ISC2 CC Security Principles Practice Question
A mid-sized accounting firm is drafting its first information security policy. The partners want the policy to address governance responsibilities clearly so that security decisions are made consistently at the right levels. Which TWO of the following are governance responsibilities that the policy should assign? (Choose two.)
⚠ Common exam trap
The trap here is equating governance with any security-related activity, when governance specifically concerns decision rights, accountability, and strategic oversight.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defining the organization's risk appetite and approving the overall security strategy
Governance is about direction, accountability, and oversight rather than hands-on control operation. Senior leadership defines risk appetite and approves strategy, while specific roles are made accountable for security outcomes and monitored through reporting. Firewall tuning, vulnerability scanning, and password resets are operational activities that implement governance decisions but do not themselves constitute governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Defining the organization's risk appetite and approving the overall security strategy
Why this is correct
Senior leadership and the board own risk appetite and strategic direction because they are accountable to stakeholders and can commit resources across the organization. A security policy that assigns this responsibility at the executive or board level ensures security decisions align with business objectives and regulatory obligations. This is a core governance function rather than a day-to-day operational task.
- ✗
Performing vulnerability scans against internal servers each week
Why it's wrong here
Weekly vulnerability scanning is a tactical control executed by the security operations team. It produces findings that feed risk management, but scanning itself does not establish governance. Governance focuses on who decides, who is accountable, and how performance is overseen, not on the routine technical tasks used to carry out those decisions.
- ✗
Resetting user passwords when employees call the service desk
Why it's wrong here
Password resets are routine identity management operations handled by the service desk under established procedures. They are necessary for daily business but are not governance responsibilities. Treating password resets as governance would blur the line between executing controls and setting the organization's security direction and accountability structure.
- ✗
Configuring firewall rules and tuning intrusion detection signatures daily
Why it's wrong here
Firewall configuration and IDS tuning are operational security tasks performed by administrators or analysts. They implement controls but do not set direction, allocate accountability, or define risk tolerance. A governance policy may reference that these activities occur, but assigning them as governance responsibilities would confuse strategic oversight with hands-on technical execution.
- ✓
Assigning accountability for security outcomes to specific roles and ensuring oversight
Why this is correct
Governance requires clear ownership: someone must be answerable for security performance, policy compliance, and risk treatment. Assigning accountability to named roles, such as a CISO or security steering committee, and establishing oversight through reporting and review are governance activities. Without this, policies exist on paper but no one is responsible for enforcing or measuring them.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
Confidentiality Integrity and Availability
The CIA Triad is a foundational security model that ensures data is kept secret, unaltered, and accessible when needed.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.