I85PREP
⌘ K
ACIA Capstone study materials
ACIA Capstone study resources

ACIA Capstone practice questions

One question at a time. Build your ACIA Capstone understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk, and Compliance Frameworks

Which category of control is primarily intended to reduce the likelihood of a threat event occurring in the first place?

  1. Preventive control Correct answer.
  2. Corrective control
  3. Compensating control
  4. Detective control

Explanation

Controls are classified by their timing relative to an event. Preventive controls act before an event to stop or deter it, such as access restrictions or encryption, and therefore lower the likelihood of occurrence rather than the impact after the fact.

Question 2Governance, Risk, and Compliance Frameworks

An organization calculates risk as likelihood multiplied by impact and then compares the result to a defined appetite. Which risk approach does this describe?

  1. Scenario stress testing
  2. Quantitative risk analysis Correct answer.
  3. Control self-assessment
  4. Qualitative heat mapping

Explanation

Multiplying likelihood by impact to produce a numeric risk value is the defining feature of quantitative risk analysis. The resulting figure can be compared directly against a monetary or numeric risk appetite threshold.

Question 3Governance, Risk, and Compliance Frameworks

What is the primary purpose of a risk register?

  1. To document identified risks with owners and treatment status Correct answer.
  2. To list every asset and its purchase price
  3. To record accepted audit findings only
  4. To store incident response playbooks

Explanation

A risk register is the central log of identified risks, capturing attributes such as likelihood, impact, owner, treatment decision, and current status. It supports ongoing tracking and reporting of risk across the organization.

Question 4Governance, Risk, and Compliance Frameworks

Which risk treatment option involves transferring financial consequences to a third party?

  1. Risk mitigation
  2. Risk transfer Correct answer.
  3. Risk acceptance
  4. Risk avoidance

Explanation

Risk transfer shifts the financial burden of a risk to another party, most commonly through insurance or contractual indemnity. The underlying risk still exists, but the organization is insulated from part of the loss.

Question 5Governance, Risk, and Compliance Frameworks

Which document defines the organization's overall direction and commitment to information security at the highest level?

  1. Standard operating procedure
  2. Information security policy Correct answer.
  3. Incident ticket template
  4. Baseline configuration guide

Explanation

The top-level information security policy states management's intent, objectives, and mandatory principles for security. Lower-level standards, procedures, and guidelines derive from and must align with this policy.

Question 6Governance, Risk, and Compliance Frameworks

Which principle requires that a person be granted only the access necessary to perform their assigned job duties?

  1. Mandatory access control
  2. Separation of duties
  3. Least privilege Correct answer.
  4. Defense in depth

Explanation

Least privilege limits each user's access rights to the minimum needed for their tasks. This reduces the potential damage from error, misuse, or compromised accounts.

Question 7Governance, Risk, and Compliance Frameworks

What distinguishes a standard from a guideline in a typical security policy framework?

  1. Standards are mandatory requirements; guidelines are recommended practices Correct answer.
  2. Standards are technical; guidelines are always legal contracts
  3. Standards apply only to IT staff; guidelines apply to everyone
  4. Standards are optional advice; guidelines are mandatory

Explanation

Standards specify mandatory, measurable requirements that support policy, while guidelines offer recommended, non-binding advice on how to meet those requirements. This distinction drives how compliance is assessed.

Question 8Governance, Risk, and Compliance Frameworks

An auditor finds that a control is properly designed but was not performed during two months of the year. How should this be characterized?

  1. A design deficiency
  2. A compensating control success
  3. A scope limitation
  4. An operating effectiveness deficiency Correct answer.

Explanation

Design deficiencies concern whether a control, as conceived, could achieve its objective. When a well-designed control fails to operate as intended during the period, the finding is an operating effectiveness deficiency.

Question 9Governance, Risk, and Compliance Frameworks

A company adopts a framework that maps its controls to multiple regulatory requirements simultaneously. What is the main governance benefit of this approach?

  1. It guarantees full legal compliance in every jurisdiction
  2. It eliminates the need for a risk register
  3. It removes the need for independent audits
  4. It reduces duplicate testing and improves control coverage visibility Correct answer.

Explanation

Harmonizing controls against a common framework lets one control satisfy several obligations, reducing redundant testing and revealing gaps. It improves efficiency and visibility but does not by itself guarantee compliance or remove audit needs.

Question 10Governance, Risk, and Compliance Frameworks

Which activity best exemplifies a second line of defense function in the three-lines model?

  1. A risk and compliance function setting policy and monitoring Correct answer.
  2. A developer writing secure code
  3. A regulator issuing enforcement action
  4. An internal audit team providing independent assurance

Explanation

In the three-lines model, the first line owns and manages risk operationally, the second line provides oversight, policy, and monitoring, and the third line gives independent assurance. A risk and compliance function performing oversight is a classic second-line role.

Question 11Governance, Risk, and Compliance Frameworks

An organization decides to accept a risk that exceeds its stated appetite because remediation cost is prohibitive. What governance step is most appropriate?

  1. Escalate for formal approval and record the exception with rationale Correct answer.
  2. Reclassify the risk as low likelihood without evidence
  3. Delete the risk from the register to avoid reporting noise
  4. Silently document the decision in a team wiki

Explanation

Accepting risk above appetite requires formal, documented approval by an accountable authority, with the rationale and any conditions recorded. This preserves accountability and supports reporting to governance bodies.

Question 12Governance, Risk, and Compliance Frameworks

Which statement best describes the role of a risk owner?

  1. They are accountable for managing a specific risk and its treatment Correct answer.
  2. They perform technical control testing on behalf of auditors
  3. They approve the organization's overall risk appetite statement
  4. They independently verify the effectiveness of all controls

Explanation

A risk owner is accountable for a specific risk, including selecting and monitoring its treatment and reporting on its status. Accountability for a named risk is the defining characteristic of the role.

Question 13Governance, Risk, and Compliance Frameworks

A regulation requires retention of security logs for one year. Which governance artifact should translate this obligation into an enforceable internal requirement?

  1. An incident post-mortem report
  2. A logging and monitoring standard Correct answer.
  3. A security awareness newsletter
  4. A vendor marketing brochure

Explanation

Regulatory obligations are operationalized through mandatory internal standards that specify concrete requirements such as retention periods. The standard makes the external obligation enforceable and auditable within the organization.

Question 14Governance, Risk, and Compliance Frameworks

What is the primary objective of a business impact analysis within continuity planning?

  1. To calculate the annual insurance premium
  2. To rank employees by performance
  3. To identify critical processes and the consequences of their disruption Correct answer.
  4. To enumerate every software license in use

Explanation

A business impact analysis identifies critical business functions and quantifies the operational and financial consequences of their disruption over time. Its outputs inform recovery time and recovery point objectives used in continuity strategy.

Question 15Governance, Risk, and Compliance Frameworks

Which metric expresses the maximum tolerable time a business process can be unavailable before unacceptable harm occurs?

  1. Recovery point objective
  2. Recovery time objective
  3. Mean time to repair
  4. Maximum tolerable downtime Correct answer.

Explanation

Maximum tolerable downtime is the longest outage a process can sustain before consequences become unacceptable. Recovery time objective is the target set to stay within that tolerance, so the two are related but distinct.

Question 16Governance, Risk, and Compliance Frameworks

A third party will process regulated data on the organization's behalf. Which governance action should occur before onboarding?

  1. Grant the vendor administrator access to all systems
  2. Conduct due diligence and execute a contract with security obligations Correct answer.
  3. Rely solely on the vendor's self-declared reputation
  4. Waive all audit rights to speed contracting

Explanation

Third-party risk governance requires proportionate due diligence and a contract that assigns security, privacy, and breach-notification obligations. These steps establish accountability before sensitive data is shared.

Question 17Governance, Risk, and Compliance Frameworks

Which element is essential for a security exception to remain governable over time?

  1. Verbal approval from a peer
  2. Removal from the risk register upon approval
  3. A defined expiry date with periodic review Correct answer.
  4. An indefinite duration to avoid renewal effort

Explanation

Exceptions should be time-bound and reviewed before expiry so that temporary tolerance does not become permanent uncontrolled risk. A defined expiry and review cycle keep the exception visible and accountable.

Question 18Governance, Risk, and Compliance Frameworks

What is the main purpose of a control matrix in a compliance program?

  1. To schedule employee vacations
  2. To store raw packet captures
  3. To map controls to the requirements and risks they address Correct answer.
  4. To replace the need for evidence collection

Explanation

A control matrix links each control to the requirements, risks, and frameworks it satisfies, exposing gaps and duplication. It supports consistent testing and clear compliance reporting.

Question 19Governance, Risk, and Compliance Frameworks

An organization wants assurance that a control operated consistently across the whole audit period, not just on one day. Which approach provides this?

  1. A single point-in-time walkthrough
  2. Sampling tests spread across the period Correct answer.
  3. Interviewing only the control owner once
  4. Reviewing the control's design document only

Explanation

Testing a sample of instances distributed across the period provides evidence of consistent operation over time. A single walkthrough or design review shows only that the control exists or worked once.

Question 20Governance, Risk, and Compliance Frameworks

Which statement correctly distinguishes policies from procedures?

  1. Policies and procedures are interchangeable terms
  2. Policies give step-by-step instructions; procedures state principles
  3. Policies state mandatory principles and intent; procedures describe how to execute them Correct answer.
  4. Policies are optional; procedures are legally binding

Explanation

Policies articulate mandatory principles and management intent, while procedures translate those principles into detailed step-by-step instructions. Keeping them distinct prevents policy from becoming overly tactical.

Question 21Governance, Risk, and Compliance Frameworks

A risk assessment identifies a threat with very high impact but very low likelihood. Which treatment consideration is most defensible?

  1. Treat it identically to a high-likelihood, low-impact risk
  2. Remove it from the register to reduce clutter
  3. Evaluate cost-effective mitigations and contingency plans proportionate to impact Correct answer.
  4. Ignore it because likelihood is low

Explanation

Low-likelihood, high-impact risks still warrant attention because a single occurrence can be severe. Proportionate mitigation and contingency planning address the impact even when likelihood is small.

Question 22Governance, Risk, and Compliance Frameworks

An organization's residual risk remains above appetite even after planned controls. What is the most appropriate governance response?

  1. Reassess treatment options and escalate the gap to accountable leadership Correct answer.
  2. Reduce the appetite threshold to match the residual level without analysis
  3. Report the residual risk as fully mitigated
  4. Defer all reporting until the next annual cycle

Explanation

When residual risk exceeds appetite, treatment options should be revisited and the gap escalated to those accountable for accepting or funding further action. Misreporting or manipulating the threshold undermines the integrity of risk governance.

Question 23Governance, Risk, and Compliance Frameworks

Which situation most clearly indicates a segregation-of-duties conflict in a governance process?

  1. An analyst reviews a dashboard weekly
  2. The same person approves a vendor payment and reconciles the bank statement Correct answer.
  3. A manager attends a risk committee meeting
  4. A developer documents code changes in a ticket

Explanation

Segregation of duties requires that authorization and reconciliation of the same transaction be performed by different people to prevent undetected error or fraud. Combining approval and reconciliation in one person creates that conflict.

Question 24Governance, Risk, and Compliance Frameworks

A board asks how the organization knows its security program is effective rather than merely documented. Which evidence set best answers this?

  1. Independent test results, metric trends, and tracked remediation of findings Correct answer.
  2. The number of pages in the security manual
  3. The org chart of the security department
  4. A list of approved policies and their publication dates

Explanation

Effectiveness is demonstrated by evidence that controls operate as intended and that issues are remediated, such as independent testing, trended metrics, and closure tracking. Documentation alone shows intent, not performance.

Question 25Governance, Risk, and Compliance Frameworks

Two regulations impose overlapping but differently worded obligations on access review frequency. What is the soundest governance approach?

  1. Apply the least frequent requirement to minimize effort
  2. Apply each requirement separately to duplicate reviews
  3. Determine the strictest applicable requirement and document the mapping rationale Correct answer.
  4. Alternate between requirements each year

Explanation

Where obligations overlap, meeting the strictest applicable requirement satisfies all of them, provided the mapping rationale is documented. This avoids both under-compliance and wasteful duplicate effort.

Question 26Governance, Risk, and Compliance Frameworks

Which document type typically states mandatory requirements and carries an enforcement mechanism for noncompliance within an organization?

  1. A guideline
  2. A standard
  3. A policy Correct answer.
  4. A baseline

Explanation

A policy is a high-level statement of management intent that establishes mandatory requirements and normally specifies consequences for noncompliance. Standards, baselines, and guidelines elaborate on or support policy but do not by themselves carry the same authoritative mandate.

Question 27Governance, Risk, and Compliance Frameworks

An organization must comply with a new data protection law. Which sequence best reflects sound governance practice?

  1. Perform a gap assessment, assign risk owners, then track remediation to closure Correct answer.
  2. Delegate the obligation entirely to the IT department without documentation
  3. Purchase cyber insurance, then notify regulators of the compliance plan
  4. Wait for the first regulatory examination before defining controls

Explanation

Compliance obligations should be translated into requirements, compared against current controls through a gap assessment, and assigned to accountable owners with tracked remediation. This creates traceable evidence that obligations are understood, owned, and being closed out.

Question 28Governance, Risk, and Compliance Frameworks

A risk register shows a threat with high potential impact but very low likelihood. Which treatment approach is most defensible under a standard risk framework?

  1. Remove the risk from the register once a control is proposed
  2. Ignore the risk because likelihood falls below the assessment threshold
  3. Document the risk with monitoring triggers and contingency plans Correct answer.
  4. Transfer the risk by purchasing a general liability policy

Explanation

Low-likelihood, high-impact risks still warrant documented monitoring, defined escalation triggers, and contingency planning because their consequences can be severe. Removing or ignoring them destroys the audit trail and leaves the organization unprepared if conditions change.

Question 29Governance, Risk, and Compliance Frameworks

Which characteristic most distinguishes a framework from a regulation?

  1. It replaces the need for an internal control catalog
  2. It is enforceable by a government agency with penalties
  3. It applies only to publicly traded companies
  4. It provides voluntary structured guidance for organizing controls Correct answer.

Explanation

Frameworks are voluntary, structured guidance that help organizations organize and mature controls, while regulations are legally binding instruments enforced by an authority. Organizations may adopt a framework to demonstrate diligence, but adoption alone creates no legal obligation.

Question 30Governance, Risk, and Compliance Frameworks

An organization maps each internal control to several frameworks and regulations at once. A regulator later changes an obligation. What is the most efficient governance response?

  1. Suspend the mapping until the next annual framework refresh
  2. Create a separate parallel control set dedicated to that regulator
  3. Rebuild the entire control set from the newly published regulatory text
  4. Update the affected mapping entries and assess only the linked controls Correct answer.

Explanation

A cross-mapping lets the organization trace an obligation to specific controls, so a change requires updating the affected entries and reassessing only the linked controls. This preserves traceability while avoiding redundant control sets and unnecessary rework across the whole program.

Question 31Identity and Access Management

Which principle states that a user should be granted only the minimum access necessary to perform their job?

  1. Defense in depth
  2. Mandatory access control
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits each identity to exactly the permissions required for its tasks and nothing more, which shrinks the blast radius of misuse or compromise. Separation of duties instead splits sensitive tasks among multiple people, while defense in depth layers controls and mandatory access control enforces labels.

Question 32Identity and Access Management

A user changes roles and retains all permissions from the previous role while gaining the new ones. Which weakness does this describe?

  1. Role explosion
  2. Credential stuffing
  3. Session fixation
  4. Privilege creep Correct answer.

Explanation

Privilege creep occurs when accumulated entitlements from past roles are never revoked, so access grows beyond what the current job requires. Periodic access reviews and automated deprovisioning on role change are the standard mitigations for this drift.

Question 33Identity and Access Management

Which authentication factor category does a hardware token generating a time-based one-time code represent?

  1. Something you know
  2. Somewhere you are
  3. Something you are
  4. Something you have Correct answer.

Explanation

A hardware token is a physical object the user possesses, so it belongs to the something-you-have factor category. Combining it with a password satisfies multi-factor authentication because the two factors come from different categories.

Question 34Identity and Access Management

What is the primary purpose of a directory service such as LDAP in an identity architecture?

  1. To encrypt network traffic between endpoints
  2. To store and query identity attributes and group memberships Correct answer.
  3. To generate and rotate cryptographic keys
  4. To filter malicious traffic at the network edge

Explanation

A directory service provides a structured, queryable repository of identities, attributes, and group memberships that applications use for authentication and authorization decisions. It is not a transport encryptor, key manager, or perimeter filter.

Question 35Identity and Access Management

Which access control model bases decisions on the identity of the subject and the ownership of the resource, letting owners set permissions?

  1. Mandatory access control
  2. Attribute-based access control
  3. Role-based access control
  4. Discretionary access control Correct answer.

Explanation

In discretionary access control the resource owner decides who may access the object, so permissions are at the owner's discretion. Mandatory models rely on system labels, role-based models rely on job roles, and attribute-based models evaluate policies over many attributes.

Question 36Identity and Access Management

What does single sign-on primarily provide to users across multiple applications?

  1. Automatic password rotation for every connected application
  2. One authentication event granting access to multiple trusted applications Correct answer.
  3. Per-application password vaults requiring separate logins
  4. Hardware-bound authentication for each individual application

Explanation

Single sign-on lets a user authenticate once to a central identity provider and then access multiple relying applications through trust relationships. This reduces password fatigue and centralizes authentication policy, but it also concentrates risk if the central session is compromised.

Question 37Identity and Access Management

Which protocol is commonly used to federate identity by exchanging signed assertions between an identity provider and a service provider?

  1. SMTP
  2. SAML Correct answer.
  3. SNMP
  4. SFTP

Explanation

SAML is an XML-based federation standard in which an identity provider issues signed assertions that a service provider trusts to authenticate a user. The other protocols handle network management or file and mail transfer and carry no identity federation semantics.

Question 38Identity and Access Management

An application needs to call a backend API on behalf of a signed-in user without sharing the user's password. Which OAuth 2.0 concept fits this need?

  1. An access token scoped to the required API Correct answer.
  2. A shared service account password
  3. A signed SAML assertion sent to the API
  4. A long-lived browser session cookie

Explanation

OAuth 2.0 issues access tokens that grant a client limited, scoped authority to call a resource server on the user's behalf without exposing the user's credentials. The token's scope should be limited to the specific API operations required.

Question 39Identity and Access Management

In an OpenID Connect flow, which artifact proves the end user's identity to the relying party?

  1. The refresh token
  2. The authorization code
  3. The access token
  4. The ID token Correct answer.

Explanation

The ID token is a signed JWT containing claims about the authentication event and the end user, which the relying party validates to establish identity. Access tokens authorize resource access and refresh tokens obtain new tokens, but neither is designed to assert user identity.

Question 40Identity and Access Management

An organization wants to reduce standing administrative rights on servers. Which approach best applies just-in-time privilege?

  1. Share a single administrator account among the team
  2. Assign permanent administrator roles to all operations staff for convenience
  3. Grant elevated roles temporarily after approval and revoke them automatically when the window ends Correct answer.
  4. Store administrator passwords in a spreadsheet accessible to the team

Explanation

Just-in-time privilege grants elevated access only for an approved, time-bound window and then automatically removes it, minimizing standing exposure. This combines approval workflow, time limits, and automated revocation to shrink the attack surface.

Question 41Identity and Access Management

A security team wants to detect when a terminated employee's account is still being used. Which control is most directly relevant?

  1. Increasing the password complexity policy
  2. Reviewing authentication logs for the disabled or orphaned account Correct answer.
  3. Enabling captcha on the login page
  4. Shortening the session timeout for all users

Explanation

Monitoring authentication logs for activity tied to terminated identities reveals deprovisioning failures and possible misuse. Password complexity, captcha, and session timeouts harden authentication generally but do not specifically detect use of an account that should no longer exist.

Question 42Identity and Access Management

Which practice best mitigates the risk of a compromised privileged account being used to create backdoor accounts?

  1. Disabling audit logging to reduce storage costs
  2. Allowing administrators to approve their own access requests
  3. Alerting on and restricting account-creation events to an approved workflow Correct answer.
  4. Requiring longer passwords for standard users

Explanation

Restricting account creation to an approved workflow and alerting on creation events detects or blocks an attacker trying to establish persistence through new accounts. Self-approval and reduced logging both weaken the controls that would catch such abuse.

Question 43Identity and Access Management

What is the main security benefit of hashing passwords with a unique per-user salt?

  1. It encrypts the password so administrators can recover it later
  2. It makes the password impossible to guess through online brute force
  3. It prevents identical passwords from producing identical stored hashes and defeats precomputed tables Correct answer.
  4. It removes the need for a password policy

Explanation

A unique salt ensures that two users with the same password store different hash values, which blocks precomputed rainbow tables and forces attackers to attack each hash separately. Salting does not make weak passwords strong or enable recovery of the original password.

Question 44Identity and Access Management

A company wants contractors to access only the project wiki while employees access all internal systems. Which authorization approach most directly supports this?

  1. Rule-based access control keyed only to time of day
  2. Mandatory access control using classification labels
  3. Role-based access control with distinct roles per population Correct answer.
  4. Discretionary access control with per-file owner settings

Explanation

Role-based access control maps populations such as contractors and employees to roles whose permissions match their responsibilities, making the distinction explicit and auditable. Classification labels, owner discretion, and time-only rules do not cleanly express the population-based boundary described.

Question 45Identity and Access Management

Which control most directly limits the damage if a federation signing key is compromised?

  1. Removing signature validation at the service provider
  2. Short assertion validity periods combined with rapid key rotation Correct answer.
  3. Longer assertion lifetimes to reduce signing operations
  4. Using a single shared key across all service providers

Explanation

Short-lived assertions and prompt key rotation shrink the window in which a stolen signing key can be used to forge trusted assertions. Removing validation or sharing one key widely would increase rather than contain the impact.

Question 46Identity and Access Management

What does an access recertification campaign require reviewers to do?

  1. Reset every user's password at the start of the quarter
  2. Reimage all endpoints that access sensitive systems
  3. Confirm or revoke each user's existing entitlements on a scheduled basis Correct answer.
  4. Reissue all authentication tokens to every application

Explanation

Recertification, also called access review, asks managers or resource owners to attest that each entitlement is still justified and to revoke anything excessive. It targets entitlement accuracy rather than credential resets, token reissuance, or endpoint rebuilding.

Question 47Identity and Access Management

An identity provider signs assertions with a private key. What must the service provider use to validate those assertions?

  1. A symmetric session cookie
  2. The corresponding public key Correct answer.
  3. The user's password hash
  4. The identity provider's private key

Explanation

Digital signatures are verified with the public key that corresponds to the private signing key, so the service provider needs that public key or a trusted certificate containing it. The private key must never be shared, and password hashes or session cookies play no role in signature validation.

Question 48Identity and Access Management

Which risk is most specific to granting a third-party SaaS application broad OAuth scopes during consent?

  1. The user's multi-factor device is automatically enrolled
  2. The user's password is transmitted to the application
  3. The application can decrypt the identity provider's signing key
  4. The application can access more user data than its function requires Correct answer.

Explanation

Overly broad scopes let a third-party application read or act on more resources than necessary, increasing exposure if that application is breached or malicious. OAuth does not hand the application the user's password, signing keys, or control of the user's MFA device.

Question 49Identity and Access Management

A policy states that no single administrator may both create a vendor payment and approve it. Which control is being applied?

  1. Separation of duties Correct answer.
  2. Single sign-on
  3. Federated identity
  4. Least privilege

Explanation

Separation of duties splits a sensitive transaction across two identities so that fraud requires collusion, which is exactly what prohibiting one person from creating and approving a payment achieves. Least privilege limits the breadth of permissions, while single sign-on and federation concern authentication convenience and trust.

Question 50Identity and Access Management

Which attribute set is most characteristic of attribute-based access control decisions?

  1. Only the time of day of the request
  2. Only the resource owner's identity
  3. Only the subject's job title
  4. Subject, resource, action, and environment attributes evaluated against a policy Correct answer.

Explanation

Attribute-based access control evaluates a policy against multiple attributes describing the subject, the resource, the requested action, and the environment. Using only one dimension, such as job title, ownership, or time, describes simpler models rather than attribute-based decisions.