Compliance Maintenance

Performing change management, ongoing compliance monitoring, audit activities, and system decommissioning to maintain continuous compliance.

5 minutes 5 Questions

Compliance Maintenance refers to the ongoing process of ensuring that an organization continuously adheres to applicable laws, regulations, standards, policies, and contractual obligations. In the context of Certified in Governance, Risk and Compliance (CGRC), compliance maintenance is a critical d…

Concepts covered
System Change Management and TrackingEnvironment Deployment and Rollback PlanningChange Control Board (CCB) Approval ProcessChange Impact Assessment on Organizational RiskMonitoring Strategy RevisionCompliance Training and Awareness ProgramsEvidence Collection and Documentation UpdatesSecurity Updates and Risk RemediationIncident Response and Contingency ActivitiesSystem and Asset MonitoringOngoing Compliance Review FrequencyAudit Testing and Vulnerability ScanningPersonnel Interviews for Compliance VerificationSystem Decommissioning RequirementsDecommission Documentation and Retention
Test mode:
Start practice test

CGRC - Compliance Maintenance Example Questions

Test your knowledge of Compliance Maintenance

Question 1

A team is preparing to deploy a security configuration update across staging and production environments. During staging validation, they notice that the update changes firewall rules and modifies user authentication timeout settings. The rollback documentation only covers reverting the firewall rule changes. What should the team do before proceeding to the production deployment?

Correct Answer: Update the rollback plan to include procedures for reverting both the firewall rules and the authentication timeout settings before moving forward

The correct answer is right because a comprehensive rollback plan must address all changes introduced by a deployment, so both the firewall rules and authentication timeout settings need documented reversion procedures before moving to production.

Proceeding with only partial rollback coverage violates change management best practices and creates risk if the deployment fails. Splitting the deployment into separate windows is unnecessary since both changes are part of the same update and should be managed together. Documenting gaps in a post-deployment review does not mitigate the immediate risk of an incomplete rollback during a failed production deployment.

The key concept tested is completeness of rollback planning within change management controls.

Question 2

A team discovers that a vendor has released a security patch for a known vulnerability in their database software. The patch has been available for two weeks. A junior analyst asks what the first step should be before applying the patch to production systems. What is the correct initial action?

Correct Answer: Test the patch in a staging environment to verify compatibility and stability

Testing the patch in a staging environment first is the correct initial action because it allows the organization to verify that the patch does not introduce compatibility issues, system instability, or unintended consequences before affecting production systems.

Deploying directly to production after only reviewing release notes skips the critical testing phase and introduces unnecessary risk. Testing in staging while simultaneously applying to production defeats the purpose of testing, as production is already exposed to potential issues. Simply documenting the vulnerability and scheduling a future maintenance window delays remediation without performing any validation of the patch itself.

The key concept tested is change management and patch management best practices within IT governance.

Question 3

An organization is architecting a contingency capability for a critical financial transaction processing enclave requiring a recovery point objective of zero and a recovery time objective of less than ten seconds. The enclave integrates heavily with legacy external third-party service providers that restrict active-active connections. Which architecture should the organization construct to meet these stringent requirements while maintaining service continuity?

Correct Answer: Deploy a multi-region active-standby architecture utilizing synchronous state replication across dedicated high-bandwidth circuits and automated border gateway protocol routing failover configurations.

Deploying a multi-region active-standby architecture with synchronous replication guarantees zero data loss and rapid automated failover within seconds while strictly adhering to the third-party restrictions against active-active connections.
The active-active topology directly violates the third-party constraints and uses asynchronous replication which risks data loss. The cold site relies on manual failover protocols that cannot meet the rigorous recovery time objective. The cloud environment utilizes periodic snapshots which fundamentally prevents achieving a recovery point objective of zero.
The key concept tested is designing disaster recovery architectures to meet stringent recovery objectives alongside external dependency constraints.

More Compliance Maintenance questions
402 questions (total)
Practice 100 questions
One session at a time, always new questions