SY0-601 Governance, Risk & Compliance 3

Question 1

Which international standard specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS)?

Accepted Answer

ISO/IEC 27001

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

SOC 2

Question 2

A company runs criminal background checks on all job applicants who will handle sensitive financial data before making a hiring decision. What type of security control is this?

Accepted Answer

Preventive control

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 3

What is the primary distinction between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP addresses continuing all critical business operations; DRP focuses on restoring IT systems and data

Answer

BCP applies only to cyberattacks; DRP applies to natural disasters

Answer

BCP focuses solely on IT systems; DRP covers all business processes

Answer

BCP is tested monthly; DRP is tested annually

Question 4

An organization requires all employees to take a consecutive two-week vacation and prohibits remote access to systems during that time. Which security principle does this policy support?

Accepted Answer

Mandatory vacation

Answer

Separation of duties

Answer

Job rotation

Answer

Least privilege

Question 5

A penetration tester signs a legal agreement promising not to disclose the findings, network diagrams, or vulnerabilities discovered during an engagement to unauthorized parties. What document is this?

Accepted Answer

Non-Disclosure Agreement (NDA)

Answer

Service Level Agreement (SLA)

Answer

Memorandum of Understanding (MOU)

Answer

Business Associate Agreement (BAA)

Question 6

A multinational company is legally required to store all European customers' data on servers physically located within the European Union. This requirement reflects which concept?

Accepted Answer

Data sovereignty

Answer

Data classification

Answer

Data masking

Answer

Data minimization

Question 7

A risk manager assigns risk levels using descriptive ratings such as 'Low,' 'Medium,' and 'High' rather than calculating specific dollar amounts. Which type of risk analysis is being performed?

Accepted Answer

Qualitative risk analysis

Answer

Quantitative risk analysis

Answer

Residual risk analysis

Answer

Inherent risk analysis