Which of the following best describes the purpose of GRC?

• Increase sales and revenue

• Align IT with business goals, manage risks, ensure compliance

• Reduce hardware costs

• Automate HR operations

In risk management, which is NOT a risk response strategy?

• Avoidance

• Mitigation

• Acceptance

• Duplication

Which framework is commonly used for IT governance?

• ISO 9001

• COBIT

• CMMI

• PMBOK

Which is an example of compliance risk?

• Competitor gaining market share

• Employee fraud

• Violation of GDPR data protection rules

• System downtime

The “Three Lines of Defense” model in GRC includes all EXCEPT:

• Operational Management

• Risk & Compliance Functions

• Internal Audit

• External Customers

Which law/regulation primarily deals with protecting health data?

• HIPAA

• SOX

• GDPR

• PCI-DSS

In risk assessment, the formula for risk is typically:

• Risk = Threat ÷ Vulnerability

• Risk = Likelihood × Impact

• Risk = Asset + Control

• Risk = Compliance × Policy

What is the main objective of an IT audit?

• Increase revenue

• Ensure IT controls safeguard assets and data

• Reduce headcount

• Improve marketing campaigns

Which of the following is a preventive control?

• Firewall configuration

• Log monitoring

• Incident response

• Audit trail review

SOX (Sarbanes-Oxley Act) is mainly concerned with:

• Environmental safety

• Financial reporting integrity

• HR hiring process

• Customer privacy laws