GRC Quiz: Governance Risk Compliance (SecurityX) Mastery

1. What is the primary purpose of a Risk Assessment in a governance and compliance program?

To eliminate all organizational risks

To identify, analyze, and prioritize threats and vulnerabilities

To ensure all employees pass security training

To replace security controls with risk acceptance

2. Which of the following is a key responsibility of a Chief Information Security Officer (CISO) in a governance structure?

Managing all IT infrastructure

Developing and overseeing security strategy aligned with business goals

Hiring all IT staff

Eliminating all security risks

3. What is the primary benefit of implementing a Third-Party Risk Management program?

To eliminate all vendor relationships

To identify and mitigate risks introduced through external partners

To reduce IT budgets

To ensure vendors comply with local laws only

4. Which of the following best describes 'compliance drift'?

Gradual deviation from established compliance requirements

Rapid implementation of new security controls

Employee turnover in the compliance department

Budget overruns in security spending

5. In governance, what does 'segregation of duties' accomplish?

Reduces employee morale

Prevents fraud by distributing critical functions among multiple people

Increases operational costs

Eliminates the need for access controls

6. Which standard provides guidance on information security management systems (ISMS)?

ISO/IEC 27001

NIST SP 800-53

PCI-DSS v3.2.1

COBIT 2019

7. What is the purpose of a Security Control in a governance framework?

To prevent all security breaches

To implement measures that mitigate identified risks

To replace the need for incident response

To ensure compliance with only internal policies

8. Which of the following is NOT typically part of a Risk Assessment process?

Threat identification

Vulnerability analysis

Employee salary benchmarking

Impact evaluation

9. In compliance audits, what does 'attestation' mean?

A formal confirmation that controls are operating effectively

Employee attendance at training sessions

Documentation of security incidents

Annual budget review

10. What is the primary goal of a Business Continuity Plan (BCP)?

To reduce IT department costs

To ensure critical business functions continue during disruptions

To replace all legacy systems

To eliminate the need for disaster recovery

11. Which of the following best describes 'due diligence' in a compliance context?

Performing reasonable and prudent efforts to meet compliance requirements

Documenting all security incidents

Conducting employee background checks

Implementing the most expensive security solutions

12. In risk management, what is the difference between 'risk mitigation' and 'risk acceptance'?

Mitigation reduces risk; acceptance acknowledges residual risk

Acceptance is more cost-effective than mitigation

Mitigation eliminates risk entirely; acceptance allows some risk

They are interchangeable terms

13. Which compliance standard is specifically designed for payment card industry data security?

ISO/IEC 27001

PCI-DSS

NIST SP 800-53

SOX

14. Which of the following is a key component of an Information Security Governance program?

Policy framework and control implementation

Employee salary reviews

Hardware procurement schedules

Network bandwidth allocation

15. In the context of governance, what does 'accountability' refer to?

The ability to track user actions in logs

Responsibility for decisions and their outcomes

Compliance with all industry standards

Delegation of authority to lower-level managers

16. Which governance framework is specifically designed for IT service management and aligns IT with business objectives?

ITIL

COBIT

ISO/IEC 27001

NIST CSF

17. What does the acronym 'RACI' stand for in governance and project management contexts?

Risk Assessment and Compliance Initiative

Responsible, Accountable, Consulted, Informed

Regulatory Audit Compliance Inspection

Risk Analysis, Compliance Integration

18. Which regulatory standard specifically addresses data protection and privacy for EU residents?

HIPAA

GDPR

PCI-DSS

SOC 2 Type II

19. In the context of Governance Risk Compliance (SecurityX), which document typically defines the organization's security direction and commitment?

Security Policy

Incident Response Plan

Risk Register

Audit Report

20. Which framework provides a comprehensive approach to enterprise risk management and is widely adopted by organizations seeking to align risk strategy with business objectives?

COSO Enterprise Risk Management Framework

ISO/IEC 27001

NIST Cybersecurity Framework

CobiT 5

GRC Quiz: Can You Master Governance & Compliance?

1. What is the primary purpose of a Risk Assessment in a governance and compliance program?

2.

What first name or nickname would you like us to use?

2. Which of the following is a key responsibility of a Chief Information Security Officer (CISO) in a governance structure?

3. What is the primary benefit of implementing a Third-Party Risk Management program?

4. Which of the following best describes 'compliance drift'?

5. In governance, what does 'segregation of duties' accomplish?

6. Which standard provides guidance on information security management systems (ISMS)?

7. What is the purpose of a Security Control in a governance framework?

8. Which of the following is NOT typically part of a Risk Assessment process?

9. In compliance audits, what does 'attestation' mean?

10. What is the primary goal of a Business Continuity Plan (BCP)?

11. Which of the following best describes 'due diligence' in a compliance context?

12. In risk management, what is the difference between 'risk mitigation' and 'risk acceptance'?

13. Which compliance standard is specifically designed for payment card industry data security?

14. Which of the following is a key component of an Information Security Governance program?

15. In the context of governance, what does 'accountability' refer to?

16. Which governance framework is specifically designed for IT service management and aligns IT with business objectives?

17. What does the acronym 'RACI' stand for in governance and project management contexts?

18. Which regulatory standard specifically addresses data protection and privacy for EU residents?

19. In the context of Governance Risk Compliance (SecurityX), which document typically defines the organization's security direction and commitment?

20. Which framework provides a comprehensive approach to enterprise risk management and is widely adopted by organizations seeking to align risk strategy with business objectives?