Governance & Compliance Practice Questions

Answers and explanations appear when you work through the set above.

1. Which governance artifact normally states management's security intent and is supported by more detailed standards, procedures, and baselines?

   • A configuration baseline
   • An information security policy
   • A step-by-step operating procedure
   • A vulnerability scan report

2. A security manager reviews whether the organization has maintained an approved patch process, documented risk decisions, and periodically tested safeguards. What does this activity MOST directly demonstrate?

   • Due care only, because it concerns protection of assets
   • Due diligence only, because it concerns investigation
   • Both due care and due diligence
   • Neither, because only an auditor can establish either concept

3. Under the GDPR terminology, a retailer decides why customer data is collected and how it will be used, while a cloud service stores and processes that data only on the retailer's instructions. Which classification is correct?

   • The retailer is the processor and the cloud service is the controller
   • The retailer is the data subject and the cloud service is the controller
   • Both organizations are data subjects
   • The retailer is the controller and the cloud service is the processor

4. A hospital plans to use an external service to host electronic protected health information. What should the security manager ensure FIRST?

   • A written business associate agreement specifying permitted uses and required safeguards
   • The vendor obtains a PCI DSS certificate before receiving any records
   • The hospital removes all administrative safeguards because hosting is outsourced
   • The vendor is treated as a workforce member rather than a business associate

5. A merchant is determining which systems belong in its PCI DSS assessment. Which factor is MOST important?

   • Whether the systems run a current version of the operating system
   • Whether it handles cardholder data or can affect its security
   • Whether the system is located in the same building as the finance department
   • Whether the system is owned by the merchant instead of a service provider

6. Which pairing is accurate for the primary focus of the listed U.S. requirements?

   • GLBA: financial institution safeguards; SOX: controls over financial reporting
   • GLBA: privacy of patient medical records; SOX: encryption of payment card transactions at merchants
   • GLBA: patent ownership; SOX: consumer marketing consent
   • GLBA: public company accounting; SOX: insurance portability

7. A company wants to prevent an employee from reusing a competitor's protected product design in a new project. Which intellectual property category is MOST likely relevant to the design itself?

   • A service mark
   • Trade secret
   • A copyright in a payroll record
   • A domain name registration

8. An ISC2-certified professional discovers that a client wants to hide a material security weakness from a customer. What is the BEST response under the ISC2 Code of Ethics?

   • Comply because the paying client always controls disclosure
   • Publish the client's confidential records and technical evidence before consulting the agreed escalation process
   • Refuse misrepresentation and escalate through professional and organizational channels
   • Ignore the issue unless a breach has already occurred

9. A security team is deploying servers for a regulated application. Which control document should define the minimum approved settings, such as logging, password configuration, and enabled services, for consistent implementation?

   • A corporate mission statement approved by the board
   • A legal hold notice
   • A data subject access request
   • A security configuration baseline