Governance, Risk, and Compliance (D486)

Correct Answer

D. Preventive administrative control

Explanation

A preventive administrative control is a policy or procedure that helps prevent security incidents by managing human behavior. Security awareness training and system testing fall into this category because they aim to reduce the likelihood of security breaches through proactive education and structured security protocols.

Why Other Options Are Wrong

A. Detective technical control

A detective technical control identifies security events after they have occurred, such as an IDS or audit logs. Security training and testing do not detect incidents but rather prevent them.

B. Preventive technical control

A preventive technical control involves technology-based solutions like firewalls and encryption, which proactively block threats. Security training and policies are not technical in nature.

C. Detective administrative control

A detective administrative control is a policy or process used to detect security issues, such as security audits. Security awareness training and system testing are preventive measures rather than detective ones.

Correct Answer

B. Three times a year

Explanation

Annualized Rate of Occurrence (ARO) represents the estimated frequency of a risk occurring within one year. If Wayne has estimated the ARO as 3, this means the risk is expected to happen three times per year. ARO is a crucial component of quantitative risk assessment, helping organizations calculate their Annualized Loss Expectancy (ALE) when combined with Single Loss Expectancy (SLE).

Why Other Options Are Wrong

A. Once every 3 months

While it may seem correct at first, this wording does not precisely describe ARO. ARO is defined by occurrences per year, not by months. However, dividing the year into three occurrences results in one event roughly every four months, not three months.

C. Once every three years

An ARO of 3 means the event happens three times per year, not once every three years. If an event occurred once every three years, the ARO would be 0.33 (1/3).

D. Once a year for three years

This option misinterprets ARO. ARO measures annual occurrences, not events spread over multiple years. The event will happen three times each year, not once per year for three years.

Correct Answer

D. Industrial accidents

Explanation

Natural disasters are catastrophic events caused by natural forces such as weather, geological activity, or environmental conditions. Examples include earthquakes, hurricanes, tornadoes, floods, and wildfires. Industrial accidents, on the other hand, are caused by human activity, equipment failures, or operational errors, and they do not fall under the category of natural disasters.

Why Other Options Are Wrong

A. Fire

Wildfires are a common natural disaster caused by dry conditions, lightning strikes, or other natural factors. However, not all fires are natural disasters—some result from human negligence or arson.

B. Flood

Flooding is a natural disaster caused by excessive rainfall, hurricanes, or rising water levels in rivers and lakes. It can cause widespread destruction to homes, businesses, and infrastructure.

C. Tornado

Tornadoes are violent windstorms caused by atmospheric conditions and are classified as natural disasters due to their destructive force and unpredictability.

Correct Answer

D. This may violate a nondisclosure agreement.

Explanation

A nondisclosure agreement (NDA) is a legal contract that restricts the sharing of confidential information with unauthorized parties. If Acme Corporation sends proprietary data to a third-party vendor, it could breach its NDA with your company. Before sharing any data, Acme must verify whether the agreement allows for such disclosures and, if necessary, obtain explicit permission.

Why Other Options Are Wrong

A. This data should be encrypted before it is sent to the third-party vendor.

Encrypting data helps protect confidentiality, but encryption alone does not address whether Acme is authorized to share the data. If the NDA prohibits sharing, encryption does not resolve the legal issue.

B. This may constitute unauthorized data sharing.

Unauthorized data sharing is a concern, but the main legal issue stems from violating the NDA. If the NDA permits data sharing with third parties under certain conditions, then it may not necessarily be unauthorized.

C. This may violate the privileged user role-based awareness training.

Privileged user role-based awareness training ensures that employees understand access control and security responsibilities. However, it does not govern external data sharing agreements, which are typically covered by NDAs or service contracts.

Correct Answer

A. Preventive

Explanation

A preventive control is designed to stop security incidents before they occur. In this case, automatically locking the computer after a period of inactivity prevents unauthorized users from gaining access when a workstation is left unattended. This ensures that sensitive information remains protected.

Why Other Options Are Wrong

B. Corrective

A corrective control is used to fix a security issue after it has occurred. Examples include restoring files from a backup after a ransomware attack. Locking a computer after inactivity is a proactive measure, not a response to an incident.

C. Deterrent

A deterrent control discourages unauthorized actions by creating the perception of consequences, such as warning signs or security cameras. While locking the screen may discourage unauthorized access, its primary function is to prevent unauthorized use, making it a preventive control rather than a deterrent.

D. Detective

A detective control identifies and alerts to security incidents, such as an IDS monitoring network traffic. The screen lock does not detect security breaches but rather prevents them, so it is not classified as a detective control.

Correct Answer

C. Nondisclosure agreements signed by employees

Explanation

A nondisclosure agreement (NDA) is a legal contract that prevents employees from sharing confidential information with unauthorized parties. While NDAs help protect trade secrets and sensitive data, they do not actively prevent or minimize security breaches caused by internal employees. Security breaches can still occur if an employee abuses their access privileges, misconfigured security settings, or acts maliciously.

Why Other Options Are Wrong

A. Job rotation

Job rotation limits the chances of fraud and internal security breaches by ensuring that no single employee remains in a position of unchecked power for too long. It also exposes employees to different roles, making it harder for malicious activity to go undetected.

B. Separation of duties

Separation of duties prevents conflicts of interest and reduces the risk of insider threats. By dividing responsibilities, no single employee has complete control over critical systems or sensitive information, making security breaches less likely.

D. Mandatory vacations

Mandatory vacations force employees to take time off, allowing security audits and investigations to uncover any fraudulent or suspicious activity. If an employee is engaged in unauthorized activities, their absence may reveal security breaches.

Correct Answer

A. Acceptable use policy

Explanation

An acceptable use policy (AUP) defines the permitted and prohibited uses of an organization’s technology resources. It ensures that employees understand the limitations of using company devices, networks, and software, reducing the risk of security threats, unauthorized data access, and potential legal liabilities. Implementing an AUP would directly address the issue of an employee misusing company systems for personal business activities.

Why Other Options Are Wrong

B. Clean desk policy

A clean desk policy requires employees to keep their workstations free of sensitive documents or electronic media when not in use. While it enhances security by minimizing the risk of information theft, it does not address unauthorized software installation or improper use of company computers.

C. Mandatory vacation policy

A mandatory vacation policy requires employees to take time off periodically, which helps uncover fraudulent activities or security risks that may go unnoticed. However, it does not prevent or restrict unauthorized use of company resources.

D. Job rotation policy

A job rotation policy involves periodically rotating employees into different roles to reduce the risk of fraud and improve skills. While it can help with security and accountability, it does not address the issue of an employee misusing company resources for personal gain.

Correct Answer:

Establishing principles, framework, and processes for risk management across the organization

Explanation:

ISO 31000 is an internationally recognized standard for risk management that emphasizes a holistic and structured approach. It does not prescribe specific technical controls or compliance checklists; instead, it provides guidance on the fundamental principles, a governance framework, and a set of generic risk management processes applicable across various industries. This ensures that risk management is aligned with the organization’s objectives and integrated into its culture, leading to more informed decision-making and better resilience.

Why Other Options Are Wrong:

Providing detailed technical controls for IT systems

This is incorrect—ISO 31000 does not focus on technical or technology-specific guidelines. Instead, it establishes a broader risk management framework that can be applied in any organizational context.

Ensuring regulatory compliance through specific procedural checklists

This is inaccurate because ISO 31000 is not a prescriptive compliance standard. While it supports compliance, its core aim is to structure risk management, not to deliver specific compliance checklists for laws or regulations.

Delivering encryption standards for data protection

This is incorrect—ISO 31000 does not delve into encryption, cybersecurity configurations, or data protection protocols. Those are covered by technical or security-focused standards like ISO 27001 or NIST.

Correct Answer

C. Control risk

Explanation

Control risk refers to the likelihood that a control, such as a policy, procedure, or configuration, fails to prevent or detect an error or fraud. In this case, the misconfigured financial accounting software is failing to prevent incorrect data from being reported, indicating a control failure.

Why Other Options Are Wrong

A. Inherent risk is incorrect because inherent risk refers to the natural level of risk present in an activity before any controls are applied. This situation is about a control failing, not an inherent risk.

B. Residual risk is incorrect because residual risk is the remaining risk after all controls have been applied. Here, the issue stems from a faulty control rather than being an accepted residual risk.

D. Transparent risk is incorrect because transparent risk is not a commonly recognized risk category in risk management frameworks.