How should I use these Governance Risk And Compliance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Governance Risk And Compliance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Governance Risk And Compliance domain.

ISC · topic practice

Governance Risk And Compliance practice questions

Practise (ISC)2 Information Systems Security Architecture Professional (CISSP-ISSAP, Aug 2025 blueprint) (ISC) Governance Risk And Compliance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Governance Risk And Compliance

Practice 10 questions Browse domain →

What the exam tests

What to know about Governance Risk And Compliance

Governance Risk And Compliance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Governance Risk And Compliance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Governance Risk And Compliance questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Governance Risk And Compliance explanation →

A firm is using Terraform for Infrastructure as Code (IaC) governance. The architect wants to prevent the deployment of insecure security groups. Which tool should be integrated into the CI/CD pipeline to perform static analysis against defined security policies?

Trap 1: Azure Policy for Kubernetes

This is platform-specific and not for IaC scanning.

Trap 2: AWS CloudFormation Guard

This is for CloudFormation, not Terraform.

Trap 3: SonarQube

SonarQube is for application code quality, not IaC security.

Study all Governance Risk And Compliance common traps →

A
Azure Policy for Kubernetes
Why wrong: This is platform-specific and not for IaC scanning.
B
AWS CloudFormation Guard
Why wrong: This is for CloudFormation, not Terraform.
C
SonarQube
Why wrong: SonarQube is for application code quality, not IaC security.
D
Terraform Cloud Sentinel
Sentinel is the Policy-as-Code framework for Terraform.

Governance Risk And Compliance practice questions

What to know about Governance Risk And Compliance

Common Governance Risk And Compliance exam traps

Governance Risk And Compliance questions

A firm is using Terraform for Infrastructure as Code (IaC) governance. The architect wants to prevent the deployment of insecure security groups. Which tool should be integrated into the CI/CD pipeline to perform static analysis against defined security policies?

When applying the SABSA (Sherwood Applied Business Security Architecture) framework to a new project, at which stage of the lifecycle is the 'Concept' of the architecture first aligned with business requirements?

To satisfy SOC2 Type II requirements regarding access lifecycle management, which TWO configurations should an architect verify within Okta for all privileged administrative accounts?

An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?

When implementing a Zero Trust Architecture in Google Cloud Platform (GCP), which component is the core Policy Decision Point (PDP) used to govern access to applications based on context-aware identity and device posture?

An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?

Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?

An organization is migrating to Azure and must align with NIST SP 800-53 controls. Which THREE actions should the architect perform within Microsoft Defender for Cloud to facilitate continuous compliance posture management?

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

To ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirement for secure system component configuration, which AWS native service provides a dashboard to continuously monitor and remediate misconfigurations?

An organization must maintain HIPAA compliance in a hybrid cloud. Which architecture pattern best enables strict separation of duties between the administrative team and the data encryption keys?

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?

A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?

Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?

Which THREE components are critical for an ISSAP architect when designing an audit trail that meets the legal requirements for non-repudiation?

A healthcare provider is deploying a multi-tenant application on GCP. To comply with data isolation requirements, which service should the architect use to ensure traffic between VPCs is strictly governed by network policy?

Track your progress over time

Start a Governance Risk And Compliance only practice session

Related ISC topic practice pages

Infrastructure And System Security practice questions

Security Architecture Modeling practice questions

Governance Risk And Compliance practice questions

Identity And Access Management Architecture practice questions

ISC fundamentals practice questions

ISC scenario practice questions

ISC troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid