Governance, Risk, and Compliance

Security frameworks, risk management, compliance strategies, threat modeling, and AI security challenges for enterprise environments.

5 minutes 5 Questions

Governance, Risk, and Compliance (GRC) is a critical framework in CompTIA SecurityX (CASP+) that integrates organizational strategy, risk management, and regulatory adherence. These three pillars work synergistically to protect organizational assets and ensure ethical operations. Governance encomp…

Concepts covered
IT Governance Frameworks (COBIT, ITIL)Security Program Documentation and PoliciesCompliance Strategies and Industry StandardsPrivacy Regulations (CCPA, GDPR)Impact Analysis and Risk PrioritizationCrisis Management and Breach ResponseData Flow Analysis and Trust BoundariesThreat Modeling with STRIDEThreat Actor Characteristics and ProfilingData Governance and ClassificationConfiguration Management and CMDBSecurity Frameworks (NIST, CSF, CSA)Security Awareness and Training ProgramsRegulatory Compliance (HIPAA, SOX, FISMA, CMMC)Quantitative and Qualitative Risk AssessmentThird-Party and Vendor Risk ManagementAttack Surface Analysis and Architecture ReviewsMITRE ATT&CK and CAPEC FrameworksAI Security Challenges and RisksGRC Tools, Mapping, and AutomationRACI Matrix and Program Management
Test mode:
Start practice test

SecurityX - Governance, Risk, and Compliance Example Questions

Test your knowledge of Governance, Risk, and Compliance

Question 1

A company stores and processes credit card transactions. During an internal review, the team discovers they need to comply with a specific industry standard for handling cardholder data. They want to determine which compliance framework applies to their situation. Which standard should the company follow?

Correct Answer: PCI DSS, since it governs the protection of payment card data

PCI DSS (Payment Card Industry Data Security Standard) is the industry-specific compliance framework designed to protect cardholder data and secure credit card transactions, making it the directly applicable standard for any organization that stores, processes, or transmits payment card information.

HIPAA applies to protected health information in the healthcare industry, not financial transaction data. SOX (Sarbanes-Oxley) governs corporate financial reporting and accounting practices, not the technical protection of payment card data. ISO 27001 is a general information security management framework, not a standard specifically governing payment card or cardholder data protection.

Key concept tested: identifying the correct industry-specific compliance framework for cardholder data environments.

Question 2

A team is reviewing a data flow diagram for a new application. The diagram shows data moving from an external user's browser to a web server, then to an application server, and finally to a database. A junior analyst asks what a trust boundary represents on this diagram. Which explanation best describes the concept of a trust boundary in data flow analysis?

Correct Answer: A line where the level of trust changes between components, indicating where validation and security controls should be applied

A trust boundary in data flow analysis represents a point where the level of trust changes between components, meaning data crossing that boundary moves from one trust zone to another and therefore requires validation, sanitization, and appropriate security controls to be applied.

Network segmentation is a physical or logical implementation detail, not the conceptual meaning of a trust boundary. Encryption changes describe a specific technical control rather than the broader concept of trust transitions. Authentication mechanism changes are similarly just one specific type of security control that might be applied at a trust boundary, not the definition of the boundary itself.

The key concept tested is understanding trust boundaries in threat modeling and data flow diagrams as used in secure application design.

Question 3

A small medical clinic stores patient records in an electronic health record (EHR) system. A new office manager asks which federal regulation requires the clinic to implement safeguards protecting the confidentiality and integrity of electronic protected health information (ePHI). Which regulation applies?

Correct Answer: HIPAA, because it mandates administrative, physical, and technical safeguards for ePHI held by covered entities

HIPAA (Health Insurance Portability and Accountability Act) is the federal regulation that specifically requires covered entities, including medical clinics, to implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

FISMA applies to federal agencies and their information systems, not private medical clinics. SOX (Sarbanes-Oxley) governs financial reporting and internal controls for publicly traded companies, not healthcare data protection. CMMC (Cybersecurity Maturity Model Certification) applies to Department of Defense contractors protecting Controlled Unclassified Information, not healthcare records.

Key concept tested: identifying the correct regulatory framework governing healthcare data protection for covered entities.

More Governance, Risk, and Compliance questions
984 questions (total)
Practice 100 questions
One session at a time, always new questions