Governance Risk And Compliance

When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?

A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

When using Google Cloud, which service is the primary point of integration for security policies to be applied across the entire organization hierarchy?

An architect is deploying a global application and needs to ensure that all HTTP traffic is redirected to HTTPS. Which service in AWS should be used to enforce this compliance globally?

Which document is considered the authoritative 'System Security Plan' (SSP) for an information system undergoing a formal authorization process?

An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?

Which THREE components are critical for an ISSAP architect when designing an audit trail that meets the legal requirements for non-repudiation?

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?

Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?

An ISSAP architect is designing a system that must be compliant with the General Data Protection Regulation (GDPR). Which THREE technical safeguards should be implemented to ensure data confidentiality?

An organization is using Azure to host sensitive data. To prevent data exfiltration, the architect needs to restrict storage account access to only the corporate network. Which feature should be used?

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

When designing an architecture to meet NIST 800-53 controls, which AWS service should be used to enforce resource tagging for all assets to ensure proper cost and compliance tracking?

What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?

What is the primary role of a 'Compliance Liaison' in an enterprise architecture team?