Security Governance practice questions

Governance is how organizational leadership directs and oversees security. Leaders define objectives, approve policies, allocate authority, and assign accountability so security activity aligns with business goals.

Setting direction, establishing policy, and assigning accountability is the definition of governance. Configuring tools, auditing controls, and monitoring logs are all execution or verification activities performed under that governance, not governance itself.

1. Ask whether the activity is about deciding and overseeing or about doing the work.
2. Governance activities involve leadership decisions such as policy approval and accountability assignment.
3. Eliminate the options describing hands-on technical work or audit testing, which are execution and verification tasks.

Exam tip: Governance is leadership setting direction, policy, and accountability; it oversees rather than performing the technical work.

Compliance means conforming to requirements. Those requirements come from outside the organization, such as laws, regulations, and contracts, and from inside it, such as policies, standards, and procedures the organization has adopted.

The correct option captures both halves: external laws and regulations plus internal policies. The distractors either narrow compliance to regulators only, confuse it with eliminating risk, or reduce it to a single technical control.

1. Recall that compliance obligations have two sources: external and internal.
2. External sources include laws, regulations, and contracts; internal sources include the organization's own policies and standards.
3. Eliminate options that mention only one source or that describe risk elimination or a specific control.

Exam tip: Compliance means meeting both external legal and regulatory requirements and the organization's own internal policies.

In GRC, the risk discipline is the ongoing process of identifying, assessing, and treating risks. Leadership sets the risk appetite, and risk management keeps the organization's actual risk exposure within that boundary.

Managing risk within the appetite leadership sets is the textbook description of the risk component. Eliminating every threat is impossible, and disciplinary policies or product purchases are not what the risk discipline means.

1. Recall that leadership defines risk appetite as part of governance.
2. Risk management then identifies, assesses, and treats risks to stay within that appetite.
3. Eliminate options promising total elimination of threats or describing unrelated policy and purchasing activities.

Exam tip: Risk management keeps organizational risk within the appetite that leadership defines; it manages risk, it does not eliminate it.

Governance and management are complementary but separate. Governance, exercised by boards and senior leadership, decides direction, approves policy, and verifies results. Management executes: it plans, builds, runs, and monitors within the direction governance sets.

Decide and verify versus execute is the classic distinction. The distractors either reverse the roles, merge the two functions, or invert who approves and who implements policy.

1. Assign strategic decisions, policy approval, and verification of outcomes to governance.
2. Assign planning, implementation, and daily operation to management.
3. Check each option against this split and eliminate any that swap or merge the roles.

Exam tip: Governance decides and verifies; management executes. Think of it as direction from the top, execution below.

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. Because it shapes strategy and resource decisions across the whole organization, defining it is a governance responsibility held by senior leadership.

Only the board and executives have the authority and the organization-wide view needed to declare how much risk is acceptable. Support staff and individual employees operate within that appetite, and regulators set legal minimums rather than the organization's appetite.

1. Recall that risk appetite is an organization-wide boundary, not a per-team preference.
2. Organization-wide boundaries are set through governance, which is exercised by senior leadership.
3. Eliminate operational staff, outside regulators, and individual employees as the source of that decision.

Exam tip: Risk appetite comes from the top: senior leadership defines it, and risk management works within it.

Compliance means meeting a defined set of requirements, while security means actually protecting assets against threats. Requirements are a baseline and a snapshot in time; threats evolve continuously, so meeting the baseline does not guarantee protection.

Passing an audit and then being breached is the classic illustration that compliance and security are related but different goals. The other options invent audit fraud, overstate regulations, or wrongly blame the audit for the breach.

1. Note that the audit verified compliance with a fixed set of requirements at one point in time.
2. Note that attackers exploit any weakness, including ones no requirement covers.
3. Conclude that compliance is a baseline that supports security but does not guarantee it.

Exam tip: Compliance is a minimum baseline, not proof of security; an organization can be fully compliant and still be breached.