I85PREP
⌘ K
GIP Professional Exam study materials
GIP Professional Exam study resources

GIP Professional Exam practice questions

One question at a time. Build your GIP Professional Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk, and Compliance

In an information security governance framework, what is the primary purpose of a charter for the information security program?

  1. To document the step-by-step procedures for restoring backups
  2. To record the results of the most recent penetration test
  3. To list the technical controls that must be configured on every server
  4. To define the program's authority, scope, and reporting lines so accountability is clear Correct answer.

Explanation

A program charter is a governance instrument that establishes mandate, scope, ownership, and reporting relationships so that security accountability is unambiguous. It operates at the strategic level and does not prescribe operational procedures or control configurations, which belong to standards and runbooks.

Question 2Governance, Risk, and Compliance

Which document type typically sits directly below a policy in the governance documentation hierarchy and translates policy statements into specific, mandatory requirements?

  1. A standard Correct answer.
  2. A project post-implementation review
  3. A board resolution
  4. A risk appetite statement

Explanation

Standards translate high-level policy intent into specific mandatory requirements, such as approved cryptographic algorithms or password length. They are binding within the organization and are supported in turn by procedures and guidelines that describe how to comply.

Question 3Governance, Risk, and Compliance

A risk practitioner is estimating the potential loss from a threat event before considering any controls. Which term best describes this estimate?

  1. Control effectiveness
  2. Residual risk
  3. Inherent risk Correct answer.
  4. Risk tolerance

Explanation

Inherent risk is the exposure that exists before controls are applied, providing a baseline for comparing the value of mitigation. Residual risk is what remains after controls, and the gap between the two indicates how much risk treatment actually reduces.

Question 4Governance, Risk, and Compliance

Which risk treatment option involves transferring financial consequences to a third party while the organization retains operational responsibility for the activity?

  1. Accepting the risk without any action
  2. Removing the underlying business process
  3. Applying an additional technical control
  4. Purchasing cyber insurance Correct answer.

Explanation

Insurance transfers the financial impact of an event to an insurer, while the organization still owns and must manage the operational risk. Transfer shifts economic consequences but never eliminates accountability for the underlying exposure.

Question 5Governance, Risk, and Compliance

Under a typical privacy regulation, which party determines the purposes and means of processing personal data?

  1. The supervisory authority
  2. The data controller Correct answer.
  3. The data subject
  4. The data processor

Explanation

The controller decides why and how personal data is processed and therefore carries the primary legal obligations and accountability. Processors act on the controller's documented instructions, while subjects are the individuals whose data is processed.

Question 6Governance, Risk, and Compliance

What distinguishes a compliance obligation that is 'mandatory' from one that is 'contractual' in a compliance register?

  1. Mandatory obligations are enforced only by auditors, while contractual ones are enforced only by courts
  2. Mandatory obligations are optional best practices, while contractual ones are always legally binding
  3. Mandatory obligations apply only to public companies, while contractual ones apply to all firms
  4. Mandatory obligations arise from law or regulation, while contractual ones arise from agreements with other parties Correct answer.

Explanation

The source of the obligation is the distinguishing factor: mandatory requirements flow from statutes, regulations, or regulators, whereas contractual requirements flow from negotiated agreements. Both are binding, but they differ in origin, enforcement route, and how they are tracked.

Question 7Governance, Risk, and Compliance

Which activity best exemplifies a detective control in a governance, risk, and compliance program?

  1. Reviewing access logs monthly to identify unauthorized privilege changes Correct answer.
  2. Requiring managers to approve access requests before provisioning
  3. Encrypting data at rest on database servers
  4. Publishing an acceptable use policy to all staff

Explanation

Detective controls identify and report events after or while they occur, and log review is a classic example because it surfaces unauthorized changes. Preventive controls stop events before they happen, and directive controls guide behavior through policy.

Question 8Governance, Risk, and Compliance

In a typical three lines model for governance, which group provides independent assurance to the board over risk management and controls?

  1. The operational business units that own the risk
  2. Internal audit Correct answer.
  3. The risk and compliance function that monitors the first line
  4. The external legal counsel retained by the organization

Explanation

Internal audit forms the third line and provides independent, objective assurance to the governing body on the effectiveness of risk management and controls. The first line owns and manages risk, while the second line provides oversight, monitoring, and challenge.

Question 9Governance, Risk, and Compliance

A risk register entry shows a likelihood of 4 and an impact of 5 on a 1-to-5 scale. Using a simple multiplicative scoring method, what is the risk score?

  1. 45
  2. 1.25
  3. 9
  4. 20 Correct answer.

Explanation

A multiplicative risk score multiplies likelihood by impact, so 4 times 5 equals 20. This score is then compared against risk appetite thresholds to determine whether treatment is required and at what priority.

Question 10Governance, Risk, and Compliance

An organization defines its risk appetite as 'low' for customer data confidentiality but 'moderate' for internal productivity tools. Which statement best reflects how this appetite should be applied?

  1. Risk appetite applies only to financial risks, so neither statement affects control design
  2. All systems should receive identical controls because appetite applies uniformly across the enterprise
  3. Internal productivity tools should receive stricter controls because they are used more often
  4. Controls protecting customer data should be stricter than those for internal productivity tools Correct answer.

Explanation

Risk appetite can be expressed at different levels for different risk categories, and control rigor should be proportionate to the stated appetite. A low appetite for confidentiality of customer data justifies stronger safeguards than a moderate appetite for productivity tools.

Question 11Governance, Risk, and Compliance

A vendor that processes regulated personal data on the organization's behalf is being assessed. Which governance artifact most directly establishes the vendor's data protection obligations?

  1. The vendor's public marketing brochure describing its security features
  2. The vendor's own internal audit report summarizing its financial controls
  3. The organization's internal acceptable use policy for employees
  4. A data processing agreement that specifies permitted purposes, safeguards, and breach notification duties Correct answer.

Explanation

A data processing agreement contractually binds the processor to defined purposes, security measures, sub-processor rules, and notification timelines. It is the primary governance mechanism that makes the vendor's privacy obligations enforceable.

Question 12Governance, Risk, and Compliance

During a compliance gap assessment, a control is found to be designed appropriately but operating inconsistently across regions. What is the most appropriate classification of this finding?

  1. An operating effectiveness deficiency rather than a design deficiency Correct answer.
  2. A false positive that should be excluded from the assessment
  3. A scope limitation that invalidates the entire assessment
  4. A design deficiency requiring a new control to be created

Explanation

Design effectiveness asks whether a control, as documented, can achieve the objective, while operating effectiveness asks whether it actually works in practice. Inconsistent execution across regions is an operating effectiveness issue even though the design is sound.

Question 13Governance, Risk, and Compliance

To demonstrate that an access review control operated throughout the year, which evidence is most persuasive to an assessor?

  1. A narrative statement in the policy that access reviews occur quarterly
  2. An email from the IT manager stating that reviews are generally completed
  3. A screenshot of the access review tool's configuration settings
  4. Dated review records with reviewer sign-off and documented actions for exceptions across the period Correct answer.

Explanation

Operating effectiveness is best evidenced by contemporaneous, dated records showing that the control ran each period and that exceptions were resolved. Policy statements and configuration screenshots show intent or design but not actual execution.

Question 14Governance, Risk, and Compliance

A security team identifies a critical vulnerability in an internet-facing system. The organization's risk response is to apply an emergency patch within 48 hours. Which risk treatment approach does this represent?

  1. Transfer
  2. Avoidance
  3. Acceptance
  4. Mitigation Correct answer.

Explanation

Applying a patch reduces the likelihood of exploitation, which is risk mitigation. Avoidance would eliminate the activity, acceptance would retain the exposure, and transfer would shift financial consequences to another party.

Question 15Governance, Risk, and Compliance

An organization must demonstrate compliance with a new regulatory requirement but lacks the internal expertise to interpret it. What is the most appropriate first governance step?

  1. Perform a regulatory obligation mapping to identify applicable requirements and assign accountable owners Correct answer.
  2. Immediately purchase a new security tool marketed as compliant
  3. Delegate the entire requirement to the IT department without further oversight
  4. Wait for the regulator to issue enforcement guidance before taking any action

Explanation

Obligation mapping translates regulatory text into specific requirements, owners, and control expectations, which is the foundation for any compliance program. Buying tools or waiting for enforcement skips the analysis needed to know what compliance actually requires.

Question 16Governance, Risk, and Compliance

Which metric best indicates whether a security awareness program is changing behavior rather than merely reaching employees?

  1. The number of pages in the awareness policy document
  2. The number of employees who received the annual awareness email
  3. The total budget spent on awareness training materials
  4. The rate at which employees report suspected phishing emails over time Correct answer.

Explanation

Behavioral metrics such as phishing reporting rates and simulated click-through trends reveal whether employees act differently. Reach and spend metrics show activity and input, not whether behavior has changed.

Question 17Governance, Risk, and Compliance

A key risk indicator (KRI) is being designed for third-party risk. Which characteristic makes it most useful for governance reporting?

  1. It captures every possible vendor attribute in a single dashboard
  2. It is updated only once per year to reduce reporting effort
  3. It is chosen because it is easy to collect rather than because it reflects risk
  4. It is measurable, tied to a defined threshold, and predictive of increasing exposure Correct answer.

Explanation

A useful KRI is quantifiable, linked to thresholds that trigger action, and forward-looking enough to signal rising exposure. Convenience or completeness alone does not make an indicator meaningful for decision-making.

Question 18Governance, Risk, and Compliance

An organization is deciding whether to accept a residual risk that exceeds its stated appetite. Who should formally authorize this exception?

  1. The vendor whose product is involved in the risk
  2. The individual security analyst who identified the risk
  3. The internal audit team that assessed the control
  4. The accountable executive at a level with authority to accept risk on behalf of the organization Correct answer.

Explanation

Risk acceptance must be authorized by someone with delegated authority and accountability at the appropriate level, often an executive or risk committee. Analysts identify risk, auditors provide assurance, and vendors have no authority to accept the organization's risk.

Question 19Governance, Risk, and Compliance

Which statement best describes the relationship between policies and procedures in a GRC framework?

  1. Procedures are optional guidance, while policies are only advisory recommendations
  2. Procedures state mandatory principles, while policies describe the technical configuration details
  3. Policies state mandatory principles and intent, while procedures describe the step-by-step actions to fulfill them Correct answer.
  4. Policies and procedures are interchangeable and differ only in document length

Explanation

Policies establish mandatory principles and management intent, and procedures operationalize them through defined steps and responsibilities. Keeping the two distinct prevents policy from becoming overly detailed and keeps procedures aligned with intent.

Question 20Governance, Risk, and Compliance

A data protection impact assessment is being scoped for a new analytics platform. What is the most important governance outcome of this assessment?

  1. A marketing statement that can be published to reassure customers
  2. A guarantee that the platform will never experience a data breach
  3. A replacement for the organization's broader enterprise risk register
  4. A documented evaluation of privacy risks and the mitigations required before processing begins Correct answer.

Explanation

A DPIA documents the privacy risks of a processing activity and the measures needed to mitigate them, supporting accountable decision-making before launch. It informs, but does not replace, the enterprise risk register and cannot guarantee outcomes.

Question 21Governance, Risk, and Compliance

In a maturity model assessment, an organization has documented processes but they are applied inconsistently and depend on individual effort. Which maturity level does this most closely reflect?

  1. An initial level, where no processes exist at all
  2. A repeatable but not yet defined level, where practices exist but are not standardized Correct answer.
  3. A managed level, where processes are measured and controlled across the enterprise
  4. An optimized level, where processes are continuously improved using quantitative data

Explanation

When practices exist but rely on individuals and vary between teams, the organization is at a repeatable stage that lacks standardization. Defined and managed levels require documented, consistently applied, and measured processes across the enterprise.

Question 22Governance, Risk, and Compliance

A regulator requests evidence of board-level oversight of cybersecurity risk. Which artifact most directly demonstrates this governance responsibility?

  1. The firewall rule base for the corporate network
  2. The help desk ticket volume for password resets
  3. Board or committee minutes showing review of cyber risk reports and decisions on risk appetite Correct answer.
  4. The list of vulnerabilities remediated in the last quarter

Explanation

Board-level oversight is evidenced by minutes showing that the governing body received cyber risk information and made decisions such as approving appetite or directing treatment. Technical artifacts show operational activity but not governance engagement.

Question 23Governance, Risk, and Compliance

An organization operates in multiple jurisdictions with conflicting data localization requirements. What is the most sound governance approach to resolving the conflict?

  1. Apply the least restrictive jurisdiction's rules everywhere to minimize cost
  2. Ignore the conflict and rely on the vendor to determine compliance
  3. Map each obligation by jurisdiction and design controls that satisfy the strictest applicable requirement where feasible Correct answer.
  4. Suspend all processing until every jurisdiction harmonizes its laws

Explanation

Obligation mapping by jurisdiction lets the organization identify conflicts and design controls that meet the strictest requirement where a single approach is feasible. Applying the weakest rule or deferring to a vendor leaves the organization exposed to enforcement in stricter jurisdictions.

Question 24Governance, Risk, and Compliance

A control self-assessment produces results that consistently rate controls as effective, yet internal audit finds significant deficiencies. What is the most likely governance weakness?

  1. The control environment is functioning better than the audit indicates
  2. The organization has too many controls and should remove several
  3. The audit team applied overly lenient testing standards
  4. The self-assessment lacks independence and objective criteria, producing optimistic ratings Correct answer.

Explanation

When self-assessments diverge sharply from independent audit findings, the likely cause is a lack of objectivity, unclear criteria, or incentives that favor favorable ratings. Strengthening independence and evidence standards is the appropriate governance response.

Question 25Governance, Risk, and Compliance

An executive argues that because a risk has low likelihood, it should be excluded from the risk register entirely. What is the most defensible governance response?

  1. Remove the risk permanently because low-likelihood events never materialize
  2. Record the risk only after it has occurred to avoid cluttering the register
  3. Retain the risk with its assessed likelihood and impact so that changes in conditions can be monitored Correct answer.
  4. Transfer the risk to the internal audit team to own and manage

Explanation

Risk registers should retain low-likelihood risks, especially high-impact ones, because likelihood can change and monitoring supports early response. Removing them or waiting for occurrence eliminates the foresight the register is meant to provide.

Question 26Governance, Risk, and Compliance

In a GRC program, which term describes the maximum level of risk an organization is willing to accept in pursuit of its objectives, before any mitigation is applied?

  1. Risk appetite Correct answer.
  2. Risk tolerance
  3. Risk capacity
  4. Risk threshold

Explanation

Risk appetite is the broad, high-level statement of how much risk the organization is willing to accept in pursuit of its objectives. It is set by senior leadership and guides the development of more granular risk limits. Tolerance and thresholds are derived from appetite and define acceptable variation around specific objectives.

Question 27Governance, Risk, and Compliance

A compliance manager is mapping a new regulation to internal controls. Which artifact best provides a structured cross-reference between regulatory requirements and the controls that satisfy them?

  1. A policy library
  2. A control matrix Correct answer.
  3. An audit trail
  4. A risk register

Explanation

A control matrix explicitly maps each requirement or risk to the specific controls that address it, showing coverage and gaps. It is the primary tool for demonstrating traceability between obligations and controls. A risk register records risks and treatments but does not inherently map to regulatory clauses.

Question 28Governance, Risk, and Compliance

Which statement best describes the purpose of a risk treatment plan within a GRC framework?

  1. It records the residual risk that remains after controls are applied.
  2. It documents the selected response to a risk and the actions, owners, and timelines for implementation. Correct answer.
  3. It lists all identified risks with their inherent likelihood and impact scores.
  4. It defines the organization's overall risk appetite statement.

Explanation

A risk treatment plan translates a chosen risk response (mitigate, transfer, avoid, or accept) into concrete actions with assigned owners and deadlines. It is an action-oriented artifact that drives implementation and accountability. The risk register, by contrast, is the inventory of risks and scores.

Question 29Governance, Risk, and Compliance

An organization is establishing a governance structure for its GRC program. Which body typically has ultimate accountability for the effectiveness of the risk management framework?

  1. The external auditor
  2. The board of directors or a board-level risk committee Correct answer.
  3. The internal audit function
  4. The chief information security officer

Explanation

Ultimate accountability for the risk management framework rests with the board, often through a dedicated risk or audit committee. The board sets risk appetite and oversees management's implementation. Internal audit provides independent assurance but does not own the framework.

Question 30Governance, Risk, and Compliance

A risk practitioner is assessing a risk that has a likelihood of 3 and an impact of 4 on a 1-to-5 scale. Using a simple multiplicative scoring method, what is the risk score?

  1. 12 Correct answer.
  2. 1.33
  3. 7
  4. 34

Explanation

A simple multiplicative risk score is calculated by multiplying likelihood by impact: 3 × 4 = 12. This score is then compared against risk appetite thresholds to determine the appropriate response. Additive or ratio methods would produce different values but are not the multiplicative method described.

Question 31Governance, Risk, and Compliance

A financial services firm must comply with a new data retention regulation. The compliance team has identified the requirement but needs to determine which business processes and systems are affected. Which activity should be performed first?

  1. Implement a new data loss prevention tool across all endpoints.
  2. Update the enterprise risk register with the new regulation as a risk.
  3. Request a temporary waiver from the regulator.
  4. Conduct a business impact analysis to identify affected processes and systems. Correct answer.

Explanation

Before designing controls, the organization must understand where the regulated data resides and which processes and systems are in scope. A business impact analysis or data flow mapping identifies those dependencies. Tool implementation and risk register updates should follow a clear scoping exercise.

Question 32Governance, Risk, and Compliance

An organization is evaluating a third-party vendor that will process sensitive customer data. Which governance artifact should be used to define the minimum security and privacy requirements the vendor must meet?

  1. A service level agreement (SLA)
  2. A master services agreement (MSA)
  3. A statement of work (SOW)
  4. A vendor risk assessment questionnaire Correct answer.

Explanation

A vendor risk assessment questionnaire is designed to evaluate the vendor's security and privacy controls against the organization's requirements. It provides a structured way to identify gaps before contracting. SLAs, MSAs, and SOWs are contractual documents that may reference requirements but do not themselves define the minimum security standards.

Question 33Governance, Risk, and Compliance

A compliance officer is designing a control to ensure that user access is revoked promptly when employees leave the organization. Which control type and timing best describes this control?

  1. Preventive, before-the-fact control Correct answer.
  2. Directive, before-the-fact control
  3. Detective, after-the-fact control
  4. Corrective, after-the-fact control

Explanation

Revoking access upon termination is a preventive control because it stops unauthorized access before it can occur. It is applied at the time of termination, which is before any potential misuse. Detective controls would identify access after the fact, and corrective controls would remediate after an incident.

Question 34Governance, Risk, and Compliance

An organization's risk appetite statement specifies a low tolerance for regulatory non-compliance. A business unit proposes a project that would introduce a new processing activity with uncertain regulatory implications. What is the most appropriate governance action?

  1. Require a compliance impact assessment before project approval. Correct answer.
  2. Escalate the decision to the board immediately.
  3. Delegate the decision to the business unit manager.
  4. Approve the project because the risk is uncertain.

Explanation

Given the low tolerance for regulatory non-compliance, the organization should assess the regulatory implications before committing resources. A compliance impact assessment provides the information needed to make a risk-informed decision. Immediate board escalation is premature without an assessment.

Question 35Governance, Risk, and Compliance

A GRC team is implementing a continuous monitoring program for compliance controls. Which characteristic is most important for the monitoring metrics to be useful to management?

  1. They are collected using the most advanced technology available.
  2. They are aligned with key risk indicators and actionable thresholds. Correct answer.
  3. They are reported only annually to reduce noise.
  4. They are kept confidential from business units.

Explanation

Monitoring metrics are most useful when they are linked to key risks and have defined thresholds that trigger action. This alignment ensures that management attention is directed to meaningful deviations. Technology choice, reporting frequency, and confidentiality are secondary considerations.

Question 36Governance, Risk, and Compliance

An organization identifies a risk that exceeds its risk appetite. Management decides to transfer the risk through insurance. Which statement best describes the residual risk after this treatment?

  1. Residual risk may still exist for losses not covered by the insurance policy. Correct answer.
  2. Residual risk is unchanged because transfer does not affect likelihood or impact.
  3. Residual risk is eliminated because the risk has been transferred.
  4. Residual risk increases because insurance introduces new risks.

Explanation

Risk transfer through insurance shifts some financial consequences but does not eliminate the risk entirely. Residual risk remains for deductibles, exclusions, and uninsured losses. Therefore, the organization must still monitor and manage the retained portion.

Question 37Governance, Risk, and Compliance

A global organization must comply with conflicting data protection laws in two jurisdictions. Which approach best demonstrates good governance in resolving the conflict?

  1. Apply the law of the country where the data originates only.
  2. Conduct a legal and regulatory analysis to determine the strictest applicable requirements and document the rationale. Correct answer.
  3. Seek a waiver from one regulator without analysis.
  4. Adopt a single global policy that ignores local legal differences.

Explanation

When laws conflict, a documented analysis identifies the strictest requirements and the rationale for the chosen approach, demonstrating due diligence. This supports accountability and defensibility with regulators. Ignoring differences or seeking waivers without analysis increases compliance risk.

Question 38Governance, Risk, and Compliance

An internal audit finds that a key compliance control has been operating effectively for the past year, but the control design is flawed and does not fully address the regulatory requirement. What is the most appropriate conclusion?

  1. The control is not effective because design flaws limit its ability to mitigate the risk. Correct answer.
  2. The control is effective because it operated as designed throughout the period.
  3. The control is effective because internal audit found no operating exceptions.
  4. The control is ineffective only if a regulatory penalty occurs.

Explanation

Control effectiveness requires both appropriate design and consistent operation. A design flaw means the control cannot fully mitigate the risk even if it operates as intended. Therefore, the control should be assessed as ineffective and redesigned.

Question 39Governance, Risk, and Compliance

A risk committee is reviewing a risk register that contains only risks with high likelihood and high impact. The committee chair notes that low-likelihood, high-impact risks are missing. What is the most likely consequence of this omission?

  1. The organization will save resources by not monitoring unlikely events.
  2. The risk appetite statement will automatically adjust to exclude these risks.
  3. The organization may be unprepared for catastrophic events that could threaten its viability. Correct answer.
  4. The risk register will be more accurate because low-likelihood risks are irrelevant.

Explanation

Low-likelihood, high-impact risks (tail risks) can have severe consequences and must be identified and assessed even if they are unlikely. Omitting them leaves the organization exposed to catastrophic events without mitigation or contingency planning. A complete risk register should capture risks across the likelihood-impact spectrum.

Question 40Governance, Risk, and Compliance

An organization is adopting a new GRC platform. The project team proposes to migrate all existing risk data without cleansing or reconciliation. What is the most significant governance risk of this approach?

  1. Users will require additional training on the new platform.
  2. The migration will take longer than expected.
  3. The platform may not support all desired features.
  4. Inaccurate or inconsistent data may lead to flawed risk decisions and reporting. Correct answer.

Explanation

Migrating uncleansed data propagates errors and inconsistencies into the new system, undermining the reliability of risk reporting and decisions. Data quality is a foundational governance concern for any GRC platform. Training and feature gaps are secondary to the integrity of risk data.

Question 41Information Security Fundamentals

In an information security context, what does the CIA triad primarily describe?

  1. The three core goals used to evaluate the protection of information assets Correct answer.
  2. The three mandatory encryption algorithms for regulated data
  3. The three phases of a penetration test lifecycle
  4. The three tiers of a data backup rotation schedule

Explanation

The CIA triad names confidentiality, integrity, and availability as the fundamental security objectives for information. Controls and risk decisions are judged against how well they preserve these three properties. Encryption, testing, and backup are mechanisms that may support one or more of them, not the triad itself.

Question 42Information Security Fundamentals

Which principle states that a user should be granted only the access necessary to perform their current job duties?

  1. Mandatory access control
  2. Defense in depth
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits each account to the minimum rights needed for its assigned tasks, reducing the blast radius of misuse or compromise. Separation of duties instead splits conflicting tasks across people, while defense in depth layers controls and mandatory access control is a policy enforcement model.

Question 43Information Security Fundamentals

A security team wants to prove that a downloaded firmware image has not been altered since the vendor published it. Which mechanism directly provides that assurance?

  1. Requiring multifactor authentication to reach the download page
  2. Comparing a computed hash against the vendor's published digest Correct answer.
  3. Encrypting the image with the vendor's public key
  4. Compressing the image with a proprietary archive format

Explanation

A cryptographic hash is a fixed-length fingerprint of the file contents, so any change produces a different digest. Comparing the locally computed hash with the vendor's published value detects modification. Encryption with a public key is not how signing works, and compression or MFA does not verify file integrity.

Question 44Information Security Fundamentals

What distinguishes a virus from a worm in malware classification?

  1. A virus only affects mobile devices, while a worm only affects servers
  2. A virus is always written in scripting languages, while a worm is always compiled
  3. A virus encrypts data for ransom, while a worm exfiltrates credentials
  4. A virus requires a host file or user action to propagate, while a worm spreads across networks on its own Correct answer.

Explanation

The classic distinction is propagation: viruses attach to files or boot sectors and typically need execution by a user, whereas worms self-replicate through network connections without a host program. Ransomware and credential theft are behaviors that either type can exhibit.

Question 45Information Security Fundamentals

Which activity best describes a phishing attack?

  1. Flooding a target with traffic until services become unavailable
  2. Intercepting and modifying traffic between two hosts on the same LAN
  3. Sending deceptive messages that impersonate a trusted party to harvest credentials or trigger action Correct answer.
  4. Guessing passwords by trying every combination of characters

Explanation

Phishing relies on social engineering: a message impersonates a trusted entity so the recipient reveals information or performs an unsafe action. Traffic flooding is denial of service, LAN interception is a man-in-the-middle technique, and exhaustive guessing is brute force.

Question 46Information Security Fundamentals

In risk management, what is the residual risk after a control has been implemented?

  1. The likelihood that the control itself fails during an audit
  2. The risk that remains after the control is applied Correct answer.
  3. The total risk before any controls exist
  4. The cost of purchasing the control

Explanation

Residual risk is the exposure left over once safeguards are in place, and management must decide whether to accept it. Inherent risk is the exposure before controls, which is a different measure. Control cost and audit findings are inputs to risk decisions, not the definition of residual risk.

Question 47Information Security Fundamentals

Which of the following is the strongest example of an authentication factor in the "something you have" category?

  1. A hardware security key Correct answer.
  2. A memorized passphrase
  3. A user's office location
  4. A fingerprint

Explanation

"Something you have" refers to a physical token the user possesses, such as a hardware security key or smart card. Passphrases are knowledge factors, fingerprints are inherence factors, and location is a contextual attribute rather than one of the standard authentication factors.

Question 48Information Security Fundamentals

What is the primary purpose of a security awareness training program?

  1. To certify that all employees have read the acceptable use policy
  2. To reduce human-related risk by helping staff recognize and respond to threats Correct answer.
  3. To replace technical controls such as email filtering
  4. To transfer legal liability for incidents from the organization to employees

Explanation

Awareness programs aim to change behavior so people can spot phishing, handle data correctly, and report incidents, which lowers human-related risk. Reading acknowledgements, liability shifting, and replacing technical controls are not the program's purpose, and technical controls remain necessary alongside training.

Question 49Information Security Fundamentals

A company stores customer records in a database and must ensure that only the application service account can read the credit card column, while analysts can read other columns. Which access control model most directly supports per-column restrictions based on role?

  1. Role-based access control with column-level privileges Correct answer.
  2. Rule-based access control using time-of-day conditions
  3. Discretionary access control based on file ownership
  4. Mandatory access control using sensitivity labels

Explanation

Role-based access control assigns permissions to roles and then maps users to roles, and database systems can apply those grants at the column level. Discretionary ownership, time-based rules, and label-based mandatory controls do not map as directly to job-role-driven column restrictions.

Question 50Information Security Fundamentals

Why is a salt added to each password before hashing in a credential store?

  1. To make identical passwords produce different stored hashes and defeat precomputed tables Correct answer.
  2. To shorten the hash output so storage costs decrease
  3. To encrypt the password so it can be recovered by administrators
  4. To allow users to reuse the same password across systems

Explanation

A unique salt per password ensures two users with the same password get different hashes, which blocks rainbow tables and forces attackers to attack each hash separately. Salting does not make hashes reversible, does not shorten them, and has no relation to password reuse policy.