Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What is the primary purpose of a risk assessment in an information security program?
Identify the purpose and value of risk assessments.
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
An intentionally vulnerable application for practicing web security in a controlled lab. Useful supplementary work for application-security topics.
Try it: Run a local, isolated instance using the project's instructions. Complete one introductory challenge, explain its root cause, and write the server-side control that would prevent it.
Open-source application; can run locally. Keep the intentionally vulnerable app isolated from public networks.
OWASP's testing methodology adds structure to application-security review. It supplements exam objectives rather than replacing a certification owner's guide.
Try it: Choose one testing category relevant to a missed question. In your own lab, record the test precondition, expected secure behavior, evidence, and remediation.
Free to read. Perform exercises only in your own lab or an explicitly authorized environment.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What is the primary purpose of a risk assessment in an information security program?
To identify and prioritize potential threats and vulnerabilities
To replace the need for security policies
To ensure all systems run at maximum performance
To document employee work hours
Correct answer
To identify and prioritize potential threats and vulnerabilities
Risk assessments help organizations understand what they are protecting, from whom, and with what level of priority. They provide a basis for making informed security investment decisions.
Which control type is primarily focused on discouraging unwanted actions before they occur?
Preventive control
Detective control
Corrective control
Compensating control
Correct answer
Preventive control
Preventive controls are designed to stop incidents from happening, such as access controls or security awareness training. Detective controls identify incidents after they occur, while corrective controls restore systems post-event.
What does the principle of least privilege aim to achieve?
Granting users only the access needed to perform their job
Allowing all users administrative access for simplicity
Ensuring all data is publicly accessible
Automatically granting temporary access to all systems
Correct answer
Granting users only the access needed to perform their job
Least privilege reduces the risk of accidental or malicious misuse of access rights. It limits user and application permissions to the minimum necessary.
Which activity is most closely associated with the 'Identify' function of a governance framework?
Defining strategic objectives and risk appetite
Implementing technical security controls
Monitoring system logs for anomalies
Applying software patches
Correct answer
Defining strategic objectives and risk appetite
The Identify function establishes the foundation by understanding organizational context, including objectives, stakeholders, and risk expectations. Implementation and monitoring belong to other functions.
Which of the following is a key responsibility of a data owner?
Classifying data and defining protection requirements
Physically securing server rooms
Writing code for secure applications
Monitoring network traffic 24/7
Correct answer
Classifying data and defining protection requirements
Data owners are accountable for the classification, integrity, and appropriate use of information. Technical and monitoring tasks are typically handled by security or operations teams.
What does compliance with regulations typically require an organization to do?
Follow specific mandated practices and reporting
Ignore industry best practices in favor of internal policies
Only apply security measures to new systems
Avoid documenting security procedures
Correct answer
Follow specific mandated practices and reporting
Regulatory compliance involves adhering to legal and contractual requirements, which often include specific controls, audits, and documentation.
Which security activity involves reviewing system configurations against established benchmarks?
Configuration auditing
Incident response planning
Business continuity testing
User onboarding
Correct answer
Configuration auditing
Configuration auditing ensures that systems are set up securely and consistently with defined standards. It helps identify deviations that could introduce risk.
What is a common goal of security awareness training?
To reduce human-related security incidents
To replace technical security controls
To increase the number of security tools used
To assign blame for security breaches
Correct answer
To reduce human-related security incidents
Awareness training educates users about risks like phishing and social engineering, aiming to foster secure behaviors and reduce accidental breaches.
Which of the following best describes a security policy?
A high-level statement of intent and rules for protecting information
A detailed technical configuration checklist
A log of all security-related incidents
A list of passwords for organizational systems
Correct answer
A high-level statement of intent and rules for protecting information
Policies provide the strategic direction and rules that guide security programs. Procedures and standards offer more detailed implementation guidance.
What does the CIA triad stand for in information security?
Confidentiality, Integrity, Availability
Compliance, Implementation, Assessment
Control, Identification, Authentication
Communication, Integration, Authorization
Correct answer
Confidentiality, Integrity, Availability
The CIA triad is a foundational model that describes the key security objectives of confidentiality, integrity, and availability for information and systems.
Which of the following is an example of a detective control?
Intrusion Detection System (IDS)
Firewall
Encryption
Access request forms
Correct answer
Intrusion Detection System (IDS)
Detective controls identify and alert on potential security incidents after they occur. Firewalls and encryption are primarily preventive, while request forms are administrative.
What is a primary benefit of establishing a security governance framework?
Providing clear accountability and decision-making structures
Guaranteeing immunity from all cyber attacks
Removing the need for risk assessments
Ensuring all employees work remotely
Correct answer
Providing clear accountability and decision-making structures
A governance framework clarifies roles, responsibilities, and decision-making processes, which improves the effectiveness and consistency of security practices.
Which practice helps ensure the integrity of data?
Implementing checksums and digital signatures
Increasing network bandwidth
Allowing open access to all files
Using default system settings
Correct answer
Implementing checksums and digital signatures
Data integrity ensures that information is accurate and unaltered. Techniques like checksums and digital signatures help detect and prevent unauthorized changes.
What is the role of metrics in security governance?
To measure the effectiveness and efficiency of security processes
To replace qualitative risk assessments
To store all organizational data
To automate all security tasks
Correct answer
To measure the effectiveness and efficiency of security processes
Metrics provide quantitative data to help leadership understand how well security programs are performing and where improvements are needed.
What is a key objective of continuous monitoring in security governance?
To detect and respond to security events in real time
To reduce the number of security policies
To eliminate the need for risk assessments
To replace incident response procedures
Correct answer
To detect and respond to security events in real time
Continuous monitoring helps organizations detect and respond to security events as they occur, supporting timely risk management.
Recall the answer before opening each card.
To identify and prioritize potential threats and vulnerabilities, providing a basis for informed security investment decisions.
Preventive control, such as access controls or security awareness training, stops incidents from happening.
Granting users only the access needed to perform their job, reducing the risk of accidental or malicious misuse.
A governance framework's Identify function establishes organizational context, including objectives and risk expectations.
Classifying data and defining protection requirements, ensuring proper classification and integrity.
Following specific mandated practices and reporting, including controls, audits, and documentation.
Configuration auditing, which identifies deviations that could introduce risk.
To reduce human-related security incidents by educating users about risks like phishing and social engineering.
A high-level statement of intent and rules for protecting information, providing strategic direction.
Confidentiality, Integrity, Availability. It is a foundational model for information security objectives.
Intrusion Detection System (IDS), which identifies and alerts on potential security incidents after they occur.
Providing clear accountability and decision-making structures, improving security effectiveness and consistency.
Implementing checksums and digital signatures to detect and prevent unauthorized changes.
To measure the effectiveness and efficiency of security processes, helping leadership gauge performance and identify improvements.
To detect and respond to security events in real time, supporting timely risk management.
Ensuring data is accurate and unaltered, protected from unauthorized modifications.
Access controls such as authentication and authorization, which stop unauthorized access before it happens.
Security or operations teams; data owners focus on classification and requirements, not daily technical operations.
It reduces accidental breaches by teaching users to recognize and avoid threats like phishing.
Defining strategic objectives, risk appetite, and understanding organizational context.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Risk assessment is central to information security, enabling organizations to identify and prioritize threats and vulnerabilities. The practice bank emphasizes that risk assessments provide a basis for informed security investment decisions. Recognizing the primary purpose—identifying and prioritizing potential threats and vulnerabilities—is critical. This understanding aligns with the Identify function of governance frameworks, which defines strategic objectives and risk appetite. Learners must grasp that risk assessment informs resource allocation and security strategy.
Security controls are categorized as preventive, detective, or corrective. Preventive controls (e.g., access controls, training) aim to stop incidents before they occur. Detective controls (e.g., IDS) identify incidents after the fact. Corrective controls restore systems post-event. The principle of least privilege grants users only the minimum access needed, reducing misuse risk. Data integrity is ensured through checksums and digital signatures. Understanding these distinctions and principles is essential for designing and evaluating security architectures.
A security governance framework provides clear accountability and decision-making structures. Key roles include data owners, who classify data and define protection requirements. Compliance with regulations necessitates specific mandated practices and reporting. Security policies are high-level statements of intent, while procedures and standards provide detailed guidance. The Identify function within governance frameworks defines strategic objectives and risk appetite. Effective governance ensures consistent security practices and regulatory adherence.
Continuous monitoring detects and responds to security events in real time, supporting timely risk management. Configuration auditing compares system setups against benchmarks to identify risky deviations. Security metrics measure the effectiveness and efficiency of security processes, helping leadership gauge performance. Security awareness training educates users to reduce human-related incidents like phishing. These activities form a feedback loop for ongoing improvement and risk reduction.
Study workflow
Identify assets, threats, and vulnerabilities. Assess likelihood and impact for each risk. Prioritize based on risk appetite defined by leadership. Document findings and recommended controls. Use the assessment to guide resource allocation and security planning.
Define job roles and required access. Grant only necessary permissions for each role. Regularly review and revoke excessive rights. Use tools like role-based access control (RBAC) to enforce policies. Monitor for unauthorized privilege escalation.
Define strategic objectives and risk appetite. Assign data owners and security roles. Develop policies, standards, and procedures. Create a reporting structure for accountability. Regularly review and update governance documents.
Select baseline benchmarks (e.g., CIS, NIST). Scan systems against benchmarks to find deviations. Prioritize and remediate critical non-compliance. Automate auditing where possible. Document and report results to management.
Identify key performance indicators (KPIs) aligned with goals. Collect data on incidents, patching, training completion. Analyze trends and present to stakeholders. Use metrics to drive improvement. Review and adjust metrics periodically for relevance.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
In CGRC, risk assessment identifies and prioritizes threats and vulnerabilities to inform security investments and align with governance and risk appetite, as emphasized in the practice bank.
Preventive controls stop incidents before they occur (e.g., firewalls, training). Detective controls identify incidents after they happen (e.g., IDS, alarms). Both are essential for security.
Data owners classify data and define protection requirements. They are accountable for the integrity and appropriate use of information, though technical tasks may be delegated to security teams.
Continuous monitoring detects and responds to security events in real time, enabling timely risk treatment. It is a key component of ongoing governance and compliance.
The CIA triad stands for Confidentiality, Integrity, and Availability. It provides the core objectives for protecting information and systems, guiding security control selection and governance.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
