01
True or false
1 point
A system meets its applicable security requirements. Does this guarantee that it has no exploitable vulnerabilities?
Free Practice Quiz Question List
7 Governance, Risk, and Compliance Online Quiz Questions
Use this free practice quiz with 20 questions to review 7 Governance, Risk, and Compliance, test your knowledge, and prepare for your next test or exam.
20 questions
02
Fill in the blank
1 point
The risk associated with a service before relevant controls are considered is its .
03
Fill in the blank
1 point
A document that provides the steps for requesting, approving, and removing an account is a .
04
Choose one
1 point
A service cannot be secured to an acceptable level, so an organization decides to discontinue it. Which risk response is this?
- A
Mitigate the activity by adding controls
- B
Avoid the activity by discontinuing the service
- C
Transfer the risk through an insurance policy
- D
Accept the risk and continue without further treatment
05
Written response
1 point
Which aspect of a supplier’s security report must cover the service your organization plans to use for the report to provide assurance about that service?
06
Written response
1 point
A high-impact risk remains after controls are installed. Who should formally decide whether the organization may retain it?
07
True or false
1 point
An organization buys insurance to shift some financial consequences of a cyber incident. This necessarily removes the organization's responsibility and all remaining risk.
- A
True
- B
False
08
Choose all
1 point
A team is assessing the risk of a new system. Select all factors that belong in its consideration of the risk.
- A
Relevant threats
- B
Vulnerabilities or predisposing conditions
- C
Likelihood
- D
Potential impact
- E
The organization's preferred software brand
09
Choose all
1 point
When setting contractual requirements for a supplier with access to sensitive data, which provisions can help clarify security responsibilities? Select all that apply.
- A
Permitted use of the organization's data
- B
Incident notification and cooperation with investigations
- C
Controls for the supplier's subcontractors
- D
Data return or secure deletion at the end of the relationship
- E
A guarantee that the customer will have no legal or reputational exposure
10
Choose one
1 point
A senior leader delegates a security task to a team. Which governance principle should still apply?
- A
Delegating a task automatically transfers all accountability to the person doing it
- B
Tasks may be delegated, but accountability should remain clear
- C
Only users are accountable for cybersecurity decisions
- D
System owners should make decisions for every resource in the organization
11
Open ended
1 point
An audit identifies a significant control weakness that remains unresolved. Describe how the organization should manage the finding and the possibility that it remains open.
12
Choose one
1 point
Which description best defines an audit?
- A
A tool that automatically searches systems for known weaknesses
- B
A systematic, documented examination of evidence against defined criteria
- C
A test that attempts to exploit a technical weakness
- D
A contract that allocates financial consequences between organizations
13
Choose one
1 point
An organization’s policy requires protection of administrative accounts. A separate document mandates multifactor authentication for those accounts. What type of document is the separate document?
- A
A guideline
- B
A standard
- C
A procedure
- D
A policy
14
Choose one
1 point
A service cannot be secured to a level the organization considers acceptable. The organization decides to discontinue it. Which risk response is this?
- A
Accept the risk and document it
- B
Transfer the risk by purchasing insurance
- C
Avoid the risk by discontinuing the service
- D
Mitigate the risk by adding controls
15
True or false
1 point
True or false: A low/medium/high risk matrix provides a precise measurement of the amount of loss an organization can expect.
- A
True
- B
False
16
Written response
1 point
Before a company considers any safeguards, it assesses the risk associated with a threat exploiting a weakness. What is the term for this risk before controls are considered?
17
Choose one
1 point
An organization has adopted a security control framework and wants to determine whether it complies with all requirements that apply to its operations. What should it do?
- A
Identify the obligations that apply to its activities, systems, locations, and data, then assess whether they are met
- B
Treat framework adoption as proof that every legal and contractual obligation is satisfied
- C
Assume that meeting internal policy requirements proves compliance with all external requirements
- D
Rely on a successful technical scan as evidence of compliance with every applicable obligation
18
Choose one
1 point
An organization needs a documented evaluation of whether controls are designed appropriately, implemented, and operating as expected against defined criteria. Which activity best fits this need?
- A
A vulnerability scan, because it identifies weaknesses in technical systems
- B
An audit, because it examines documented evidence against defined criteria
- C
A penetration test, because it attempts to exploit technical weaknesses
- D
A risk acceptance, because it records a decision to retain risk
19
Choose one
1 point
A supplier provides a recent security report, but the report excludes the specific service the organization plans to use. What is the best next step?
- A
Treat the report as sufficient because it is recent
- B
Use the report as assurance for every service from that supplier
- C
Seek evidence that covers the planned service and assess its relevance
- D
Ignore the report date and scope because the supplier provided it
20
Written response
1 point
A high-impact risk remains after controls are installed. Which authorized role should formally decide whether the organization may retain it?