ISC Certified in Governance Risk and Compliance Sample Questions:

1. The amount of time mission/business processes can be disrupted without causing significant harm to the organization's mission.
Response:

A) Recovery Time Objective (RTO)
B) Disaster Recovery Plan (DRP)
C) Maximum Tolerable Downtime (MTD)
D) System of Records Notice (SRN)

2. The process by which a security control baseline is modified based on: (i) the application of scoping guidance; (ii) the specification of compensating security controls, if needed; and (iii) the specification of organization-defined parameters in the security controls via explicit assignment and selection statements.
Response:

A) Tailoring
B) Scoping
C) Feature
D) Guidance

3. The RMF Step and task where a Continuous Monitoring strategy that monitors the effectiveness of the selected security controls is created.
Response:

A) RMF Step 2, Task 2
B) RMF Step 2, Task 1
C) RMF Step 2, Task 3
D) RMF Step 1, Task 3

4. What are the four business areas of BRM?
Response:

A) 1. support functions necessary to conduct government (support delivery of services)
2. resource management functions that support all areas of the government's business (management of resources)
3. mechanisms the government uses to achieve its purpose (missions or services to citizens)
4. purpose of government (modes of delivery)
B) 1. purpose of government (missions or services to citizens)
2. mechanisms the government uses to achieve its purpose(modes of delivery)
3. support functions necessary to conduct government ((missions or services to citizens)
4. resource management functions that support all areas of the government's business (support delivery of services)
C) 1. purpose of government (missions or services to citizens)
2. mechanisms the government uses to achieve its purpose(modes of delivery)
3. support functions necessary to conduct government (support delivery of services)
4. resource management functions that support all areas of the government's business (management of resources)
D) 1. purpose of government (support delivery of services)
2. mechanisms the government uses to achieve its purpose(modes of delivery)
3. resource management functions that support all areas of the government's business (missions or services to citizens)
4. support functions necessary to conduct government (support delivery of services)

5. Significant changes to a system may trigger an event-driven authorization action which may include by are not limited to all of the following except one. Choose the exception.
Response:

A) Modifications to system ports protocols and services
B) Changes in information types processed, stored, or transmitted by the system
C) Installation of a new or upgraded operating system, middleware component, or application
D) Modifications to how information, including PII, is processed
E) Modifications to security and privacy controls
F) Moving to a new facility

Solutions: