I85PREP
⌘ K
SecurityX study materials
SecurityX study resources

SecurityX practice questions

One question at a time. Build your SecurityX understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk, and Compliance

Rather than reduce the likelihood of a breach, an organization buys a cyber insurance policy that covers incident response and legal costs. Which risk treatment option does this represent?

  1. Risk transfer Correct answer.
  2. Risk mitigation
  3. Risk avoidance
  4. Risk acceptance

Explanation

Transferring risk shifts the financial consequence of an event to a third party, here the insurer, while the organization still owns the operational impact. Avoidance eliminates the activity that creates the risk, and mitigation reduces likelihood or impact through controls.

Question 2Governance, Risk, and Compliance

Which document type sets a mandatory, specific requirement, such as the approved authentication methods that must be used for remote access, and applies organization-wide?

  1. Policy
  2. Guideline
  3. Standard Correct answer.
  4. Procedure

Explanation

A standard converts policy intent into mandatory, measurable requirements that can be audited, such as required encryption strengths or authentication methods. Policies express management intent in broad terms, while guidelines are discretionary recommendations.

Question 3Governance, Risk, and Compliance

A business impact analysis concludes that an order-entry system must be operational again within four hours of an outage. Which metric captures this requirement?

  1. Recovery point objective
  2. Mean time between failures
  3. Mean time to repair
  4. Recovery time objective Correct answer.

Explanation

The recovery time objective is the maximum acceptable downtime set by the business for a process or system. The recovery point objective describes tolerable data loss measured in time, not the restoration deadline.

Question 4Governance, Risk, and Compliance

Locks, badge readers, and a mantrap at a data center entrance are best classified as which type of control?

  1. Corrective
  2. Compensating
  3. Detective
  4. Preventive Correct answer.

Explanation

Preventive controls stop an event from occurring; physical barriers block unauthorized entry before detection or response is needed. Detective controls would instead identify that an event already happened.

Question 5Governance, Risk, and Compliance

Who is accountable for deciding the classification of a data set and approving who may access it?

  1. Data processor
  2. Data owner Correct answer.
  3. Data subject
  4. Data custodian

Explanation

The data owner is a business-side role accountable for classification, access approval, and appropriate use of a data set. Custodians carry out the technical handling of that data under the owner's direction.

Question 6Governance, Risk, and Compliance

Which term describes the amount and type of risk an organization is willing to accept in pursuit of its objectives?

  1. Risk tolerance
  2. Risk appetite Correct answer.
  3. Residual risk
  4. Inherent risk

Explanation

Risk appetite expresses how much risk leadership is willing to take to achieve strategic goals and is normally approved at board level. Tolerance is the acceptable variation around that appetite for a specific process or metric.

Question 7Governance, Risk, and Compliance

A privacy principle requires that personal data be kept only as long as needed to fulfil the stated purpose and then deleted or anonymized. Which principle is this?

  1. Accuracy
  2. Storage limitation Correct answer.
  3. Purpose limitation
  4. Data minimization

Explanation

Storage limitation governs retention duration: identifiable data must not be kept longer than the purpose requires. Data minimization instead limits how much is collected.

Question 8Governance, Risk, and Compliance

Two companies are about to discuss a possible joint venture and need a legally binding commitment that neither will disclose the other's confidential information. Which agreement fits?

  1. Business partners agreement
  2. Service level agreement
  3. Non-disclosure agreement Correct answer.
  4. Memorandum of understanding

Explanation

A non-disclosure agreement creates enforceable confidentiality obligations and defines what is confidential and for how long. A memorandum of understanding records mutual intent and is generally non-binding, while SLAs define service performance.

Question 9Governance, Risk, and Compliance

An asset is valued at $200,000, a threat would destroy 25 percent of its value, and the event is expected twice per year. What is the annualized loss expectancy?

  1. $100,000 Correct answer.
  2. $400,000
  3. $50,000
  4. $25,000

Explanation

Single loss expectancy equals asset value multiplied by exposure factor, giving $50,000. Annualized loss expectancy multiplies that single loss by the annualized rate of occurrence, so $50,000 x 2 = $100,000.

Question 10Governance, Risk, and Compliance

An organization has adopted ISO/IEC 27001 and wants to know which Annex A controls it has not yet implemented and how far its current state is from the target state. Which activity produces this information?

  1. Penetration test
  2. Tabletop exercise
  3. Gap analysis Correct answer.
  4. Vulnerability scan

Explanation

A gap analysis compares the current state of controls against a chosen framework or target state and identifies what is missing. It produces the remediation roadmap that feeds the risk treatment plan and statement of applicability.

Question 11Governance, Risk, and Compliance

After a disaster, which plan primarily coordinates relocating staff, activating alternate facilities, and keeping business processes running?

  1. Business continuity plan Correct answer.
  2. Disaster recovery plan
  3. Incident response plan
  4. Configuration management plan

Explanation

The business continuity plan addresses people, facilities, suppliers, and process-level continuity so the organization can keep operating. The disaster recovery plan is narrower and concentrates on restoring IT systems and data.

Question 12Governance, Risk, and Compliance

A business unit cannot meet a mandatory control before the compliance deadline, so leadership formally documents and approves a time-bound deviation while funding a remediation plan. What has been created?

  1. Control deficiency
  2. Risk exception Correct answer.
  3. Compensating control
  4. False positive

Explanation

A risk exception is a documented, formally approved decision to deviate from a requirement for a defined period, usually with an owner and a remediation date. It differs from a compensating control, which is an alternative safeguard that actually achieves the objective.

Question 13Governance, Risk, and Compliance

Which type of metric tracks changing exposure, such as a rising count of unpatched internet-facing hosts, to warn of an increased likelihood of future loss?

  1. Return on security investment
  2. Service level objective
  3. Key performance indicator
  4. Key risk indicator Correct answer.

Explanation

A key risk indicator measures exposure drivers that precede loss and is used to forecast whether risk is increasing or decreasing. Performance indicators instead report how well a process is executing against its target.

Question 14Governance, Risk, and Compliance

A new HR analytics platform will process special-category data such as employee health records and will profile individuals. Which assessment should be completed before the platform goes live?

  1. Vulnerability assessment
  2. Data protection impact assessment Correct answer.
  3. SOC 2 Type 2 report
  4. Threat model

Explanation

A data protection impact assessment evaluates the necessity and proportionality of processing and identifies privacy risks and mitigations for high-risk processing such as special-category data or profiling. It is a privacy obligation, distinct from technical security testing.

Question 15Governance, Risk, and Compliance

A vendor supplies a report containing an independent auditor's opinion on both the suitability of control design and operating effectiveness over a nine-month period, distributed under NDA to customers. Which report is this?

  1. SOC 1 Type 1 report
  2. SOC 2 Type 1 report
  3. SOC 2 Type 2 report Correct answer.
  4. SOC 3 report

Explanation

A SOC 2 Type 2 report covers the security, availability, or confidentiality criteria and tests operating effectiveness throughout a period. Type 1 covers design at a single point in time only.

Question 16Governance, Risk, and Compliance

Which group typically approves the enterprise risk appetite and reviews aggregated risk reporting on behalf of the board of directors?

  1. Change advisory board
  2. Data governance council
  3. Security operations center
  4. Board risk committee Correct answer.

Explanation

A board-level risk committee provides oversight of the risk management program, endorses the risk appetite, and reviews consolidated risk reporting. Operational bodies such as the SOC or the change advisory board execute rather than govern.

Question 17Governance, Risk, and Compliance

Litigation against an organization is reasonably anticipated. What is the required effect on records relevant to that matter?

  1. Deletion proceeds on the normal retention schedule
  2. The records are moved to the archive tier
  3. The records are encrypted at rest
  4. Scheduled destruction of the affected records is suspended Correct answer.

Explanation

A legal hold overrides the retention schedule and requires that potentially relevant records be preserved, because destroying them can constitute spoliation of evidence. Preservation must be documented and communicated to custodians until the matter closes.

Question 18Governance, Risk, and Compliance

A security team wants to know whether its phishing awareness training actually changed employee behavior. Which measure provides the most direct evidence?

  1. Phishing simulation click rate measured before and after the training Correct answer.
  2. Number of awareness posters displayed in each office
  3. Number of malicious emails blocked by the secure email gateway
  4. Percentage of employees who completed the annual training module

Explanation

Behavior change is demonstrated by comparing a behavioral outcome, such as simulated phishing click or report rates, across a pre-training and post-training period. Completion statistics and gateway blocks measure activity and tooling rather than employee behavior.

Question 19Governance, Risk, and Compliance

Which process ensures that security and compliance impacts are evaluated and approved before a modification is deployed into production?

  1. Patch management
  2. Vulnerability management
  3. Asset management
  4. Change management Correct answer.

Explanation

Change management provides the review and authorization gate in which security, compliance, and operational impacts are assessed and the change is approved, often by a change advisory board. It is what prevents unvetted modifications from reaching production.

Question 20Governance, Risk, and Compliance

Leadership wants to validate decision-making, escalation paths, and crisis communications for a ransomware scenario without touching production systems. Which activity best meets this objective?

  1. Penetration test
  2. Red team engagement
  3. Tabletop exercise Correct answer.
  4. Failover test

Explanation

A tabletop exercise walks participants through a scenario in discussion form to test roles, escalation, and communications without affecting live systems. Technical exercises such as failover tests or penetration tests exercise systems rather than decision-making.

Question 21Governance, Risk, and Compliance

An EU subsidiary must send employee personal data to its US parent company, and no adequacy decision covers the destination country. Which mechanism is most commonly used to legitimize the transfer?

  1. An adequacy decision covering the transfer
  2. A SOC 2 Type 1 report from the importer
  3. Standard contractual clauses between the exporter and importer Correct answer.
  4. A penetration test report for the importer's environment

Explanation

Where no adequacy decision exists, standard contractual clauses impose agreed data protection obligations on exporter and importer and provide the legal basis for the transfer. They are contractual safeguards rather than assurance artifacts.

Question 22Governance, Risk, and Compliance

An analyst rates each risk on a five-point likelihood scale and a five-point impact scale and plots the results on a heat map. Which statement best characterizes this approach?

  1. It removes analyst bias from the risk ranking
  2. It requires a historical loss database to remain valid
  3. It produces a defensible monetary estimate of annualized loss
  4. It uses ordinal scales that depend on subject-matter judgment Correct answer.

Explanation

Qualitative analysis assigns ordinal ratings using expert judgment to rank risks quickly, which is useful for prioritization and communication. It does not produce monetary loss estimates, and judgment-based scales can carry bias that must be managed through calibration and multiple raters.

Question 23Governance, Risk, and Compliance

An e-commerce merchant wants the greatest reduction in PCI DSS scope for its web tier. Which action achieves this?

  1. Truncating account numbers before writing them to the web tier database
  2. Replacing direct card capture with a validated tokenization service so card data never enters the merchant environment Correct answer.
  3. Encrypting cardholder data stored in the web tier database
  4. Running quarterly external vulnerability scans against the web tier

Explanation

Scope is driven by systems that store, process, or transmit account data, so removing the data flow from the environment removes those systems from scope. Outsourcing capture to a validated tokenization provider means the merchant's own systems never handle card data.

Question 24Governance, Risk, and Compliance

An organization wants a contractual provision that lets it inspect a critical supplier's security controls and supporting evidence on demand. Which clause achieves this?

  1. Service level agreement
  2. Indemnification clause
  3. Right-to-audit clause Correct answer.
  4. Non-disclosure agreement

Explanation

A right-to-audit clause grants the customer the contractual ability to examine the supplier's controls and evidence, directly or through an appointed assessor. It is the mechanism that makes ongoing assurance enforceable rather than voluntary.

Question 25Governance, Risk, and Compliance

A US defense contractor must show, through a certified third-party assessment, that it protects controlled unclassified information in line with Department of Defense requirements. Which program applies?

  1. FISMA
  2. CMMC Correct answer.
  3. FedRAMP
  4. NIST Cybersecurity Framework

Explanation

The Cybersecurity Maturity Model Certification program imposes assessed maturity requirements on defense industrial base organizations that handle controlled unclassified information. FedRAMP authorizes cloud services for federal agencies, and the NIST CSF is a voluntary framework without certification.

Question 26Governance, Risk, and Compliance

An organization purchases a cyber insurance policy to cover the costs of a potential data breach. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk transfer Correct answer.
  4. Risk mitigation

Explanation

Risk transfer shifts the financial consequence of a risk to a third party such as an insurer, while the organization remains accountable for managing the underlying exposure. The event can still occur; only the cost impact is shared with another party.

Question 27Governance, Risk, and Compliance

A business impact analysis states that the order management system can tolerate no more than 15 minutes of lost transaction data. Which metric expresses this requirement?

  1. Maximum tolerable downtime (MTD)
  2. Service level objective (SLO)
  3. Recovery point objective (RPO) Correct answer.
  4. Recovery time objective (RTO)

Explanation

The recovery point objective defines the acceptable amount of data loss, measured backward in time from the point of disruption. It drives backup frequency, whereas RTO describes how quickly the service must be restored.

Question 28Governance, Risk, and Compliance

Which document type contains mandatory, high-level statements of management intent that govern how an organization protects information?

  1. Baseline
  2. Procedure
  3. Policy Correct answer.
  4. Guideline

Explanation

A policy is senior management's mandatory statement of intent and direction, and it authorizes the more detailed documents beneath it. Standards and baselines specify concrete requirements, procedures describe step-by-step tasks, and guidelines are discretionary advice.

Question 29Governance, Risk, and Compliance

Who is accountable for deciding the classification of a data set and which parties may access it?

  1. The information security team
  2. The data owner Correct answer.
  3. The data custodian
  4. The data subject

Explanation

The data owner is the business role accountable for assigning classification and authorizing access based on business need. Custodians then implement and operate the safeguards that the owner requires.

Question 30Governance, Risk, and Compliance

A developer can commit code and also push it directly to production without any review. Which control most directly addresses this exposure?

  1. Increasing the frequency of vulnerability scans
  2. Adding a detective log review after each release
  3. Separating deployment authority from code authoring Correct answer.
  4. Requiring developers to sign an acceptable use agreement

Explanation

Segregation of duties divides incompatible responsibilities so that no single person can both create and release a change without independent oversight. This removes the opportunity for unreviewed or malicious code to reach production.

Question 31Governance, Risk, and Compliance

A company engages a cloud payroll provider that processes employee data only on the company's documented instructions and for no other purpose. How is the provider classified under data protection law?

  1. Processor Correct answer.
  2. Controller
  3. Data subject
  4. Joint controller

Explanation

A processor handles personal data on behalf of, and on the documented instructions of, the controller, which determines the purposes and means of processing. The payroll provider acts only on instruction and therefore is the processor.

Question 32Governance, Risk, and Compliance

A legacy application cannot enforce multi-factor authentication. The team instead restricts access to a hardened jump host that requires MFA and records all sessions. What has been implemented?

  1. A deterrent control that discourages attackers
  2. A compensating control Correct answer.
  3. A corrective control that restores affected service
  4. A directive control that mandates user behavior

Explanation

A compensating control is an alternative safeguard that achieves the same risk objective when the preferred control cannot be applied. It substitutes for the missing capability rather than removing the requirement.

Question 33Governance, Risk, and Compliance

Where should the internal audit function report in order to preserve its independence when auditing security controls?

  1. The audit committee of the board Correct answer.
  2. The chief information security officer
  3. The procurement function
  4. The IT operations manager

Explanation

Independence requires that auditors not be managed by the people responsible for the controls they examine. Reporting to the audit committee of the board keeps audit free of operational influence and gives findings an independent escalation path.

Question 34Governance, Risk, and Compliance

An organization onboards hundreds of suppliers each year. What is the most appropriate way to decide how much security due diligence each supplier receives?

  1. Tier suppliers by data sensitivity and service criticality Correct answer.
  2. Apply the same full assessment to every supplier for consistency
  3. Assess only suppliers that request access to the network
  4. Rely on the supplier's own marketing claims to reduce effort

Explanation

Third-party assurance should be risk-based, so effort is proportionate to the exposure a supplier creates. Tiering by data sensitivity and operational criticality directs deeper assessment to the relationships that could cause the greatest harm.

Question 35Governance, Risk, and Compliance

A risk is rated high before any controls are applied. After the planned controls are implemented and verified, the remaining level of risk is called:

  1. Inherent risk
  2. Control risk
  3. Residual risk Correct answer.
  4. Risk appetite

Explanation

Residual risk is the exposure that remains once controls have been implemented and evaluated. Inherent risk is the level measured before controls, so the difference between the two reflects the effect of the control environment.

Question 36Governance, Risk, and Compliance

Which activity identifies the organization's most critical business processes, their dependencies, and the impact of their disruption over time?

  1. Threat modeling
  2. Business impact analysis Correct answer.
  3. Control self-assessment
  4. Vulnerability assessment

Explanation

A business impact analysis determines which processes are most critical, what they depend on, and how harm grows as disruption lengthens. Its outputs set recovery priorities and objectives that drive continuity and disaster recovery planning.

Question 37Governance, Risk, and Compliance

An organization voluntarily adopts an industry security framework. How does this obligation differ from a statutory regulation?

  1. It is voluntary; the regulation is legally enforceable Correct answer.
  2. It supersedes the regulation where the two overlap
  3. It becomes legally binding once the organization formally adopts it
  4. It applies only to publicly traded companies

Explanation

Frameworks and standards are voluntary good practice that an organization chooses to follow, often for assurance or contractual reasons. Regulations create legal duties that a government authority enforces, typically with penalties for non-compliance.

Question 38Governance, Risk, and Compliance

A data subject submits a valid access request to a controller. Under the GDPR, within what period must the controller respond, and what extension is permitted?

  1. Within 30 calendar days, extendable once by a further 30 days
  2. Within one month, extendable by two months for complex requests Correct answer.
  3. Within 90 calendar days, extendable by a further 90 days on request
  4. Within 72 hours of receipt, with no possibility of extension

Explanation

The GDPR requires a response without undue delay and in any event within one month of receiving the request. That period may be extended by two further months where the request is complex, provided the data subject is informed of the extension and the reasons within the first month.

Question 39Governance, Risk, and Compliance

An auditor must determine whether an access review control operated consistently throughout the year. Which approach provides the strongest evidence?

  1. Reviewing the design documentation for the workflow in the review tool
  2. Interviewing the control owner about the review process
  3. Reading the documented access review procedure
  4. Sampling reviews across the period and inspecting approvals Correct answer.

Explanation

Testing operating effectiveness requires evidence that the control actually performed as designed over the whole period, which comes from examining instances of the control in action. Sampling completed reviews and inspecting the evidence of approval and follow-up demonstrates consistent execution.

Question 40Governance, Risk, and Compliance

A company must satisfy several overlapping regulatory frameworks and finds its teams collecting the same evidence repeatedly. Which approach best reduces this duplication?

  1. Delegate evidence collection to each business unit independently
  2. Perform a separate full assessment for every framework each year
  3. Map requirements to common controls and reuse evidence Correct answer.
  4. Adopt only the framework with the strictest requirements and drop the others

Explanation

Control harmonization maps the requirements of multiple frameworks to a unified control set so a single piece of evidence supports many obligations. Coverage is maintained while redundant testing and audit fatigue are reduced.

Question 41Security Architecture

Under the cloud shared responsibility model, which responsibility always remains with the customer regardless of service model?

  1. Maintaining the hypervisor that runs tenant workloads
  2. Securing the physical data center hosting the service
  3. Protecting the confidentiality of customer data Correct answer.
  4. Replacing failed storage drives in the provider's facility

Explanation

The customer always retains ownership of data and responsibility for identity, access, and data classification, even when infrastructure is provider-managed. The provider secures the physical facility and underlying platform according to the service model.

Question 42Security Architecture

Which principle is central to a zero trust architecture?

  1. Trusting devices automatically once inside the corporate perimeter
  2. Granting broad access after a single successful login
  3. Relying on network location to determine authorization
  4. Verifying every request as untrusted, regardless of location Correct answer.

Explanation

Zero trust removes implicit trust based on network location and requires continuous verification of identity, device posture, and context for each request. Access is granted per session with least privilege.

Question 43Security Architecture

What is the primary purpose of a DMZ in network architecture?

  1. To provide a high-availability database cluster
  2. To store backups encrypted at rest
  3. To force all internal traffic through one central firewall appliance
  4. To isolate public-facing services from the internal network Correct answer.

Explanation

A DMZ places public-facing services in a segmented zone reachable from the internet but separated from internal systems by firewalls. If an exposed host is compromised, segmentation limits lateral movement.

Question 44Security Architecture

Which metric defines the maximum acceptable time to restore a service after a disruption?

  1. Service level objective (SLO)
  2. Recovery point objective (RPO)
  3. Mean time between failures (MTBF)
  4. Recovery time objective (RTO) Correct answer.

Explanation

RTO is the maximum tolerable downtime before a disruption causes unacceptable business impact. RPO measures acceptable data loss, not time to restore.

Question 45Security Architecture

What is the primary role of a hardware security module (HSM) in a security architecture?

  1. Filtering malicious traffic at the network edge
  2. Storing user credentials in a directory service
  3. Managing and protecting cryptographic keys Correct answer.
  4. Providing virtual desktops to remote users

Explanation

An HSM is a tamper-resistant device that stores keys and performs cryptographic operations so keys are not exposed to general-purpose systems. It supports key lifecycle management and policy enforcement.

Question 46Security Architecture

What does microsegmentation primarily achieve in a data center?

  1. It aggregates all VLANs into one broadcast domain
  2. It replaces the need for user authentication
  3. It enforces granular policy between workloads Correct answer.
  4. It encrypts all data at rest on storage arrays

Explanation

Microsegmentation creates small policy zones around workloads so traffic is allowed only on explicitly permitted flows. It reduces east-west lateral movement better than coarse VLAN boundaries.

Question 47Security Architecture

Which concept describes layering multiple independent security controls so failure of one does not expose the whole system?

  1. Single sign-on
  2. Load balancing
  3. Defense in depth Correct answer.
  4. Flat network topology

Explanation

Defense in depth combines preventive, detective, and corrective controls across layers so an attacker must defeat multiple independent safeguards. No single control is assumed to be sufficient.

Question 48Security Architecture

What is the main function of network access control (NAC)?

  1. Checking endpoint compliance before access Correct answer.
  2. Balancing requests across web servers
  3. Providing DNS resolution for internal hosts
  4. Encrypting traffic between branch offices

Explanation

NAC checks identity and endpoint posture, such as patch level and antivirus status, before permitting access and can place noncompliant devices in a remediation VLAN. It does not encrypt traffic or provide DNS.

Question 49Security Architecture

Which architecture converges networking and security functions such as secure web gateway, CASB, and zero trust network access into a cloud-delivered service?

  1. Public key infrastructure (PKI)
  2. Software-defined perimeter (SDP)
  3. Secure access service edge (SASE) Correct answer.
  4. Security information and event management (SIEM)

Explanation

SASE consolidates network and security services such as secure web gateway, CASB, firewall-as-a-service, and zero trust network access into a cloud-delivered edge. It is designed to follow users and workloads rather than backhaul to a data center.

Question 50Security Architecture

An organization wants visibility into and policy enforcement over employees' use of unsanctioned cloud applications. Which technology best fits?

  1. Network tap
  2. Host-based intrusion prevention system
  3. Web application firewall
  4. Cloud access security broker Correct answer.

Explanation

A CASB provides visibility, data protection, and policy enforcement for cloud application usage, including shadow IT. It can discover unsanctioned apps and apply controls such as blocking or encryption.