CGRC Security Control Selection Quiz

1. Control selection should consider which of the following factors?

Cost-benefit analysis

Regulatory compliance requirements

Organizational risk appetite

All of the above

2. Which stakeholder group should be involved in control selection decisions?

IT department only

Risk, compliance, operations, and business leadership

External auditors only

Vendors exclusively

Submit

4. Which of the following best describes 'defense in depth' in control selection?

Using only the strongest single control

Implementing multiple layers of controls to protect assets

Reducing the number of controls

Focusing on preventive controls only

5. Control selection decisions should be documented to support which function?

Audit trails and accountability

Regulatory compliance evidence

Future control reviews and updates

All of the above

6. What is the primary challenge in selecting compensating controls?

They cost more than primary controls

They must provide equivalent protection without duplicating primary controls

They cannot be monitored

Vendors refuse to support them

Submit

8. Which process ensures selected controls remain effective over time?

Risk assessment

Control monitoring and evaluation

Vendor management

Policy documentation

9. In the CGRC framework, control selection must support which governance objective?

Maximizing profit

Achieving organizational goals while managing risk

Reducing IT costs

Compliance auditing only

10. A firewall is best classified as which type of control?

Detective

Corrective

Preventive

Monitoring

11. Which control type is designed to prevent a security incident from occurring?

Preventive

Detective

Corrective

Compensating

12. Which control type modifies or repairs damage from a security incident?

Preventive

Detective

Corrective

Directive

13. What is the relationship between control effectiveness and organizational risk tolerance?

No relationship

Controls must reduce risk to acceptable levels

Risk tolerance determines minimum control standards

Both b and c

Submit

15. Which step should occur before selecting specific security controls?

Vendor selection

Control testing

Threat and vulnerability assessment

Documentation review

16. In control selection, what does 'residual risk' represent?

Risk eliminated by controls

Risk remaining after control implementation

Risk from external threats only

Risk accepted by management

17. Detective controls are most effective when paired with which other control type?

Preventive controls

Corrective controls

Monitoring controls

Both a and b

18. Which framework provides guidance on control categories in the CGRC context?

ISO 27001

NIST Cybersecurity Framework

COBIT

All of the above

19. What is the primary purpose of compensating controls?

Eliminate all risk

Provide alternative safeguards when primary controls fail

Reduce audit scope

Lower insurance premiums

20. Control selection should be aligned with which primary organizational factor?

Budget constraints only

Risk assessment results

Vendor preferences

Industry trends

CGRC Security Control Selection Quiz

1. Control selection should consider which of the following factors?

2.

What first name or nickname would you like us to use?

2. Which stakeholder group should be involved in control selection decisions?

3. Control selection must account for the organization's ____ environment and constraints.

4. Which of the following best describes 'defense in depth' in control selection?

5. Control selection decisions should be documented to support which function?

6. What is the primary challenge in selecting compensating controls?

7. Security controls selected must align with organizational ____ and strategic objectives.

8. Which process ensures selected controls remain effective over time?

9. In the CGRC framework, control selection must support which governance objective?

10. A firewall is best classified as which type of control?

11. Which control type is designed to prevent a security incident from occurring?

12. Which control type modifies or repairs damage from a security incident?

13. What is the relationship between control effectiveness and organizational risk tolerance?

14. A control that identifies a security breach after it occurs is classified as ____.

15. Which step should occur before selecting specific security controls?

16. In control selection, what does 'residual risk' represent?

17. Detective controls are most effective when paired with which other control type?

18. Which framework provides guidance on control categories in the CGRC context?

19. What is the primary purpose of compensating controls?

20. Control selection should be aligned with which primary organizational factor?