Security+ Governance Quiz: Risk & Compliance Mastery

1. Which document outlines acceptable employee behavior regarding information security?

Acceptable Use Policy (AUP)

Security Control Policy

Incident Response Plan

Business Continuity Plan

2. The responsibility for implementing security governance ultimately rests with:

Senior leadership and the board of directors

The IT department exclusively

Individual security employees

External auditors

3. A business continuity plan differs from a disaster recovery plan in that it addresses:

Overall business operations and resumption

Only IT system restoration

Network connectivity only

Employee payroll systems

4. The frequency of security training for employees should be determined by:

Risk assessment and compliance requirements

Employee preference

Budget availability

Random scheduling

5. Which international standard specifies requirements for information security management systems?

ISO/IEC 27001

ISO 9001

ISO 14001

ISO 45001

6. A security control that prevents unauthorized access before an incident occurs is classified as:

Preventive

Detective

Corrective

Compensating

7. The process of identifying what data an organization holds is called:

Data discovery

Data validation

Data encryption

Data archival

8. Which framework is most commonly used for IT governance and control objectives?

COBIT

ITIL

PRINCE2

Agile

9. The practice of documenting security incidents and their resolution is part of:

Incident management

Asset inventory

Network segmentation

Firewall configuration

10. Data classification typically includes which of the following levels?

Public, Internal, Confidential, Restricted

Low, Medium, High, Critical

Open, Limited, Secure, Classified

Basic, Standard, Premium, Enterprise

11. Which framework provides a structured approach to identifying, analyzing, and mitigating organizational risks?

NIST Risk Management Framework (RMF)

ISO 9001 Quality Management

COBIT IT Governance

ITIL Service Management

12. The principle of least privilege ensures that users have:

Only the minimum access required for their job

Full administrative access

No restrictions on system resources

Access to all company data

13. An organization's security posture is continuously monitored through which process?

Compliance auditing

Vulnerability management

Risk assessment

All of the above

14. PCI DSS compliance is mandatory for organizations that handle which type of data?

Payment card information

Medical records

Educational transcripts

Employee contact information

15. Which role is typically responsible for establishing security governance policies?

Chief Information Security Officer (CISO)

Network administrator

Help desk technician

Junior security analyst

16. The process of systematically examining security controls to ensure they are effective is called:

Security assessment

Vulnerability scanning

Threat modeling

Penetration testing

17. Which compliance standard is specifically designed for healthcare data protection?

HIPAA

PCI DSS

SOC 2

NIST SP 800-53

18. Risk appetite is best defined as:

The amount of risk an organization is willing to accept

The total number of vulnerabilities in systems

The budget allocated to security

The frequency of security audits

19. Which of the following is a key component of the NIST Cybersecurity Framework?

Identify, Protect, Detect, Respond, Recover

Plan, Do, Check, Act

Assess, Report, Audit, Review

Define, Implement, Monitor, Adjust

20. What is the primary purpose of a security governance program?

To eliminate all security risks completely

To align security strategy with business objectives

To replace technical controls with policies

To reduce IT department budget

Security+ Governance Quiz: Can You Master Risk & Compliance?