I85PREP
⌘ K
GCT-2A-324 study materials
GCT-2A-324 study resources

GCT-2A-324 practice questions

One question at a time. Build your GCT-2A-324 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk, and Compliance Fundamentals

In a governance, risk, and compliance program, which document typically sits at the highest level and establishes the organization's overall security intent and direction?

  1. The incident ticket template
  2. The information security policy Correct answer.
  3. The firewall rule base
  4. The asset inventory spreadsheet

Explanation

The top-level information security policy states management's intent, objectives, and commitment to security, and it authorizes the lower-level standards, procedures, and guidelines beneath it. Operational artifacts such as rule bases, tickets, and inventories implement or record activity but do not set direction.

Question 2Governance, Risk, and Compliance Fundamentals

Which statement best distinguishes a standard from a procedure in a typical GRC documentation hierarchy?

  1. A standard is optional guidance, while a procedure is mandatory
  2. A standard applies only to executives, while a procedure applies only to technicians
  3. A standard describes business goals, while a procedure describes legal obligations
  4. A standard mandates specific requirements, while a procedure gives step-by-step instructions to meet them Correct answer.

Explanation

Standards are mandatory, measurable requirements such as approved algorithms or password length, whereas procedures describe the ordered steps staff follow to satisfy a policy or standard. This keeps the mandatory 'what' separate from the operational 'how'.

Question 3Governance, Risk, and Compliance Fundamentals

An organization's risk register shows a risk with likelihood rated high and impact rated medium. A manager wants to purchase cyber insurance to cover part of the potential loss. Which risk treatment option does this represent?

  1. Risk mitigation
  2. Risk avoidance
  3. Risk acceptance
  4. Risk transfer Correct answer.

Explanation

Buying insurance shifts part of the financial consequence to a third party, which is risk transfer. Avoidance would eliminate the activity, acceptance would retain the risk without further action, and mitigation would reduce likelihood or impact through controls.

Question 4Governance, Risk, and Compliance Fundamentals

What is the primary purpose of a risk appetite statement in a GRC program?

  1. To list every vulnerability discovered during the last scan
  2. To assign disciplinary action for policy violations
  3. To define how much risk the organization is willing to pursue or retain in pursuit of its objectives Correct answer.
  4. To record the technical configuration of each server

Explanation

A risk appetite statement expresses the amount and type of risk leadership is willing to accept to achieve objectives, and it guides treatment decisions and tolerance thresholds. Vulnerability lists, disciplinary rules, and server configurations are operational artifacts, not appetite statements.

Question 5Governance, Risk, and Compliance Fundamentals

Which element is most characteristic of a compliance obligation register?

  1. Each entry lists the names of employees who attended training
  2. Each entry captures the version history of the firewall firmware
  3. Each entry records the mean time to repair a failed disk
  4. Each entry links a legal or regulatory requirement to the controls and owners responsible for meeting it Correct answer.

Explanation

A compliance obligation register maps external and internal requirements to the controls, evidence, and accountable owners that satisfy them, enabling traceability. The other entries are operational metrics or records unrelated to obligation tracking.

Question 6Governance, Risk, and Compliance Fundamentals

In the classic triad used to describe information security objectives, which property ensures that data is not altered improperly?

  1. Integrity Correct answer.
  2. Availability
  3. Confidentiality
  4. Non-repudiation

Explanation

Integrity means data and systems are accurate, complete, and protected from unauthorized modification. Confidentiality restricts access to authorized parties, availability ensures timely access, and non-repudiation is a related assurance property rather than one of the three core objectives.

Question 7Governance, Risk, and Compliance Fundamentals

A control that reduces the likelihood of an event occurring, such as requiring multi-factor authentication, is best described as which type of control?

  1. Corrective
  2. Preventive Correct answer.
  3. Compensating
  4. Detective

Explanation

Preventive controls stop or reduce the chance of an event before it happens, and multi-factor authentication blocks many unauthorized access attempts. Detective controls discover events, corrective controls restore after events, and compensating controls substitute for a primary control.

Question 8Governance, Risk, and Compliance Fundamentals

Which activity best describes the core purpose of a business impact analysis (BIA) within continuity planning?

  1. Determining the fair market value of the company's stock
  2. Selecting the vendor that supplies office furniture
  3. Testing whether employees can recognize phishing emails
  4. Identifying critical processes and the consequences of their disruption to set recovery priorities Correct answer.

Explanation

A BIA identifies critical business functions, quantifies the operational and financial impact of their disruption over time, and establishes recovery time and recovery point objectives. It therefore drives continuity priorities rather than security awareness or procurement decisions.

Question 9Governance, Risk, and Compliance Fundamentals

An auditor finds that a server administrator can both approve and implement changes to production systems. Which principle is most directly violated?

  1. Least privilege
  2. Data minimization
  3. Separation of duties Correct answer.
  4. Need to know

Explanation

Separation of duties requires that no single person controls all parts of a sensitive transaction, so approval and implementation should be split. Least privilege, need to know, and data minimization limit the scope of access but do not by themselves prevent one person from holding conflicting duties.

Question 10Governance, Risk, and Compliance Fundamentals

A risk assessment rates a threat as low likelihood but very high impact, and leadership decides to retain the risk because the cost of controls exceeds the expected loss. What should the risk register record to make this decision auditable?

  1. Only the name of the risk owner, with no further detail
  2. The rationale, approver, review date, and current treatment status of the accepted risk Correct answer.
  3. A note that the risk was deleted from the register
  4. The technical specifications of the affected server

Explanation

Accepted risks should remain in the register with documented rationale, the accountable approver, a review date, and status so the decision is traceable and can be revisited. Deleting the risk or omitting the rationale removes the audit trail.

Question 11Governance, Risk, and Compliance Fundamentals

An organization must comply with a regulation requiring breach notification within 72 hours. Which control is most directly aligned with meeting this obligation?

  1. An annual review of the physical badge system
  2. A backup retention period of seven years
  3. A documented incident response process with defined escalation and notification timelines Correct answer.
  4. A quarterly password rotation for service accounts

Explanation

Meeting a fixed notification deadline depends on an incident response process that detects, escalates, and triggers notification within the required window. Password rotation, badge reviews, and backup retention address other objectives and do not ensure timely regulatory notification.

Question 12Governance, Risk, and Compliance Fundamentals

Which metric best demonstrates the effectiveness of a patch management control rather than merely its activity?

  1. Number of patches downloaded during the quarter
  2. Percentage of critical vulnerabilities remediated within the defined service-level target Correct answer.
  3. Count of servers enrolled in the patch tool
  4. Total hours the patch team spent in meetings

Explanation

Effectiveness metrics measure outcomes against a target, such as the share of critical vulnerabilities remediated within the required window. Activity metrics like downloads, enrollments, and meeting hours show effort but not whether risk was reduced on time.

Question 13Governance, Risk, and Compliance Fundamentals

A company identifies a risk that a key supplier may fail to deliver a critical service. Which treatment most directly reduces the impact if the supplier fails?

  1. Removing the supplier from the vendor list
  2. Lowering the risk rating in the register without any action
  3. Establishing a qualified alternate supplier and tested failover arrangements Correct answer.
  4. Extending the supplier contract by one year

Explanation

A qualified alternate supplier with tested failover reduces the impact of a supplier failure by enabling continuity of the service. Re-rating without action, extending a contract, or deleting the vendor does not create a substitute capability.

Question 14Governance, Risk, and Compliance Fundamentals

What is the primary role of a control self-assessment in a GRC program?

  1. Drafting marketing materials for security certifications
  2. Having process owners evaluate and attest to the design and operating effectiveness of their controls Correct answer.
  3. Replacing all independent audits with informal conversations
  4. Calculating the depreciation of IT assets

Explanation

A control self-assessment lets process owners examine and attest to their own controls, providing early insight into gaps and ownership accountability. It complements rather than replaces independent assurance and has nothing to do with asset depreciation or marketing.

Question 15Governance, Risk, and Compliance Fundamentals

During a risk assessment, a team estimates likelihood and impact using a five-by-five matrix and then multiplies the values. What is the main limitation of relying solely on this approach?

  1. Multiplication always produces a value below one
  2. The matrix cannot be applied to more than one asset at a time
  3. The numeric scores can imply false precision and may not reflect correlated or cascading risks Correct answer.
  4. The method requires regulatory approval before use

Explanation

Qualitative scoring produces ordinal judgments that can look precise once multiplied, and it typically treats risks independently, missing correlations and cascading effects. The other statements are factually incorrect about how matrices work.

Question 16Governance, Risk, and Compliance Fundamentals

Which practice best supports the principle of least privilege for privileged accounts?

  1. Storing administrator credentials in a shared spreadsheet
  2. Keeping a permanent domain administrator account for daily email use
  3. Sharing a single administrator account among the operations team
  4. Granting elevated rights only for the task and duration needed, then removing them Correct answer.

Explanation

Least privilege means privileged access is granted just-in-time for the specific task and revoked when no longer needed, often through privileged access management. Shared accounts, permanent high-privilege use, and insecure storage all expand exposure.

Question 17Governance, Risk, and Compliance Fundamentals

A regulator issues new rules that take effect in six months. The compliance team must decide how to respond. Which first step is most appropriate?

  1. Immediately disable all internet-facing systems
  2. Wait until the effective date to assess impact
  3. Outsource the entire security program to a third party
  4. Perform a gap analysis comparing the new requirements against current controls and evidence Correct answer.

Explanation

A gap analysis identifies where current controls and evidence fall short of the new requirements so remediation can be planned and prioritized before the effective date. Disabling systems, waiting, or wholesale outsourcing are disproportionate or delay action.

Question 18Governance, Risk, and Compliance Fundamentals

Which statement accurately describes the relationship between policies and guidelines?

  1. Policies state mandatory expectations, while guidelines offer recommended practices that allow discretion Correct answer.
  2. Policies are advisory, while guidelines are legally binding
  3. Policies are written by auditors, while guidelines are written by regulators
  4. Policies apply only to contractors, while guidelines apply only to employees

Explanation

Policies set mandatory expectations and are enforced, whereas guidelines provide recommended approaches that allow judgment in implementation. The other options misstate authority, authorship, or scope.

Question 19Governance, Risk, and Compliance Fundamentals

An organization wants to demonstrate that a third-party cloud provider meets its security requirements. Which artifact is most directly relevant?

  1. The provider's office floor plan
  2. An independent assurance report covering the provider's relevant control environment Correct answer.
  3. The provider's marketing brochure
  4. The provider's stock ticker symbol

Explanation

An independent assurance report, such as an attestation over the provider's controls, gives evidence that the control environment meets stated criteria. Brochures, ticker symbols, and floor plans do not substantiate control effectiveness.

Question 20Governance, Risk, and Compliance Fundamentals

A risk owner decides to reduce the likelihood of a data breach by deploying data loss prevention tools. Two months later, the residual risk rating is still high. What is the most appropriate next step in the risk management cycle?

  1. Reclassify the risk as an opportunity
  2. Delete the control from the register and take no further action
  3. Close the risk because a control was deployed
  4. Reassess the control's effectiveness and revisit the treatment plan or appetite decision Correct answer.

Explanation

Risk management is iterative; if residual risk remains above tolerance after treatment, the owner should evaluate whether the control works as intended and adjust the treatment or escalate the appetite decision. Closing the risk merely because a control exists ignores its measured effect.

Question 21Governance, Risk, and Compliance Fundamentals

An internal audit finds that a detective control generates thousands of alerts weekly, and analysts investigate only a small fraction. Which conclusion is most defensible?

  1. The risk has been eliminated because a control exists
  2. The control is fully effective because alerts are being generated
  3. The alerts should be deleted to reduce noise
  4. The control's monitoring and triage capacity is inadequate, so its detective effectiveness is undermined Correct answer.

Explanation

A detective control only works if alerts are reviewed and acted on; an overwhelming backlog means real events may go unnoticed, so tuning and adequate triage capacity are needed. Alert generation alone, or deleting alerts, does not establish effectiveness.

Question 22Governance, Risk, and Compliance Fundamentals

A multinational firm faces conflicting privacy requirements across two jurisdictions in which it operates. Which approach best reflects sound GRC practice?

  1. Map each obligation to the affected data and processes, then design controls that satisfy the stricter applicable requirement where feasible Correct answer.
  2. Apply whichever rule is cheapest to implement regardless of legal exposure
  3. Ignore both sets of rules until enforcement actions occur
  4. Apply only the requirements of the headquarters country everywhere

Explanation

Sound practice is to map obligations to data flows and processes, then design controls meeting the strictest applicable requirement where conflicts arise, documenting any legal analysis. Applying only headquarters rules, waiting for enforcement, or choosing by cost alone creates legal and reputational exposure.

Question 23Governance, Risk, and Compliance Fundamentals

Leadership asks whether a proposed new product feature can launch given the organization's risk appetite. Which reasoning best applies the concept of risk tolerance?

  1. Defer the decision indefinitely to avoid accountability
  2. Reject the launch because any residual risk is unacceptable
  3. Compare the feature's residual risk against the defined tolerance thresholds for that risk category and escalate if it exceeds them Correct answer.
  4. Approve the launch because new features always increase revenue

Explanation

Risk tolerance translates appetite into measurable thresholds per category, so the decision should compare residual risk with those thresholds and escalate when exceeded. Blanket approval, blanket rejection, or indefinite deferral ignores the defined limits and accountability.

Question 24Governance, Risk, and Compliance Fundamentals

An organization discovers that a vendor subcontracts part of a critical service without notifying anyone. Which governance gap does this most directly reveal?

  1. Insufficient flow-down of security and notification requirements to subcontractors in the vendor agreement Correct answer.
  2. An excess of detective logging on internal servers
  3. An overly strict password complexity standard
  4. Too frequent review of the asset inventory

Explanation

The gap is that contractual requirements were not flowed down to subcontractors, including notification of subprocessing, so oversight of the extended supply chain failed. Password standards, internal logging, and inventory review frequency do not govern subcontractor conduct.

Question 25Governance, Risk, and Compliance Fundamentals

Which combination best reflects a defensible three-lines model for governance and assurance?

  1. The vendor operates controls, the regulator provides oversight, and customers give assurance
  2. All three lines are performed by the same team to save costs
  3. Internal audit operates the controls, management provides independent assurance, and the board performs daily monitoring
  4. Management owns and operates controls, a risk and compliance function provides oversight, and internal audit gives independent assurance Correct answer.

Explanation

In the three-lines model, operational management owns and runs controls, a risk and compliance function provides independent oversight and challenge, and internal audit provides independent assurance to the board. Collapsing the lines or reassigning them to vendors and regulators defeats independence.

Question 26Governance, Risk, and Compliance Fundamentals

Which statement best describes the difference between a risk and an issue in a governance, risk, and compliance program?

  1. A risk is an uncertain future event that may affect objectives, while an issue is a problem that has already occurred and requires action. Correct answer.
  2. A risk is always financial in nature, while an issue concerns only regulatory matters.
  3. A risk is identified by external auditors, while an issue is identified only by internal staff.
  4. A risk is recorded after an incident, while an issue is forecast during planning.

Explanation

In GRC practice, a risk describes a potential future event with uncertainty about whether and how it will affect objectives, so it is managed through assessment and treatment. An issue is a realized problem or gap that already exists and must be resolved through corrective action. Keeping the two distinct ensures risks are evaluated before impact and issues are tracked to closure.

Question 27Governance, Risk, and Compliance Fundamentals

An organization defines its tolerance for disruption by stating the maximum time a critical payment system may be unavailable before unacceptable harm occurs. Which continuity term describes this threshold?

  1. Maximum tolerable downtime (MTD) Correct answer.
  2. Mean time to repair (MTTR)
  3. Recovery point objective (RPO)
  4. Service level agreement (SLA)

Explanation

Maximum tolerable downtime is the longest period a business process can be unavailable before the impact becomes unacceptable to the organization. It is derived from business impact analysis and sets the outer boundary that recovery plans must satisfy. Related metrics such as RPO and MTTR are technical measures used to design solutions that fit inside that boundary.

Question 28Governance, Risk, and Compliance Fundamentals

A governance committee wants a single consolidated view of compliance status across regulations, internal policies, and third-party obligations. Which capability most directly delivers this?

  1. A data classification standard
  2. A compliance obligation register mapped to controls and owners Correct answer.
  3. An incident response runbook
  4. A penetration testing schedule

Explanation

A compliance obligation register catalogs each external and internal requirement, links it to the controls that satisfy it, and assigns accountability. Mapping obligations to controls allows leadership to see coverage, gaps, and overlaps in one place. This traceability is the foundation for consolidated compliance reporting.

Question 29Governance, Risk, and Compliance Fundamentals

Which statement correctly distinguishes a standard from a procedure?

  1. A standard specifies mandatory requirements such as a control baseline, while a procedure gives step-by-step instructions for performing a task. Correct answer.
  2. A standard is optional guidance, while a procedure is mandatory.
  3. A standard describes the organization's overall intent, while a procedure is approved only by the board.
  4. A standard applies only to third parties, while a procedure applies only to employees.

Explanation

In a typical policy hierarchy, standards set mandatory, measurable requirements such as approved configurations or control baselines. Procedures translate those requirements into detailed, sequential steps that staff follow to perform a task consistently. Policies state intent at a high level, while standards and procedures become progressively more specific and operational.

Question 30Governance, Risk, and Compliance Fundamentals

A risk register entry shows a score of 20 on a five-by-five matrix, above the organization's threshold of 12. The risk owner proposes to purchase cyber insurance and take no other action. How should the governance function evaluate this proposal?

  1. Require the risk owner to raise the threshold so the score falls below it.
  2. Reject it outright, because insurance is never an acceptable treatment.
  3. Assess whether transferring the financial impact is sufficient given that the residual risk still exceeds appetite. Correct answer.
  4. Accept it, because insurance eliminates the risk from the register.

Explanation

Insurance is a risk transfer treatment that addresses financial consequences but does not reduce the likelihood or operational impact of the event. Where the residual risk remains above the defined threshold, the governance function must judge whether the remaining exposure is genuinely within appetite or whether additional mitigation is needed. Adjusting the threshold to fit the score would be a manipulation of the assessment rather than a treatment.

Question 31Governance, Risk, and Compliance Fundamentals

A GRC team is designing key risk indicators for a customer onboarding process. Which characteristic makes an indicator most useful for early warning?

  1. It is chosen because the underlying data is easy to collect, regardless of relevance.
  2. It measures a leading condition, such as the percentage of onboarding cases missing verification, with a defined threshold. Correct answer.
  3. It is calculated only after a loss event has been recorded.
  4. It is reported annually to minimize reporting effort.

Explanation

Effective key risk indicators are relevant, measurable, and tied to a threshold that triggers action before losses occur. A leading indicator such as the rate of incomplete verification signals deteriorating control performance early. Convenience of data collection or infrequent reporting undermines the indicator's predictive value.

Question 32Governance, Risk, and Compliance Fundamentals

A vendor contract requires the supplier to notify the client of security incidents within 24 hours and to permit annual audits. The supplier's last two audit reports are more than two years old. Which governance action best addresses this gap?

  1. Terminate the contract immediately without further review.
  2. Escalate the expired assurance to the vendor risk owner and require current evidence or an alternative assurance mechanism. Correct answer.
  3. File the old reports as evidence of compliance and take no further action.
  4. Remove the supplier from the vendor inventory to avoid audit findings.

Explanation

Third-party risk management requires that assurance evidence remain current for the duration of the relationship, not just at onboarding. When evidence is stale, the vendor risk owner should pursue refreshed reports, on-site assessment, or another agreed assurance mechanism, and escalate if the supplier does not comply. Removing the supplier from the inventory or relying on outdated reports conceals the exposure rather than managing it.

Question 33Governance, Risk, and Compliance Fundamentals

An organization wants to reduce the chance that a single administrator can both configure and delete audit logs. Which control objective does this primarily serve?

  1. Segregation of duties over privileged functions Correct answer.
  2. Encryption of data at rest
  3. Data minimization
  4. Availability through load balancing

Explanation

Separating the ability to configure logging from the ability to delete or alter logs prevents one person from covering tracks, which is a segregation-of-duties objective applied to privileged functions. This separation preserves the integrity and trustworthiness of audit evidence. The other options address privacy, availability, and confidentiality respectively rather than conflicting duties.

Question 34Governance, Risk, and Compliance Fundamentals

A board asks management to explain how the organization's risk appetite statement influences day-to-day decisions. Which response best reflects sound governance practice?

  1. The statement defines quantified tolerance levels that are embedded in approval workflows, project gates, and exception processes. Correct answer.
  2. The statement is used only by the internal audit team when scoping engagements.
  3. The statement is replaced each quarter with the latest risk register scores.
  4. The statement is published once and stored in the policy library for reference.

Explanation

A risk appetite statement becomes operative only when it is translated into measurable tolerances and applied at decision points such as approvals, project gates, and exception handling. Embedding it in workflows lets managers make consistent trade-offs without ad hoc escalation. Storing it passively or restricting it to audit limits its governance value.

Question 35Governance, Risk, and Compliance Fundamentals

A control owner reports that a monthly access review is performed, but the review spreadsheet does not record who approved each decision or what action was taken. Which conclusion is most defensible?

  1. The control's operating effectiveness cannot be demonstrated because evidence of review decisions and actions is missing. Correct answer.
  2. The control should be reclassified as preventive because a review prevents all unauthorized access.
  3. The control is unnecessary because access reviews are a technical rather than governance activity.
  4. The control is fully effective because the review occurred on schedule.

Explanation

Operating effectiveness requires evidence that the control was performed as designed, including who reviewed, what was decided, and how exceptions were resolved. A schedule alone shows activity but not that the review achieved its objective. Without documented decisions and follow-up actions, an auditor cannot conclude the control operated effectively.

Question 36Governance, Risk, and Compliance Fundamentals

A company operates in a jurisdiction requiring data localization and another requiring cross-border transfer safeguards. Which approach best balances both obligations?

  1. Store all data only in the first jurisdiction and ignore the second regulation.
  2. Rely on the strictest single regulation and assume it satisfies all others.
  3. Map each data flow to the applicable legal requirements and apply location controls plus approved transfer mechanisms where permitted. Correct answer.
  4. Encrypt all data and treat encryption as a substitute for any legal transfer requirement.

Explanation

Conflicting legal obligations are managed by mapping data flows to jurisdictions and determining which requirements attach to each dataset and transfer. Where localization is mandated, location controls apply; where transfers are permitted with safeguards, approved transfer mechanisms can be used. Assuming one law satisfies all others or that encryption replaces legal obligations is a common but unsound shortcut.

Question 37Governance, Risk, and Compliance Fundamentals

During an audit, management disputes a finding and provides additional evidence that the control operated as designed. What is the most appropriate next step in the audit process?

  1. Management formally responds to the finding, and the auditor evaluates the new evidence and documents whether the finding stands, is revised, or is closed. Correct answer.
  2. Management escalates directly to the regulator to overturn the finding.
  3. The finding is automatically closed because management disagrees with it.
  4. The auditor silently discards the finding to preserve the relationship.

Explanation

Audit findings follow a formal management response process in which the auditee provides evidence and remediation commitments, and the auditor evaluates that response objectively. The auditor then documents whether the finding is validated, revised, or closed based on the evidence. Neither silent withdrawal nor automatic closure preserves the independence and traceability of the audit.

Question 38Governance, Risk, and Compliance Fundamentals

An organization is selecting a framework to structure its information security management system and wants certification against an internationally recognized standard. Which choice best fits this objective?

  1. A vendor-specific security questionnaire
  2. An internal maturity model created solely for the organization
  3. ISO/IEC 27001, which specifies requirements for an information security management system and supports third-party certification Correct answer.
  4. A national incident reporting scheme

Explanation

ISO/IEC 27001 sets out requirements for establishing, operating, and continually improving an information security management system and is designed to support independent certification. That makes it suitable when the goal is externally recognized assurance. Questionnaires, reporting schemes, and bespoke internal models may be useful but do not provide the same certifiable management system standard.

Question 39Governance, Risk, and Compliance Fundamentals

A risk assessment team assigns likelihood and impact scores subjectively, and different teams produce widely different ratings for similar systems. Which improvement most directly increases consistency?

  1. Removing the impact dimension to simplify scoring
  2. Increasing the number of risk register fields
  3. Having each team use its own scale
  4. Defining calibrated rating criteria with concrete examples for each likelihood and impact level Correct answer.

Explanation

Inconsistent ratings usually stem from vague scale definitions that each assessor interprets differently. Calibrated criteria with concrete anchors, such as defined financial ranges or outage durations for each impact level, align judgments across teams. Adding fields or letting teams define separate scales increases variability rather than reducing it.

Question 40Governance, Risk, and Compliance Fundamentals

A regulator requires that certain records be retained for seven years, but the organization's privacy policy requires deletion of personal data once it is no longer needed. Which governance decision is most appropriate?

  1. Retain records for the legally mandated period, apply access restrictions and minimization to the personal data, and document the legal basis for retention. Correct answer.
  2. Let each business unit decide its own retention period without central oversight.
  3. Delete all records at the end of the privacy retention period regardless of the legal requirement.
  4. Retain all data indefinitely to avoid any risk of noncompliance.

Explanation

Retention obligations and data minimization must be reconciled rather than treated as absolutes. The sound approach is to retain only what the law requires for the mandated period, restrict access and minimize personal data within those records, and document the legal basis. Indefinite retention or decentralized decisions create privacy and compliance exposure.

Question 41Security Architecture and Design

In a mandatory access control (MAC) system, a subject with a Secret clearance attempts to read a Top Secret document. Under the Bell-LaPadula model, what is the outcome?

  1. The read is denied because Bell-LaPadula forbids read-down access
  2. The read is denied because the subject's clearance is below the object's classification level Correct answer.
  3. The read is permitted only if the subject also holds a need-to-know for the document
  4. The read is permitted because reading does not change classification levels

Explanation

Bell-LaPadula's simple security property (no read up) forbids a subject from reading an object whose classification exceeds the subject's clearance. A Secret-cleared subject reading a Top Secret object violates that rule, so the access is denied. Need-to-know is a separate control layered on top, and the model does not forbid read-down.

Question 42Security Architecture and Design

Which security model is specifically designed to address covert channels and information flow between different sensitivity levels by enforcing the *-property (star property)?

  1. Bell-LaPadula model Correct answer.
  2. Biba integrity model
  3. Take-Grant model
  4. Clark-Wilson model

Explanation

Bell-LaPadula defines the *-property (confinement property), which restricts writes so that information cannot flow from a higher classification to a lower one, directly targeting covert-channel leakage. It combines the simple security property with the *-property to control both reads and writes. The other models address integrity or rights propagation rather than confidentiality flow.

Question 43Security Architecture and Design

An organization wants to protect the integrity of data so that a low-integrity process cannot write to a high-integrity file. Which model directly enforces this rule?

  1. Bell-LaPadula
  2. Biba Correct answer.
  3. Harrison-Ruzzo-Ullman
  4. Brewer-Nash

Explanation

The Biba integrity model is the mirror image of Bell-LaPadula and enforces no write-up: a subject at a lower integrity level cannot modify an object at a higher integrity level. This protects high-integrity data from contamination by less trustworthy processes. Bell-LaPadula and Brewer-Nash focus on confidentiality, and HRU focuses on access-right safety.

Question 44Security Architecture and Design

In the Clark-Wilson model, what is the role of a well-formed transaction?

  1. It defines the clearance levels assigned to constrained data items
  2. It encrypts data at rest so that only constrained data items can be read
  3. It moves the system from one consistent state to another while preserving integrity invariants Correct answer.
  4. It allows users to bypass integrity checks when authorized by an administrator

Explanation

Clark-Wilson requires that all modifications to constrained data items occur through well-formed transactions that preserve the system's integrity invariants. Each transaction takes the system from one valid state to another and is subject to separation of duty. Encryption and clearance levels are not the model's concern.

Question 45Security Architecture and Design

A security architect needs a model that prevents a consultant from accessing records of two competing clients in the same market segment. Which model best fits this requirement?

  1. Bell-LaPadula model
  2. Brewer-Nash (Chinese Wall) model Correct answer.
  3. Clark-Wilson model
  4. Biba integrity model

Explanation

The Brewer-Nash model, also called the Chinese Wall, dynamically restricts access based on what a subject has already accessed, preventing conflicts of interest between competing organizations. Once a consultant accesses one client's data, access to a competitor's data in the same conflict class is blocked. The other models address integrity or multilevel confidentiality, not conflict-of-interest separation.

Question 46Security Architecture and Design

Which statement accurately describes the reference monitor concept?

  1. It is a database of user passwords stored in encrypted form
  2. It is a logging service that records events after access has been granted
  3. It is a hardware firewall placed at the network perimeter to filter packets
  4. It is an abstract machine that mediates all access requests and must be tamper-proof and always invoked Correct answer.

Explanation

The reference monitor is an abstract security component that validates every access request against the security policy. It must be tamper-proof, always invoked, and small enough to be verified, which is why the security kernel implements it. It is not a network device, a credential store, or a post-hoc logger.

Question 47Security Architecture and Design

Which property must a security kernel satisfy to be considered a correct implementation of the reference monitor?

  1. It must be larger than the operating system it protects
  2. It must run in user mode to allow easy patching
  3. It must store all audit logs on remote servers
  4. It must be verifiable, always invoked, and tamper-proof Correct answer.

Explanation

A security kernel implementing the reference monitor must be always invoked, tamper-proof, and small and simple enough to be formally verified. These three properties are the classic criteria for reference monitor correctness. Size, privilege mode, and log location are not part of the criteria.

Question 48Security Architecture and Design

What distinguishes a trusted computing base (TCB) from the full operating system?

  1. The TCB is the physical facility that houses the servers
  2. The TCB is the backup and recovery subsystem
  3. The TCB is the subset of components that must be trusted to enforce the security policy Correct answer.
  4. The TCB is the set of user applications that request access to files

Explanation

The trusted computing base comprises all hardware, firmware, and software components whose correct operation is necessary to enforce the security policy. It is deliberately the smallest subset that must be trusted, not the entire OS or the applications running on it. Physical facilities and backup systems are outside this definition.

Question 49Security Architecture and Design

Which protection ring model places the operating system kernel in the most privileged ring and user applications in the least privileged ring?

  1. Rings are ordered only by process priority, not by privilege
  2. Ring 0 is least privileged and ring 3 is most privileged
  3. Ring 3 is most privileged and ring 0 is least privileged
  4. Ring 0 is most privileged and higher-numbered rings are progressively less privileged Correct answer.

Explanation

In the ring protection architecture, ring 0 is the innermost and most privileged level, where the kernel typically executes, and increasing ring numbers represent decreasing privilege. User applications normally run in the outermost ring (ring 3 on x86). This layering enforces isolation between the kernel and user code.

Question 50Security Architecture and Design

An architect is evaluating a system that must prevent a process from reading memory belonging to another process. Which design principle most directly supports this?

  1. Process isolation through separate address spaces Correct answer.
  2. Disabling memory protection to improve performance
  3. Granting every process kernel-level privileges
  4. Storing all processes in a single shared address space

Explanation

Process isolation via separate virtual address spaces prevents one process from directly reading another's memory, since the hardware enforces address translation boundaries. Shared address spaces, kernel privileges for all processes, and disabled memory protection all remove those boundaries. Isolation is a foundational architectural principle for confinement.