Governance, Risk & Compliance Quiz

Caroline has been asked to find an international standard to guide her company's choices in implementing information security management systems. Which of the following would be the best choice for her?

• ISO 27002

• ISO 27017

• NIST 800-12

• NIST 800-14

Adam is concerned about malware infecting machines on his network. One of his concerns is that malware would be able to access sensitive system functionality that requires administrative access. What technique would best address this issue?

• Implementing host-based antimalware

• Using a nonadministrative account for normal activities

• Implementing full-disk encryption (FDE)

• Making certain the operating systems are patched

You are responsible for setting up new accounts for your company network. What is the most important thing to keep in mind when setting up new accounts?

• Password length

• Password complexity

• Account age

• Least privileges

Which of the following principles stipulates that multiple changes to a computer system should not be made at the same time?

• Due diligence

• Acceptable use

• Change management

• Due care

You are a security engineer and discovered an employee using the company's computer systems to operate their small business. The employee installed their personal software on the company's computer and is using the computer hardware, such as the USB port. What policy would you recommend the company implement to prevent such a breach of the company's data and network being compromised?

• Acceptable use policy

• Clean desk policy

• Mandatory vacation policy

• Job rotation policy

What standard is used for credit card security?

• GDPR

• COPPA

• PCI-DSS

• CIS

You are a security manager for your company and need to reduce the risk of employees working in collusion to embezzle funds. Which of the following policies would you implement?

• Mandatory vacations

• Clean desk

• NDA

• Continuing education

After your company implemented a clean desk policy, you have been asked to secure physical documents every night. Which of the following would be the best solution?

• Department door lock

• Locking cabinets and drawers at each desk

• Proximity cards

• Onboarding

Which of the following techniques attempts to predict the likelihood a threat will occur and assigns monetary values should a loss occur?

• Change management

• Vulnerability assessment

• Qualitative risk assessment

• Quantitative risk assessment

Which of the following agreements is less formal than a traditional contract but still has a certain level of importance to all parties involved?

• SLA
• BPA

• ISA

• MOU