Security and Privacy Governance, Risk Management, and Compliance Program

Foundational knowledge of governance, risk management, and compliance programs including frameworks, regulations, and security requirements.

5 minutes 5 Questions

Security and Privacy Governance, Risk Management, and Compliance (GRC) Program is a comprehensive framework that integrates three critical organizational functions to ensure effective management of information security and privacy. **Security and Privacy Governance** establishes the strategic dire…

Concepts covered
Principles of Governance, Risk Management, and ComplianceRoles and Responsibilities for Compliance ActivitiesSecurity and Privacy Controls and RequirementsSystem Assets and Boundary DescriptionsConfidentiality, Integrity, Availability, Non-Repudiation, and PrivacyInformation Lifecycle ManagementSystem Development Life Cycle (SDLC)NIST Risk Management FrameworkNIST Cybersecurity FrameworkCOBIT Framework for IT GovernanceISO/IEC Standards for Information SecurityCompliance Program EstablishmentFISMA and Federal Information Security RequirementsHIPAA and Healthcare Privacy ComplianceGDPR and International Privacy RequirementsFedRAMP Cloud Compliance FrameworkPCI-DSS Payment Card Industry StandardsCybersecurity Maturity Model Certification (CMMC)
Test mode:
Start practice test

CGRC - Security and Privacy Governance, Risk Management, and Compliance Program Example Questions

Test your knowledge of Security and Privacy Governance, Risk Management, and Compliance Program

Question 1

A company collects names and email addresses from website visitors located in France. The company stores this data on servers in Canada. A visitor asks the company to explain what personal data it holds about them. Under GDPR, what must the company provide to the visitor?

Correct Answer: A clear summary of the personal data being processed and the purposes for processing it

Under GDPR Article 15 (Right of Access), a data subject has the right to obtain confirmation of whether their personal data is being processed and, if so, access to that data along with information such as the purposes of processing, categories of data, recipients, and retention periods, which is best summarized as a clear summary of the personal data and processing purposes.

Providing certified server logs and database records goes far beyond the GDPR requirement and includes technical operational data not owed to the data subject. Notifying the French data protection authority is not required when responding to a standard subject access request. Confirming transfer mechanisms like standard contractual clauses is not what the right of access requires, though information about international transfers may be included.

Key concept tested: GDPR Right of Access (Article 15) and the data subject's right to know what personal data is processed and why.

Question 2

A cloud service provider is gathering necessary artifacts to begin their formal FedRAMP authorization process. The compliance team is tasked with providing a comprehensive description of the system architecture, the authorization boundary, and the specific security controls applied to protect federal data. Which standardized document must the team compile to capture this system information?

Correct Answer: The System Security Plan (SSP) which describes the implemented security controls and the defined system boundaries.

The System Security Plan is the foundational document in the FedRAMP process that formally defines the system architecture, authorization boundary, and how required security controls are implemented.

The Security Assessment Report is incorrect because it contains the results of an independent control evaluation rather than the system definition. The Plan of Action and Milestones tracks the remediation of identified weaknesses rather than describing the architecture. The Continuous Monitoring Strategy Guide details ongoing post-authorization surveillance activities instead of baseline system implementation.

Key concept: FedRAMP authorization documentation and the primary purpose of the System Security Plan.

Question 3

A small retail company launches an online store. A customer purchases an item and later claims they never placed the order. The company has server logs showing the transaction timestamp and IP address, but the customer used a shared family computer and no individual login was required. Which security principle is most difficult to enforce in this situation?

Correct Answer: Non-repudiation, because there is no mechanism to uniquely tie the transaction to a specific individual

Non-repudiation is most difficult to enforce here because the shared family computer with no individual authentication means there is no way to uniquely attribute the transaction to a specific person, allowing the customer to plausibly deny placing the order.

The confidentiality answer is wrong because the scenario concerns proving who performed the action, not protecting data from unauthorized viewing. The second non-repudiation option is wrong because the server logs do prove the transaction occurred; the issue is tying it to a specific individual, not proving occurrence. The integrity answer is wrong because the scenario does not raise concerns about log tampering.

Key concept tested: non-repudiation and its dependency on strong individual authentication.

More Security and Privacy Governance, Risk Management, and Compliance Program questions
483 questions (total)
Practice 100 questions
One session at a time, always new questions