executive sponsorship, or reporting relationships, which are the specific expectations stated in the scenario before control testing begins.
D
A risk register listing the subsidiary's top information security risks
Why it fails: A risk register is valuable, but it is a risk management output that should be produced within an approved program framework. Without a charter defining who owns risk decisions, how risks are escalated, and what risk criteria apply, the register lacks governance context. The scenario specifically asks for documented scope, authority, and reporting lines before testing, which the register does not provide.

Question 7easymultiple choice

You are an internal auditor tasked with assessing the effectiveness of your organization's security controls. You have full access to internal documentation and personnel. Which type of audit are you performing?

Trap 1: Third-party audit

A third-party audit is performed by an independent external auditor, such as a certification body. It provides an unbiased opinion. In this scenario, you are internal, so it is not a third-party audit. Third-party audits are typically for certifications like ISO 27001 or SOC 2.

Trap 2: Compliance audit

A compliance audit checks adherence to laws, regulations, or standards. While this could be a compliance audit, the question focuses on the type based on who performs it. The term 'compliance audit' does not specify the auditor's relationship to the organization. The correct classification based on internal performance is first-party audit.

Trap 3: Second-party audit

A second-party audit is conducted by an external party that has a vested interest in the organization, such as a customer or supplier. It is not performed by the organization itself. Since you are an internal auditor, this does not apply. Second-party audits are often used to assess suppliers or partners against contractual requirements.

A
Third-party audit
Why it fails: A third-party audit is performed by an independent external auditor, such as a certification body. It provides an unbiased opinion. In this scenario, you are internal, so it is not a third-party audit. Third-party audits are typically for certifications like ISO 27001 or SOC 2.
B
Compliance audit
Why it fails: A compliance audit checks adherence to laws, regulations, or standards. While this could be a compliance audit, the question focuses on the type based on who performs it. The term 'compliance audit' does not specify the auditor's relationship to the organization. The correct classification based on internal performance is first-party audit.
C
First-party audit
A first-party audit is an internal audit conducted by the organization itself to assess its own controls, processes, or compliance. It is used for self-assessment and improvement, without external pressure. In this scenario, you are an internal auditor with full access, so it is a first-party audit. This type of audit helps identify gaps before external audits.
D
Second-party audit
Why it fails: A second-party audit is conducted by an external party that has a vested interest in the organization, such as a customer or supplier. It is not performed by the organization itself. Since you are an internal auditor, this does not apply. Second-party audits are often used to assess suppliers or partners against contractual requirements.

Question 8mediummultiple choice

A financial services firm is implementing controls for a new mobile banking application that processes customers' personally identifiable information. The GRC analyst must select a control that provides strong confidentiality for data at rest on the mobile device and allows remote verification that the device has not been rooted or jailbroken. Which control BEST meets these requirements?

Trap 1: Transport Layer Security (TLS) pinning for all network…

TLS pinning secures data in transit, not at rest. Code obfuscation hinders reverse engineering but does not encrypt stored data or verify device integrity remotely. These controls are relevant to network security and intellectual property protection, but they do not satisfy the confidentiality of data at rest or the attestation requirement.

Trap 2: Containerization of the application with runtime application…

Containerization and RASP protect the application at runtime but do not encrypt data at rest on the device. Periodic scans detect vulnerabilities but do not provide continuous integrity attestation. These controls fail to address the need for strong confidentiality of stored PII and remote verification of device integrity, making them insufficient for the stated requirements.

Trap 3: Mandatory access control (MAC) enforced by the mobile OS and remote…

MAC and remote wipe address access control and data destruction, not data-at-rest encryption. Remote wipe is a reactive measure after loss or theft, not a preventive confidentiality control. Neither mechanism provides remote attestation of device integrity, so this option does not meet the dual requirements of the scenario.

A
Transport Layer Security (TLS) pinning for all network communications and code obfuscation of the application binary.
Why it fails: TLS pinning secures data in transit, not at rest. Code obfuscation hinders reverse engineering but does not encrypt stored data or verify device integrity remotely. These controls are relevant to network security and intellectual property protection, but they do not satisfy the confidentiality of data at rest or the attestation requirement.
B
Containerization of the application with runtime application self-protection (RASP) and periodic vulnerability scans.
Why it fails: Containerization and RASP protect the application at runtime but do not encrypt data at rest on the device. Periodic scans detect vulnerabilities but do not provide continuous integrity attestation. These controls fail to address the need for strong confidentiality of stored PII and remote verification of device integrity, making them insufficient for the stated requirements.
C
Mandatory access control (MAC) enforced by the mobile OS and remote wipe capability.
Why it fails: MAC and remote wipe address access control and data destruction, not data-at-rest encryption. Remote wipe is a reactive measure after loss or theft, not a preventive confidentiality control. Neither mechanism provides remote attestation of device integrity, so this option does not meet the dual requirements of the scenario.
D
Full-disk encryption with a key stored in the device's secure enclave and remote attestation of device integrity.
Full-disk encryption protects data at rest by encrypting the entire storage volume, and storing the key in a hardware-backed secure enclave prevents extraction. Remote attestation allows the server to verify the device's integrity state, detecting rooting or jailbreaking. This combination directly satisfies both confidentiality and integrity verification requirements for the mobile banking scenario.