Governance, Risk, and Compliance (D486)
Access The Exact Questions for Governance, Risk, and Compliance (D486)
💯 100% Pass Rate guaranteed
🗓️ Unlock for 1 Month
Rated 4.8/5 from over 1000+ reviews
- Unlimited Exact Practice Test Questions
- Trusted By 200 Million Students and Professors
What’s Included:
- Unlock Actual Exam Questions and Answers for Governance, Risk, and Compliance (D486) on monthly basis
- Well-structured questions covering all topics, accompanied by organized images.
- Learn from mistakes with detailed answer explanations.
- Easy To understand explanations for all students.
Your Essential Exam Toolkit: Available Now Governance, Risk, and Compliance (D486) : Practice Questions & Answers
Free Governance, Risk, and Compliance (D486) Questions
What type of control is a lock?
-
Managerial
-
Technical
-
Physical
-
Corrective
Explanation
Correct Answer
C. Physical
Explanation
A lock is a physical security control because it is a tangible mechanism used to restrict access to a location or object. Physical controls help prevent unauthorized access by acting as a barrier to entry. Other examples of physical controls include fences, security guards, and access control doors.
Why Other Options Are Wrong
A. Managerial is incorrect because managerial controls involve policies, procedures, and administrative actions rather than physical security measures.
B. Technical is incorrect because technical controls involve the use of technology, such as firewalls, encryption, and intrusion detection systems, not physical barriers like locks.
D. Corrective is incorrect because corrective controls are implemented after an incident to restore security, such as restoring backups or patching vulnerabilities. A lock is a preventive measure rather than a corrective one.
You are an IT administrator for a company, and you are adding new employees to an organization's identity and access management system. Which of the following best describes the process you are performing?
-
Onboarding
-
Offboarding
-
Adverse action
-
Job rotation
Explanation
Correct Answer
A. Onboarding
Explanation
Onboarding is the process of integrating new employees into an organization, which includes granting them the necessary access to systems, applications, and resources. This step ensures that new hires have the appropriate permissions to perform their job functions securely and efficiently.
Why Other Options Are Wrong
B. Offboarding
Offboarding is the opposite of onboarding; it involves revoking an employee’s access when they leave the organization to prevent unauthorized access and security risks. Since new employees are being added, not removed, offboarding is incorrect.
C. Adverse action
Adverse action refers to a negative employment decision, such as termination or demotion, usually based on a background check or performance issues. Adding employees to a system is not an adverse action.
D. Job rotation
Job rotation is a security and workforce strategy where employees periodically switch roles or responsibilities to improve skills and reduce fraud risk. This does not describe the process of granting new employees system access.
Your company's security policy includes system testing and security awareness training guidelines. Which of the following control types is this?
-
Detective technical control
-
Preventive technical control
-
Detective administrative control
-
Preventive administrative control
Explanation
Correct Answer
D. Preventive administrative control
Explanation
A preventive administrative control is a policy or procedure that helps prevent security incidents by managing human behavior. Security awareness training and system testing fall into this category because they aim to reduce the likelihood of security breaches through proactive education and structured security protocols.
Why Other Options Are Wrong
A. Detective technical control
A detective technical control identifies security events after they have occurred, such as an IDS or audit logs. Security training and testing do not detect incidents but rather prevent them.
B. Preventive technical control
A preventive technical control involves technology-based solutions like firewalls and encryption, which proactively block threats. Security training and policies are not technical in nature.
C. Detective administrative control
A detective administrative control is a policy or process used to detect security issues, such as security audits. Security awareness training and system testing are preventive measures rather than detective ones.
Leigh Ann is the new network administrator for a local community bank. She studies the current file server folder structures and permissions. The previous administrator didn't properly secure customer documents in the folders. Leigh Ann assigns appropriate file and folder permissions to be sure that only the authorized employees can access the data. What security role is Leigh Ann assuming?
-
Power user
-
Data owner
-
User
-
Custodian
Explanation
Correct Answer
D. Custodian
Explanation
A custodian is responsible for implementing security policies, maintaining access controls, and ensuring data protection. Leigh Ann is acting as a custodian by assigning proper permissions to secure customer documents. Custodians manage and enforce data security but do not make decisions on data classification or policy.
Why Other Options Are Wrong
A. Power user
A power user has elevated privileges but is typically not responsible for enforcing security policies. They have additional access but do not play a direct role in securing sensitive data.
B. Data owner
The data owner is responsible for determining who should have access to data and setting security requirements. However, Leigh Ann is enforcing security controls rather than making policy decisions, so she is acting as a custodian, not a data owner.
C. User
A user is a standard employee who accesses data and applications as needed for their job. Leigh Ann is not just using the system; she is managing and securing it, which makes her a custodian rather than a typical user.
As the IT security officer for your organization, you are configuring data label options for your company's research and development file server. Regular users can label documents as contractor, public, or internal. Which label should be assigned to company trade secrets?
-
High
-
Top secret
-
Proprietary
-
Low
Explanation
Correct Answer
C. Proprietary
Explanation
The "Proprietary" label is commonly used for sensitive company information, such as trade secrets, that should be protected from unauthorized disclosure. Proprietary data is confidential and intended for internal use or restricted access within the company. This classification ensures that only authorized personnel can view or modify the information, reducing the risk of data leaks or theft.
Why Other Options Are Wrong
A. High is a general security label but does not specifically indicate that the data belongs to the company as a trade secret. While "high" might indicate importance, it lacks specificity in defining intellectual property protections.
B. Top secret is a classification typically used in government or military settings for national security information. While trade secrets are confidential, they do not typically require the extreme restrictions that "top secret" classification implies.
D. Low would not be an appropriate classification for trade secrets, as it implies minimal security controls and accessibility to a broad audience. Trade secrets require higher protection to prevent unauthorized access or misuse.
Which of the following is not a physical security control?
-
Motion detector
-
Fence
-
Antivirus software
-
Closed-circuit television (CCTV)
Explanation
Correct Answer
C. Antivirus software
Explanation
Physical security controls are designed to protect the physical infrastructure, assets, and personnel from threats such as theft, unauthorized access, or environmental hazards. Antivirus software is not a physical security control because it focuses on digital protection against malware and cyber threats. Instead of securing a physical location, it safeguards systems from software-based attacks.
Why Other Options Are Wrong
A. Motion detector is a physical security control because it detects movement within a secured area, helping to prevent unauthorized access. It is commonly used in alarm systems to trigger alerts when unexpected motion is detected.
B. Fence is a classic physical security measure used to create a barrier around a property or sensitive area. It helps prevent unauthorized access by establishing a physical boundary.
D. Closed-circuit television (CCTV) is a physical security control used for surveillance and monitoring. It allows security personnel to track activity in a specific area, helping to deter and investigate security incidents.
Marcus wants to ensure that attackers can't identify his customers if they were to gain a copy of his organization's web application database. He wants to protect their Social Security numbers (SSNs) with an alternate value that he can reference elsewhere when he needs to look up a customer by their SSN. What technique should he use to accomplish this?
-
Encryption
-
Tokenization
-
Data masking
-
Data washing
Explanation
Correct Answer:
B. Tokenization
Explanation:
Tokenization replaces sensitive data, such as Social Security numbers, with a non-sensitive equivalent (a "token") that has no exploitable meaning. The actual data is stored securely in a separate database, and only authorized systems can map the token back to the original value. This technique is widely used for protecting sensitive financial and personal information while maintaining functionality in business applications.
Why other options are wrong:
A. Encryption – While encryption protects data by converting it into a secure format, the original data can still be retrieved by decrypting it with a key. Tokenization is more suitable in this case because it eliminates the risk of exposing actual SSNs.
C. Data masking – Data masking replaces sensitive information with a fake but similar-looking value for display purposes. However, it is not intended for actual database protection and does not allow retrieval of the original data when needed.
D. Data washing – This is not a recognized security technique. It might refer to data cleansing, which is used for correcting or removing incorrect or duplicate data, but it does not secure sensitive data like SSNs.
You are a security manager for your company and need to reduce the risk of employees working in collusion to embezzle funds. Which of the following policies would you implement?
-
Mandatory vacations
-
Clean desk
-
NDA
-
Continuing education
Explanation
Correct Answer
A. Mandatory vacations
Explanation
Mandatory vacations help detect fraudulent activities by requiring employees to take time off, during which their duties are temporarily assigned to others. This can expose any unethical or illegal activities that might otherwise go unnoticed. This policy is particularly effective in financial and accounting roles where collusion and embezzlement are significant risks.
Why Other Options Are Wrong
B. Clean desk
A clean desk policy ensures sensitive information is secured when an employee is not at their workstation. While this improves security, it does not specifically address the risk of collusion or fraudulent activities.
C. NDA
A non-disclosure agreement (NDA) prevents employees from sharing confidential company information. While important for protecting intellectual property, it does not mitigate the risk of internal fraud or collusion.
D. Continuing education
Continuing education focuses on professional development and keeping employees up to date with industry standards. It does not provide any direct mechanism for preventing or detecting fraudulent activities within an organization.
You have an asset that is valued at $16,000, the exposure factor of a risk affecting that asset is 35 percent, and the annualized rate of occurrence is 75 percent. What is the SLE?
-
$5,600
-
$5,000
-
$4,200
-
$3,000
Explanation
Correct Answer
A. $5,600
Explanation
The Single Loss Expectancy (SLE) is calculated using the formula:
SLE = Asset Value × Exposure Factor
Given:
Asset Value = $16,000
Exposure Factor = 35% (0.35)
SLE = $16,000 × 0.35 = $5,600
Why Other Options Are Wrong
B. $5,000 is incorrect because it does not follow the correct formula for calculating SLE. The correct multiplication of $16,000 and 0.35 does not result in $5,000.
C. $4,200 is incorrect because it assumes an incorrect exposure factor or asset value. The proper calculation results in $5,600.
D. $3,000 is incorrect because it is unrelated to the actual computation of SLE. The given exposure factor applied to the asset value does not yield this amount.
You are a security administrator and advise the web development team to include a CAPTCHA on the web page where users register for an account. Which of the following controls is this referring to?
-
Deterrent
-
Detective
-
Compensating
-
Degaussing
Explanation
Correct Answer
A. Deterrent
Explanation
A CAPTCHA serves as a deterrent control because it discourages automated bots from abusing the registration system. By requiring users to complete a challenge, it prevents unauthorized access attempts and spam account creation.
Why Other Options Are Wrong
B. Detective
A detective control identifies or logs security incidents but does not actively prevent them. CAPTCHA does not just detect suspicious activity; it proactively blocks bots.
C. Compensating
A compensating control is an alternative security measure used when a primary control is not feasible. CAPTCHA is not compensating for another control; it is a primary security mechanism for user verification.
D. Degaussing
Degaussing is a method used to erase data from magnetic storage devices, such as hard drives. It is unrelated to web security and user verification.
How to Order
Select Your Exam
Click on your desired exam to open its dedicated page with resources like practice questions, flashcards, and study guides.Choose what to focus on, Your selected exam is saved for quick access Once you log in.
Subscribe
Hit the Subscribe button on the platform. With your subscription, you will enjoy unlimited access to all practice questions and resources for a full 1-month period. After the month has elapsed, you can choose to resubscribe to continue benefiting from our comprehensive exam preparation tools and resources.
Pay and unlock the practice Questions
Once your payment is processed, you’ll immediately unlock access to all practice questions tailored to your selected exam for 1 month .
Frequently Asked Question
ULOSCA is an online study platform that offers expertly crafted exam practice questions and detailed explanations, designed to help students excel in their exams, including the Governance, Risk, and Compliance (D486) exam.
We offer over 200 exam practice questions specifically designed for the D486 exam, covering key topics to ensure you’re fully prepared.
ULOSCA is available for just $30 per month, giving you unlimited access to all our study resources.
With your subscription, you get unlimited access to practice questions, detailed explanations, and study resources that are tailored to the D486 exam.
Yes! Our practice questions are carefully designed to reflect the type and difficulty level of the questions you will encounter on the real D486 exam.
Yes, once you subscribe, you have 24/7 access to all of our high-quality study materials, allowing you to study at your own pace.
Absolutely! Each question is followed by detailed, easy-to-understand explanations that break down complex concepts, making it easier for you to grasp difficult material.
By practicing with our realistic questions and thoroughly understanding the explanations, you’ll gain deeper insights, build confidence, and enhance your ability to tackle any question on exam day.
While we currently don’t offer a free trial, we do provide unlimited access to our resources, which allows you to fully explore all the benefits of a subscription before committing.