40 questions · Governance Risk And Compliance · All types, answers revealed
When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?
Provides assurance of control effectiveness.
Why this answer
TPRM requires understanding the vendor's security posture before onboarding.
When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?
Prevents unauthorized data migration.
Why this answer
Data residency requires physical and logical controls to ensure data stays where it should.
Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?
Focuses on uniformity from the top down.
Why this answer
Centralized governance provides consistent policy enforcement, though it may be less agile than decentralized models.
A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?
Designed specifically for template validation.
Why this answer
CloudFormation Guard is an open-source tool that lets developers define policy-as-code to validate CloudFormation templates before deployment.
To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?
Intercepts requests to enforce policy.
Why this answer
Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.
An organization must maintain HIPAA compliance in a hybrid cloud. Which architecture pattern best enables strict separation of duties between the administrative team and the data encryption keys?
Provides physical control and separation of duties for keys.
Why this answer
Using an external HSM (Hardware Security Module) like AWS CloudHSM ensures that administrators of the cloud infrastructure have no access to the keys, fulfilling the separation of duties requirement.
To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?
Crucial for determining if a threat results in a loss event.
Why this answer
FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.
Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?
These set the floor for minimum acceptable risk.
Why this answer
Risk appetite must align with business goals and legal requirements to be effective.
Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?
Required to identify new threats.
Why this answer
New cloud services require updated risk assessments and governance mapping.
An organization is building a microservices architecture. To ensure compliance with GDPR, where should the data classification metadata be enforced to ensure that PII is not stored in non-compliant regions?
Tags provide metadata for policy-based resource control.
Why this answer
Enforcing classification at the infrastructure level (e.g., tags or resource policies) allows automated tools to restrict data placement.
When using Google Cloud, which service is the primary point of integration for security policies to be applied across the entire organization hierarchy?
Centralized policy management for GCP.
Why this answer
Organization Policy Service allows for hierarchical policy enforcement across projects and folders.
An architect is deploying a global application and needs to ensure that all HTTP traffic is redirected to HTTPS. Which service in AWS should be used to enforce this compliance globally?
Enforces HTTPS at the CDN edge.
Why this answer
AWS WAF (Web Application Firewall) attached to CloudFront can enforce protocols, but the most direct way to enforce HTTPS at the edge is via CloudFront Viewer Protocol Policy.
Which document is considered the authoritative 'System Security Plan' (SSP) for an information system undergoing a formal authorization process?
The formal document required for authorization.
Why this answer
The SSP is the primary document that details how security controls are met for a system.
An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?
This is the specific feature for automated key rotation.
Why this answer
Azure Key Vault managed storage account keys provide automated rotation for shared keys, aligning with security governance requirements.
Which THREE components are critical for an ISSAP architect when designing an audit trail that meets the legal requirements for non-repudiation?
Ensures accurate ordering for forensic analysis.
Why this answer
Non-repudiation requires evidence of identity and content integrity that cannot be challenged.
A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?
Designed for standardizing image creation.
Why this answer
EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.
In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?
Govern is the new core function in 2.0.
Why this answer
NIST CSF 2.0 added the 'Govern' function, which specifically includes Supply Chain Risk Management (SCRM) and governance strategy.
When implementing a Zero Trust Architecture in Google Cloud Platform (GCP), which component is the core Policy Decision Point (PDP) used to govern access to applications based on context-aware identity and device posture?
This is the engine where access levels are defined for PDP decisions.
Why this answer
Access Context Manager is the policy engine in GCP that defines the context used by the BeyondCorp architecture to make access decisions.
To ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirement for secure system component configuration, which AWS native service provides a dashboard to continuously monitor and remediate misconfigurations?
This is the primary compliance dashboard for AWS standards.
Why this answer
AWS Security Hub aggregates compliance findings and provides a PCI DSS standard view with automated remediation workflows.
Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?
The framework for IT-business alignment.
Why this answer
COBIT is specifically designed to bridge the gap between IT and business requirements in large-scale enterprises.
When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?
Necessary to locate the user's data.
Why this answer
Right to be forgotten requires finding and securely deleting data across potentially distributed systems.
Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?
The core framework document for governance.
Why this answer
COBIT 2019 Framework: Governance and Management Objectives is the primary document outlining business alignment.
Which THREE components are critical to implement an effective 'Security as Code' architecture?
Automates the feedback loop.
Why this answer
Security as Code requires automation, testing, and continuous enforcement.
In the context of the CISSP-ISSAP, which governance activity involves verifying that the architecture aligns with business requirements through regular audits?
The activity of verifying alignment.
Why this answer
Compliance Monitoring is the governance activity that ensures the implemented system remains aligned with business requirements and regulatory standards.
An ISSAP architect is designing a system that must be compliant with the General Data Protection Regulation (GDPR). Which THREE technical safeguards should be implemented to ensure data confidentiality?
Protects data during transport.
Why this answer
GDPR mandates technical and organizational measures for protection, specifically confidentiality via encryption and access control.
An organization is using Azure to host sensitive data. To prevent data exfiltration, the architect needs to restrict storage account access to only the corporate network. Which feature should be used?
Provides granular network control.
Why this answer
Virtual Network service endpoints or Azure Private Link allow for restricted network access, preventing data exfiltration to the public internet.
An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?
This explicitly prevents bucket creation in unauthorized regions.
Why this answer
Using 's3:RequestedRegion' in an SCP allows for the restriction of bucket creation to specific geographic regions, which is a common requirement for data sovereignty.
An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?
SCPs are the preventative mechanism within Control Tower to restrict actions across member accounts.
Why this answer
AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.
An organization is migrating to Azure and must align with NIST SP 800-53 controls. Which THREE actions should the architect perform within Microsoft Defender for Cloud to facilitate continuous compliance posture management?
This enables the specific control mapping and monitoring.
Why this answer
Defender for Cloud provides integrated regulatory compliance dashboards for NIST 800-53, requiring specific setup steps.
Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?
Essential for oversight and compliance.
Why this answer
Architects must ensure their CSP selection supports the organization's specific compliance and security needs.
A healthcare provider is deploying a multi-tenant application on GCP. To comply with data isolation requirements, which service should the architect use to ensure traffic between VPCs is strictly governed by network policy?
Enforces network perimeters and data isolation.
Why this answer
VPC Service Controls provides a security perimeter that prevents data exfiltration and enforces strict network boundary compliance in GCP.
What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?
Governance is the primary function.
Why this answer
The ISSC provides high-level direction, prioritizes security initiatives, and ensures alignment with business goals.
To satisfy SOC2 Type II requirements regarding access lifecycle management, which TWO configurations should an architect verify within Okta for all privileged administrative accounts?
This mitigates credential theft, a key SOC2 requirement.
Why this answer
SOC2 requires strict lifecycle management and authentication assurance for privileged accounts.
When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?
Logs compliance without blocking.
Why this answer
The 'Audit' effect is specifically designed to log events without impacting the deployment action.
An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?
Logs key usage and API activities.
Why this answer
CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.
An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?
Allows for real-time compliance polling.
Why this answer
Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.
An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?
This is the specific feature for secret detection.
Why this answer
GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.
When designing an architecture to meet NIST 800-53 controls, which AWS service should be used to enforce resource tagging for all assets to ensure proper cost and compliance tracking?
Provides rule-based enforcement for tags.
Why this answer
AWS Config is the primary tool that can enforce tagging policies and alert on or remediate non-compliant resources.
What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?
The core purpose of a gap analysis.
Why this answer
A gap analysis identifies where the current architecture deviates from the target compliance framework.
What is the primary role of a 'Compliance Liaison' in an enterprise architecture team?
The primary role is communication and alignment.
Why this answer
A liaison bridges the gap between technical teams and audit requirements, ensuring that compliance is understood and implemented.
Ready to test yourself?
Try a timed practice session using only Governance Risk And Compliance questions.