GRC IT Governance and Cybersecurity 3

Question 1

A CISO presents a risk appetite statement to the board. What does this statement primarily define?

Accepted Answer

The level of risk the organization is willing to accept in pursuit of its objectives

Answer

Risk appetite defines the amount and type of risk an organization is willing to accept while pursuing its strategic goals.

Question 2

Which cybersecurity governance model separates ownership of data from custody and use, assigning accountability to a named individual for each data set?

Accepted Answer

Data stewardship model

Answer

Data stewardship assigns named data owners accountable for data classification, protection, and lifecycle management across the organization.

Question 3

Which ISO standard provides guidance specifically on information security governance for boards and senior executives?

Accepted Answer

ISO/IEC 27014

Answer

ISO/IEC 27014 provides guidance on concepts and principles for the governance of information security at the organizational level.

Question 4

An organization uses a RACI matrix for its cybersecurity program. What does the 'A' in RACI represent?

Accepted Answer

Accountable — the person who owns the outcome and signs off

Answer

In a RACI matrix, 'Accountable' designates the single person who is ultimately answerable for the correct completion of a task or decision.

Question 5

When implementing IT governance controls, what is the primary purpose of segregation of duties (SoD)?

Accepted Answer

To prevent fraud and errors by ensuring no single person controls all aspects of a critical process

Answer

Segregation of duties prevents conflicts of interest and reduces the risk of fraud or undetected errors by requiring multiple people to complete sensitive transactions.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC IT Governance and Cybersecurity 3