I85PREP
⌘ K
SCLE Module 17 study materials
SCLE Module 17 study resources

SCLE Module 17 practice questions

One question at a time. Build your SCLE Module 17 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundational Concepts and Terminology

In secure coding terminology, what distinguishes a vulnerability from an exploit?

  1. A vulnerability is an attacker's motive, while an exploit is the financial damage that results.
  2. A vulnerability is a weakness in a system, while an exploit is a technique or code that takes advantage of it. Correct answer.
  3. A vulnerability is a piece of malware, while an exploit is the payload it delivers to a host.
  4. A vulnerability is a monitoring alert, while an exploit is the log entry that triggered it.

Explanation

A vulnerability is an inherent weakness such as a coding flaw or misconfiguration, whereas an exploit is the concrete means used to abuse that weakness. The two are related but distinct: a vulnerability can exist without any exploit ever being written.

Question 2Foundational Concepts and Terminology

Which term describes the principle that a program should grant a user or process only the access needed to perform its task?

  1. Fail-safe defaults
  2. Separation of duties
  3. Least privilege Correct answer.
  4. Defense in depth

Explanation

Least privilege limits each subject to the minimum permissions required for its function, reducing the blast radius of a compromise. Defense in depth, fail-safe defaults, and separation of duties are related but distinct security principles.

Question 3Foundational Concepts and Terminology

In threat modeling, what does the term 'attack surface' refer to?

  1. The total set of points where an unauthorized user can try to enter or extract data from a system. Correct answer.
  2. The list of known attackers who have previously targeted the organization.
  3. The physical perimeter of the data center that houses production servers.
  4. The collection of patches that have not yet been applied to production.

Explanation

Attack surface is the sum of all exposed entry and exit points, such as interfaces, inputs, and services, that an adversary could attempt to abuse. Reducing the attack surface means removing or hardening those points rather than tracking people or patch backlogs.

Question 4Foundational Concepts and Terminology

Which pair correctly matches a threat with a corresponding vulnerability?

  1. A threat is a fixed coding error, while a vulnerability is the person who discovers it.
  2. A threat is a compliance requirement, while a vulnerability is the audit finding it produces.
  3. A threat is a firewall rule, while a vulnerability is the port that the rule blocks.
  4. A threat is a potential cause of harm, while a vulnerability is a condition that could be exploited by that threat. Correct answer.

Explanation

In risk terminology a threat is any potential source of harm, such as an attacker or a natural event, and a vulnerability is a weakness that a threat could act upon. Risk arises when a threat can realistically exploit a vulnerability.

Question 5Foundational Concepts and Terminology

What does the acronym CVE identify in security terminology?

  1. A certification exam for security professionals.
  2. A catalog of publicly disclosed cybersecurity vulnerabilities, each assigned a unique identifier. Correct answer.
  3. A protocol for encrypting traffic between web servers.
  4. A framework for classifying data sensitivity levels.

Explanation

CVE stands for Common Vulnerabilities and Exposures and provides standardized identifiers so that a specific vulnerability can be referenced consistently across tools and vendors. It is not a certification, a data classification scheme, or an encryption protocol.

Question 6Foundational Concepts and Terminology

Which term describes a security control that verifies identity before access is granted?

  1. Authentication Correct answer.
  2. Authorization
  3. Attestation
  4. Accounting

Explanation

Authentication establishes and verifies who a subject claims to be, using factors such as passwords, tokens, or biometrics. Authorization then decides what that authenticated subject may do.

Question 7Foundational Concepts and Terminology

In secure design, what does 'fail-safe' or 'fail-closed' behavior mean for an access control check?

  1. When the check cannot complete, access is denied by default. Correct answer.
  2. When the check cannot complete, access is granted to preserve availability.
  3. When the check fails, the system reboots to restore a clean state.
  4. When the check fails, an alert is sent but access continues as before.

Explanation

Fail-safe or fail-closed design ensures that an error in a security decision results in denial rather than exposure. This prevents attackers from bypassing controls by forcing the check into an error state.

Question 8Foundational Concepts and Terminology

What is the primary meaning of 'input validation' as a foundational security concept?

  1. Recording every user action in an immutable audit log.
  2. Checking that data received by an application conforms to expected type, format, and range before use. Correct answer.
  3. Assigning roles to users so they can access only their own records.
  4. Encrypting all data before it is written to a database.

Explanation

Input validation verifies that untrusted data matches expected constraints, such as type, length, and allowed characters, before the application processes it. This blocks malformed or malicious input from reaching sensitive logic.

Question 9Foundational Concepts and Terminology

A developer stores a password using a fast general-purpose hash such as SHA-256 with no salt. Which terminology best identifies the resulting weakness?

  1. The design relies on security through obscurity by hiding the algorithm.
  2. The design violates the principle of separation of duties among administrators.
  3. The design lacks a memory-hard password hashing function and per-user salt, enabling offline cracking and rainbow-table attacks. Correct answer.
  4. The design uses symmetric encryption where asymmetric encryption is required.

Explanation

Password storage requires a slow, salted, memory-hard function such as Argon2, bcrypt, or scrypt, so that offline guessing and precomputed tables are impractical. A fast unsalted hash makes identical passwords recognizable and cheap to crack.

Question 10Foundational Concepts and Terminology

Which statement best captures the difference between a vulnerability and a risk?

  1. A vulnerability applies to software, while risk applies exclusively to physical facilities.
  2. A vulnerability is a measured quantity, while risk is a qualitative opinion with no relation to likelihood.
  3. A vulnerability exists only after exploitation, while risk exists only before exploitation.
  4. A vulnerability is a weakness, while risk expresses the likelihood and impact of that weakness being exploited. Correct answer.

Explanation

A vulnerability is a concrete weakness, whereas risk combines the probability of a threat exploiting it with the resulting business impact. Two identical vulnerabilities can carry different risk depending on exposure and asset value.

Question 11Foundational Concepts and Terminology

In threat modeling, what does STRIDE categorize?

  1. Stages of the software development lifecycle.
  2. Categories of cryptographic key lengths.
  3. Types of threats such as spoofing, tampering, and repudiation. Correct answer.
  4. Levels of data classification from public to top secret.

Explanation

STRIDE is a threat classification scheme covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. It helps teams enumerate the kinds of threats a component may face.

Question 12Foundational Concepts and Terminology

What does 'defense in depth' prescribe for a security architecture?

  1. Relying on a single strong perimeter firewall for all protection.
  2. Layering independent controls so that failure of one does not leave the asset unprotected. Correct answer.
  3. Removing redundant controls to simplify incident response.
  4. Encrypting data only at the perimeter and not at rest.

Explanation

Defense in depth uses multiple overlapping and independent controls across layers, so that a single bypass or failure does not expose the asset. It explicitly rejects single points of security failure.

Question 13Foundational Concepts and Terminology

Which term describes untrusted data that is interpreted as code by an interpreter, such as SQL or a shell?

  1. Redirection
  2. Injection Correct answer.
  3. Serialization
  4. Reflection

Explanation

Injection occurs when untrusted input is concatenated into a command or query and the interpreter executes it as code. Parameterized queries and strict input handling are the standard mitigations.

Question 14Foundational Concepts and Terminology

What is the meaning of 'zero trust' as a foundational security model?

  1. All internal traffic is encrypted but otherwise treated as fully trusted.
  2. Trust is established once at login and then persists for the session.
  3. All users are denied access permanently until a manual exception is approved.
  4. No subject is implicitly trusted based on network location; every access request is continuously verified. Correct answer.

Explanation

Zero trust removes implicit trust based on being inside a network and requires explicit, continuous verification of identity and context for each access. It is not blanket denial, nor is it one-time authentication followed by implicit trust.

Question 15Foundational Concepts and Terminology

A team labels a finding 'false positive' during triage. What does this mean in vulnerability management terminology?

  1. The finding was confirmed and requires immediate patching.
  2. The finding is a duplicate of another confirmed issue.
  3. The finding affects only test environments and is therefore valid.
  4. The scanner reported an issue that does not actually exist or is not exploitable in this context. Correct answer.

Explanation

A false positive is a reported issue that is not a genuine vulnerability in the given context, for example due to compensating controls or inaccurate detection. It is distinct from a duplicate or a confirmed true positive.

Question 16Foundational Concepts and Terminology

Which concept explains why a system should not make security decisions based on client-supplied values such as hidden form fields?

  1. Trust boundaries apply only to network packets, not to application data.
  2. Hidden fields are protected by the browser and cannot be modified by users.
  3. Trust boundaries require that data crossing from an untrusted to a trusted zone be validated and not assumed trustworthy. Correct answer.
  4. Client-side values are always encrypted and therefore cannot be altered.

Explanation

A trust boundary separates zones of differing trust, and data crossing it must be validated rather than trusted. Values in hidden fields or client storage are fully attacker-controlled, so server-side checks are mandatory.

Question 17Foundational Concepts and Terminology

What distinguishes 'authorization' from 'access control' in precise usage?

  1. Authorization and access control are unrelated concepts with no dependency.
  2. Authorization applies only to humans, while access control applies only to services.
  3. Authorization is the decision about what a subject may do, while access control is the mechanism that enforces that decision. Correct answer.
  4. Authorization is enforced by the operating system, while access control is enforced only by applications.

Explanation

Authorization is the policy decision that defines permitted actions for a subject, and access control is the enforcement machinery, such as ACLs or policy engines, that applies the decision. The decision and its enforcement are complementary.

Question 18Foundational Concepts and Terminology

In risk terminology, what is 'residual risk'?

  1. The risk that remains after existing controls have been applied. Correct answer.
  2. The risk that has been formally accepted without any analysis.
  3. The risk present before any controls are considered.
  4. The risk transferred entirely to a third party through insurance.

Explanation

Residual risk is what remains once mitigating controls are in place, and it must be compared against the organization's risk appetite. Inherent risk, by contrast, is assessed before controls.

Question 19Foundational Concepts and Terminology

What does 'sandboxing' mean as a containment concept?

  1. Testing code exclusively in production to observe real user behavior.
  2. Encrypting an application's database with a hardware security module.
  3. Running untrusted code in an isolated environment with restricted access to system resources. Correct answer.
  4. Granting an application full administrative rights to simplify deployment.

Explanation

Sandboxing confines untrusted code to an isolated environment with limited privileges and resource access, so that malicious or faulty behavior cannot affect the wider system. It is a containment control rather than an encryption or privilege-elevation technique.

Question 20Foundational Concepts and Terminology

What is the purpose of a Common Weakness Enumeration (CWE) identifier?

  1. To certify that a product has passed a security audit.
  2. To identify a specific vulnerable product version and its patch level.
  3. To record the identity of the person who wrote the vulnerable code.
  4. To classify a type of software weakness, such as improper input validation, so it can be tracked consistently. Correct answer.

Explanation

CWE categorizes classes of software weaknesses, enabling consistent discussion, training, and measurement across projects. A specific vulnerable instance in a product is instead identified by a CVE, and certification is a separate activity.

Question 21Foundational Concepts and Terminology

Which statement correctly distinguishes 'threat actor' from 'attack vector'?

  1. A threat actor is the entity that may carry out an attack, while an attack vector is the path used to reach the target. Correct answer.
  2. A threat actor is a software tool, while an attack vector is the vulnerability it exploits.
  3. A threat actor is a legal agreement, while an attack vector is a compliance control.
  4. A threat actor is the path used to reach the target, while an attack vector is the entity carrying out the attack.

Explanation

A threat actor is the party, such as a criminal group or insider, who may conduct an attack, whereas an attack vector is the means or path, such as phishing or an exposed service, used to reach the target. Keeping these separate clarifies threat models.

Question 22Foundational Concepts and Terminology

A scanner flags a library version as vulnerable, but the application never calls the affected function and the library is loaded only in a disabled feature. Which classification is most appropriate?

  1. A confirmed critical vulnerability that must be patched immediately without review.
  2. A false negative because the scanner missed the real issue.
  3. A compensating control that mitigates the vulnerability automatically.
  4. A context-dependent finding that requires validation before being treated as an exploitable vulnerability. Correct answer.

Explanation

Reachability and context determine whether a reported component issue is actually exploitable, so the finding must be validated rather than assumed critical. This is a core part of triage in vulnerability management.

Question 23Foundational Concepts and Terminology

In a threat model, an attacker can modify a value between the time it is checked and the time it is used. Which weakness class does this describe?

  1. A cryptographic failure caused by a weak key length.
  2. A cross-site scripting flaw in output encoding.
  3. A buffer overflow caused by unbounded copying.
  4. A time-of-check to time-of-use race condition. Correct answer.

Explanation

A time-of-check to time-of-use flaw arises when a resource's state changes between validation and use, allowing an attacker to substitute a different value. Mitigations include atomic operations and locking the resource during the check and use.

Question 24Foundational Concepts and Terminology

Which statement best explains why 'security through obscurity' is considered insufficient as a primary control?

  1. Hidden design details can be discovered or leaked, so protection must rely on mechanisms that remain secure when their design is known. Correct answer.
  2. Obscurity is effective only when combined with unpatched systems.
  3. Obscurity is illegal in most jurisdictions and therefore cannot be used at all.
  4. Obscurity always requires more computing power than cryptography.

Explanation

Security should not depend on an attacker remaining ignorant of the design, because details can be reverse engineered or disclosed. Obscurity can add friction as a secondary layer, but robustness must come from sound, openly analyzed mechanisms.

Question 25Foundational Concepts and Terminology

An organization classifies a finding as 'accepted risk' after documenting that the cost of remediation exceeds the potential loss. Which statement correctly describes this decision?

  1. The vulnerability still exists, and the organization has chosen to tolerate it with documented justification and review. Correct answer.
  2. The vulnerability has been eliminated because the risk was formally accepted.
  3. The vulnerability is now a false positive because it was not remediated.
  4. The vulnerability has been transferred to an insurer, removing all organizational liability.

Explanation

Risk acceptance is a treatment decision that tolerates an identified risk with documented rationale, ownership, and periodic review; it does not remove the underlying vulnerability. Elimination and transfer are different treatment options with different effects.

Question 26Foundational Concepts and Terminology

In security terminology, what does the CIA triad stand for?

  1. Control, Inspection, Authorization
  2. Confidentiality, Integrity, Availability Correct answer.
  3. Compliance, Isolation, Authentication
  4. Cryptography, Identity, Auditing

Explanation

The CIA triad is a foundational model naming the three core security objectives: confidentiality (preventing unauthorized disclosure), integrity (preventing unauthorized modification), and availability (ensuring timely and reliable access). These three properties guide control selection and risk assessment across systems.

Question 27Foundational Concepts and Terminology

Which term describes a security mechanism that records actions in a tamper-evident sequence so that later investigation can establish what occurred?

  1. Penetration testing
  2. Audit logging Correct answer.
  3. Vulnerability scanning
  4. Threat hunting

Explanation

Audit logging captures security-relevant events in a protected, sequential record so that investigators can reconstruct activity and detect tampering. The other options are assessment or detection activities, not the record-keeping mechanism itself.

Question 28Foundational Concepts and Terminology

A security team wants to ensure that a user who has been authenticated as a member of the finance group can read financial reports but cannot modify them. Which concept does this requirement primarily illustrate?

  1. Non-repudiation
  2. Authorization Correct answer.
  3. Authentication
  4. Federation

Explanation

Authorization determines what an authenticated principal is permitted to do, such as read but not modify a resource. Authentication establishes identity, while authorization governs the allowed actions after identity is established.

Question 29Foundational Concepts and Terminology

Which security principle states that a subject should be granted only the minimum access rights necessary to perform its required function?

  1. Defense in depth
  2. Least privilege Correct answer.
  3. Zero trust
  4. Separation of duties

Explanation

Least privilege limits each subject to the minimum permissions needed for its task, reducing the potential impact of misuse or compromise. Separation of duties divides critical tasks among multiple parties, defense in depth layers controls, and zero trust removes implicit trust based on network location.

Question 30Foundational Concepts and Terminology

An application uses a single shared administrator account for all administrative actions, with no individual attribution. Which security property is most directly weakened by this practice?

  1. Confidentiality
  2. Availability
  3. Integrity
  4. Non-repudiation Correct answer.

Explanation

Non-repudiation depends on being able to attribute an action to a specific principal so that the principal cannot credibly deny it. A shared account destroys individual attribution, making it impossible to prove which person performed an administrative action, even though confidentiality, availability, and integrity may still be protected by other controls.

Question 31Governance, Risk, and Compliance

In a security governance program, what is the primary purpose of a charter approved by executive leadership?

  1. To document the results of the latest penetration test
  2. To define the security function's authority, scope, and reporting lines Correct answer.
  3. To list the technical controls required for each server
  4. To record individual user access approvals

Explanation

A charter is a governance instrument that establishes the mandate of the security program, including its authority, scope, and accountability relationships. Technical control lists, test results, and access approvals are operational artifacts that flow from that mandate rather than define it.

Question 32Governance, Risk, and Compliance

Which statement best distinguishes a policy from a standard in a security documentation hierarchy?

  1. A policy is optional guidance, while a standard is legally binding
  2. A policy is written by auditors, while a standard is written by engineers
  3. A policy changes monthly, while a standard remains fixed forever
  4. A policy states mandatory high-level intent, while a standard specifies mandatory detailed requirements Correct answer.

Explanation

Policies express management intent and mandatory direction at a high level, and standards translate that intent into specific, measurable requirements. Both are mandatory, so treating a policy as optional guidance misstates the hierarchy. Authorship and change frequency vary by organization and do not define the distinction.

Question 33Governance, Risk, and Compliance

An organization classifies data and finds that customer payment records require the highest protection tier. Which governance action most directly follows from that classification?

  1. Applying the same controls uniformly to every data set
  2. Delegating classification decisions to each individual employee
  3. Applying the control baseline defined for the highest tier to those records Correct answer.
  4. Removing the records from the asset inventory to reduce exposure

Explanation

Data classification exists to drive differentiated handling, so the highest tier should trigger the corresponding control baseline for storage, access, and transmission. Uniform controls ignore risk differences, and removing records from inventory undermines accountability rather than protecting data.

Question 34Governance, Risk, and Compliance

What is the main difference between a risk appetite and a risk tolerance statement?

  1. Appetite is set by regulators; tolerance is set by customers
  2. Appetite applies only to IT systems; tolerance applies only to financial risk
  3. Appetite is the amount of risk leadership is willing to pursue for value; tolerance is the acceptable deviation around a specific objective Correct answer.
  4. Appetite is qualitative; tolerance must always be quantitative

Explanation

Risk appetite expresses the broad level of risk the organization is willing to accept in pursuit of its objectives, while tolerance defines acceptable variation for a specific objective or metric. Both can be qualitative or quantitative, and both are set internally rather than by regulators or customers.

Question 35Governance, Risk, and Compliance

Which activity is a detective control rather than a preventive control?

  1. Requiring multi-factor authentication at login
  2. Restricting administrative access to a privileged group
  3. Encrypting data at rest with managed keys
  4. Reviewing authentication logs for failed login bursts Correct answer.

Explanation

Detective controls identify and report events after or while they occur, and log review for failed logins fits that role. Multi-factor authentication, encryption, and access restriction all act to stop an event from succeeding, which makes them preventive.

Question 36Governance, Risk, and Compliance

A compliance team must demonstrate that a third-party vendor protects confidential data. Which governance artifact most directly supports that assurance?

  1. An internal memo stating the vendor was chosen for its reputation
  2. A copy of the vendor's organizational chart
  3. The vendor's marketing brochure describing its security culture
  4. A current independent assurance report scoped to the vendor's relevant controls Correct answer.

Explanation

Third-party assurance relies on evidence that relevant controls were independently examined, such as an attestation report covering the in-scope systems. Marketing material, reputation-based memos, and org charts are not evidence that controls operate effectively.

Question 37Governance, Risk, and Compliance

In risk assessment terminology, what does inherent risk represent?

  1. The cost of implementing a control
  2. The exposure before considering the effect of existing controls Correct answer.
  3. The likelihood that an audit will find an exception
  4. The exposure remaining after controls have been applied

Explanation

Inherent risk is the level of exposure that exists absent controls, providing a baseline for evaluating control value. Residual risk is the exposure that remains once controls are operating, and control cost or audit findings are separate considerations.

Question 38Governance, Risk, and Compliance

Who is typically accountable for accepting a residual risk that exceeds the organization's tolerance?

  1. The external auditor reviewing the controls
  2. The help desk technician who logged the ticket
  3. The business owner with authority over the affected process Correct answer.
  4. The security analyst who identified the risk

Explanation

Risk acceptance requires authority over the process and its outcomes, which normally rests with the accountable business owner. Analysts, auditors, and support staff may identify or document risk but lack the authority to accept it on the organization's behalf.

Question 39Governance, Risk, and Compliance

A regulation requires retention of security event logs for one year. The security team proposes deleting logs after 90 days to save storage costs. How should governance handle this proposal?

  1. Approve it because cost reduction is always a valid business justification
  2. Reject it because the retention requirement is a compliance obligation that overrides the cost saving Correct answer.
  3. Approve it if the security manager verbally agrees
  4. Defer it until the next external audit

Explanation

Legal and regulatory retention requirements set a minimum obligation, and internal cost preferences cannot override it without a formal exception. Approving the deletion would create a compliance breach, and verbal agreement does not substitute for the required retention.

Question 40Governance, Risk, and Compliance

Which metric best indicates whether a vulnerability management program is operating effectively over time?

  1. Count of vulnerability reports emailed to managers
  2. Median time to remediate critical vulnerabilities by severity tier Correct answer.
  3. Number of scanners deployed across the estate
  4. Total number of vulnerabilities ever discovered

Explanation

Effective governance metrics measure outcomes such as how quickly risk is reduced, and remediation time by severity reflects that. Raw discovery counts, scanner counts, and email volume measure activity or volume rather than the timeliness of risk reduction.

Question 41Governance, Risk, and Compliance

An organization adopts a control framework and maps its existing controls to it. What is the main governance benefit of that mapping?

  1. It shows how existing controls satisfy framework requirements and reveals gaps Correct answer.
  2. It eliminates the need to document control ownership
  3. It guarantees the organization will pass an audit without further work
  4. It replaces the need for a risk assessment process

Explanation

Mapping creates traceability between what the organization does and what a framework expects, exposing overlaps and gaps that guide remediation. It does not guarantee audit outcomes, remove documentation duties, or substitute for risk assessment.

Question 42Governance, Risk, and Compliance

A business unit wants to adopt a new cloud service that will store regulated data. Which sequence best reflects sound governance?

  1. Approve the service because the vendor is well known, then skip assessment
  2. Delegate approval to the vendor's account manager
  3. Deploy the service, then assess risk once users report problems
  4. Assess risk and compliance impact, approve or reject, then define controls and monitoring Correct answer.

Explanation

Governance requires evaluating risk and compliance impact before committing to a service, then conditioning approval on defined controls and ongoing monitoring. Deploying first inverts the process, and vendor reputation or vendor staff cannot substitute for the organization's own assessment and approval.

Question 43Governance, Risk, and Compliance

What does segregation of duties primarily achieve in a security governance context?

  1. It removes the need for logging privileged activity
  2. It transfers accountability for sensitive actions to the audit function
  3. It ensures every task is performed by at least two people simultaneously
  4. It prevents one person from initiating and approving the same sensitive action Correct answer.

Explanation

Segregation of duties divides incompatible responsibilities so that no single individual can both execute and authorize a sensitive transaction without detection. It does not require simultaneous performance, eliminate logging, or shift accountability to auditors.

Question 44Governance, Risk, and Compliance

During a risk assessment, a team rates likelihood as high and impact as low for a given scenario. Which treatment decision is most consistent with common risk practice?

  1. Ignore it because impact is low
  2. Escalate it as a critical incident immediately
  3. Accept or monitor the risk while prioritizing higher combined exposures Correct answer.
  4. Treat it as the top priority because likelihood is high

Explanation

Risk is a function of both likelihood and impact, so a high-likelihood, low-impact scenario typically ranks below high-impact exposures and may be accepted or monitored. Prioritizing solely on likelihood or dismissing the scenario entirely both misapply the assessment.

Question 45Governance, Risk, and Compliance

Which element is essential for an exception (risk acceptance) process to be auditable?

  1. Removal of the exception from the risk register
  2. Documented rationale, approver identity, scope, and expiration date Correct answer.
  3. An unlimited duration so the exception never needs review
  4. A verbal agreement between the requester and a colleague

Explanation

An auditable exception records who approved it, why, what it covers, and when it expires so that it can be reviewed and revoked. Verbal agreements, indefinite duration, and removal from the register all destroy the traceability auditors require.

Question 46Governance, Risk, and Compliance

An internal audit finds that a key control is designed well but is not consistently performed. How should this be characterized?

  1. The control is preventive and therefore effective
  2. The control is deficient in operating effectiveness Correct answer.
  3. The control is compensating and therefore acceptable
  4. The control is deficient in design

Explanation

Operating effectiveness concerns whether a properly designed control actually functions as intended, so inconsistent performance is an operating deficiency. A design deficiency would mean the control as specified cannot achieve its objective, which is not the case here.

Question 47Governance, Risk, and Compliance

What is the purpose of a statement of applicability in an information security management system?

  1. It documents the results of the most recent risk audit
  2. It provides the financial budget for security projects
  3. It records the names of all employees who completed awareness training
  4. It lists the selected controls and justifies inclusions and exclusions Correct answer.

Explanation

The statement of applicability identifies which controls from the chosen framework the organization applies and explains why any are excluded. Training rosters, budgets, and audit results are separate records that do not serve this purpose.

Question 48Governance, Risk, and Compliance

A vendor's assurance report shows a qualified opinion with exceptions in a control area that handles the organization's data. What is the most appropriate governance response?

  1. File the report without review since it is externally produced
  2. Accept the report because an independent opinion was issued
  3. Assess the exceptions for impact and require remediation or compensating controls Correct answer.
  4. Terminate the relationship immediately without further analysis

Explanation

A qualified opinion signals that identified control exceptions may affect the organization's data, so the exceptions must be evaluated and addressed through remediation or compensating controls. The presence of an opinion does not mean the exceptions are acceptable, and neither reflexive termination nor unreviewed filing reflects due diligence.

Question 49Governance, Risk, and Compliance

Which pair correctly matches a risk response to its description?

  1. Avoid: shift financial consequences to a third party
  2. Transfer: eliminate the activity that creates the risk
  3. Mitigate: apply controls to reduce likelihood or impact Correct answer.
  4. Accept: apply new controls to reduce exposure

Explanation

Mitigation reduces risk by lowering likelihood, impact, or both through controls. Avoidance eliminates the activity, transfer shifts consequences to another party such as an insurer, and acceptance retains the risk without adding controls.

Question 50Governance, Risk, and Compliance

A regulator issues new guidance that is not yet enforceable but signals future expectations. How should governance treat it?

  1. Treat it as immediately binding and halt all related operations
  2. Track it and begin planning alignment so the organization is ready before enforcement Correct answer.
  3. Ignore it entirely until an enforcement action occurs
  4. Delegate the decision to individual system administrators

Explanation

Forward-looking guidance is a planning signal, and proactive alignment reduces future compliance and cost risk. Ignoring it until enforcement creates avoidable exposure, while treating non-binding guidance as an immediate operational stop is disproportionate.