GRC IT Governance and Cybersecurity 5

Question 1

A company undergoes a SOC 2 Type II audit. What distinguishes Type II from Type I?

Accepted Answer

Type II tests control effectiveness over a period of time; Type I only tests design at a point in time

Answer

SOC 2 Type II evaluates whether controls operated effectively over an audit period (typically 6–12 months), while Type I only assesses control design at a single point in time.

Question 2

Which cybersecurity governance principle requires that individuals only access information necessary to perform their job functions?

Accepted Answer

Need to know

Answer

The need-to-know principle limits access to information strictly required for an individual's specific job role, minimizing exposure of sensitive data.

Question 3

An organization's cybersecurity governance program includes a risk register. What is the primary purpose of maintaining this document?

Accepted Answer

To track identified risks, their likelihood, impact, and treatment status over time

Answer

A risk register is a central repository that captures identified risks along with their assessment, ownership, and treatment plans for ongoing governance oversight.

Question 4

Under HIPAA, which governance role is responsible for overseeing the organization's compliance with privacy regulations?

Accepted Answer

Privacy Officer

Answer

HIPAA requires covered entities to designate a Privacy Officer responsible for developing and implementing privacy policies and procedures.

Question 5

Which cybersecurity governance activity involves simulating a breach scenario to test whether incident response procedures are effective?

Accepted Answer

Tabletop exercise

Answer

A tabletop exercise is a discussion-based simulation where stakeholders walk through a hypothetical incident scenario to evaluate their response procedures.

(GRC) Governance, Risk, and Compliance Certification Practice Test

(GRC) Governance, Risk, and Compliance Certification Practice Test

GRC IT Governance and Cybersecurity 5