CGRC Security Control Implementation Quiz

1. In control implementation, what does 'control scope' define?

The budget allocated to controls

The systems, processes, and assets covered by a control

The frequency of control testing

The approval authority for controls

2. Which factor is critical when evaluating the feasibility of implementing a security control?

Whether the control is mentioned in industry standards

The organization's resources, culture, and technical capabilities

The number of users affected

The control's vendor reputation

3. In control implementation, what does 'control baseline' establish?

The minimum set of controls required for an organization or system

The maximum number of controls allowed

The cost of implementing controls

The schedule for control testing

4. What is the primary benefit of implementing layered controls in security architecture?

It increases operational complexity

It provides defense-in-depth to mitigate multiple attack vectors

It eliminates the need for risk assessment

It reduces the need for monitoring

5. Which approach ensures controls remain effective over time in a dynamic environment?

Implementing controls once and monitoring for changes

Continuous monitoring and periodic reassessment

Replacing controls annually

Documenting controls only at implementation

6. In security governance, what does control evidence documentation serve?

To prove controls operate effectively and meet compliance requirements

To reduce audit costs

To eliminate the need for testing

To authorize control changes

7. What is the relationship between risk assessment and control selection?

Risk assessment identifies gaps; controls address those gaps

Risk assessment and control selection are independent

Control selection determines risk levels

Risk assessment is only for compliance

8. Which metric is used to measure control maturity in security governance?

Control implementation percentage

Control Capability Maturity Model (CMM)

Control cost-benefit ratio

Control frequency of updates

9. What is compensating control in the context of security governance?

A control that replaces a required control when the original cannot be implemented

A control that monitors other controls

A control that reduces operational costs

A control that detects control failures

10. Which control implementation challenge arises from conflicting security and usability requirements?

Control fragmentation

Control redundancy

Control balancing

Control saturation

11. Which phase of the control lifecycle involves defining control objectives and determining required control types?

Control design and specification

Control implementation

Control monitoring

Control optimization

12. Which of the following is a characteristic of a well-designed control?

It is always automated

It has clear objectives and measurable outcomes

It requires no documentation

It eliminates all risk

13. What is the primary goal of control effectiveness assessment?

To determine if controls reduce risk to acceptable levels

To identify the most expensive controls

To replace all manual controls

To increase control complexity

14. Which control implementation activity involves assigning responsibility for control execution?

Control scoping

Control ownership assignment

Control testing

Control documentation

15. Detective controls are most effective when implemented alongside which other control type?

Preventive controls

Physical controls

Corrective controls

Compensating controls

16. What is a key difference between administrative and technical controls?

Administrative controls use policies; technical controls use technology

Technical controls are more effective

Administrative controls prevent incidents

Technical controls require less maintenance

17. Which framework provides a comprehensive structure for implementing information security controls?

NIST Cybersecurity Framework

ISO/IEC 27001

COBIT

All of the above

18. In control implementation, what does the term 'control testing' primarily validate?

Whether controls are cost-effective

Whether controls operate as designed

Whether controls are documented

Whether controls are approved by management

19. Which of the following best describes preventive controls?

Controls that detect unauthorized activities

Controls that stop unauthorized activities before they occur

Controls that restore systems after incidents

Controls that monitor compliance status

20. What is the primary purpose of a control matrix in security governance?

To map threats to vulnerabilities

To align controls with business objectives and compliance requirements

To identify all system users

To document IT asset inventory