CompTIA Security+ Governance, Risk & Compliance Practice Questions

Question 1

Which document outlines rules for acceptable use of company resources?

Accepted Answer

AUP

Answer

SLA

Answer

MOU

Answer

SOW

Question 2

Which principle ensures users have only the access needed for their job?

Accepted Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Answer

Need to know

Question 3

Which regulation protects healthcare information in the US?

Accepted Answer

HIPAA

Answer

PCI DSS

Answer

SOX

Answer

GDPR

Question 4

What is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

To identify critical systems and recovery priorities

Answer

To detect network intrusions

Answer

To encrypt sensitive data

Answer

To authenticate remote users

Question 5

Which principle ensures no single person controls all critical functions?

Accepted Answer

Separation of duties

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 6

What is the PRIMARY purpose of a risk assessment?

Accepted Answer

To identify and prioritize risks

Answer

To eliminate all risks

Answer

To encrypt all sensitive data

Answer

To authenticate all users

Question 7

What is the PRIMARY purpose of a data retention policy?

Accepted Answer

To define how long different data types should be kept

Answer

To maximize storage space

Answer

To encrypt all stored data

Answer

To authenticate data access

Question 8

What is the PRIMARY purpose of a non-disclosure agreement (NDA)?

Accepted Answer

To protect confidential information

Answer

To define acceptable use of resources

Answer

To establish service level expectations

Answer

To document incident response procedures

Question 9

Which regulation governs credit card data security?

Accepted Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Answer

GDPR

Question 10

What is the PRIMARY purpose of PII (Personally Identifiable Information) protection?

Accepted Answer

To safeguard individual privacy

Answer

To maximize data storage efficiency

Answer

To improve network performance

Answer

To authenticate users

Question 11

What is the PRIMARY purpose of a security awareness program?

Accepted Answer

To educate users about security policies and threats

Answer

To eliminate all security risks

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 12

What is the PRIMARY purpose of a security policy?

Accepted Answer

To define organizational security expectations

Answer

To eliminate all security risks

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 13

What is the PRIMARY purpose of a security baseline?

Accepted Answer

To establish minimum security configurations

Answer

To eliminate all security risks

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 14

What is the PRIMARY purpose of a data classification policy?

Accepted Answer

To categorize data based on sensitivity

Answer

To eliminate all security risks

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 15

What is the PRIMARY purpose of change management?

Accepted Answer

To control modifications to IT systems

Answer

To eliminate all security risks

Answer

To monitor employee internet usage

Answer

To encrypt sensitive data

Question 16

Which of the following BEST describes the concept of 'confidentiality' in the CIA triad?

Accepted Answer

Preventing the unauthorized disclosure of sensitive information.

Answer

Ensuring that data is accurate and has not been tampered with.

Answer

Ensuring that systems and data are available to authorized users when needed.

Answer

Ensuring that actions can be traced back to an individual or entity.

Question 17

What is the primary goal of performing a security audit?

Accepted Answer

To provide an independent assessment of an organization's security controls and compliance.

Answer

To actively exploit vulnerabilities in the network.

Answer

To immediately remediate all identified security weaknesses.

Answer

To deploy new security technologies within the organization.

Question 18

What is the process of identifying, quantifying, and prioritizing risks to an organization called?

Accepted Answer

Risk assessment

Answer

Incident response

Answer

Vulnerability scanning

Answer

Penetration testing

Question 19

Which software development practice involves integrating security testing early and throughout the software development lifecycle (SDLC)?

Accepted Answer

Shift Left

Answer

Waterfall

Answer

Obfuscation

Answer

Sandboxing

Question 20

Which concept refers to the legal requirement that data collected on citizens must be stored and processed within the physical borders of the country where the citizen resides?

Accepted Answer

Data sovereignty

Answer

Data classification

Answer

Data masking

Answer

Data loss prevention

Question 21

Which privacy regulation grants European Union citizens the 'right to be forgotten' (erasure of personal data)?

Accepted Answer

GDPR

Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Question 22

Which control category describes security measures like security guards, fences, and lighting?

Accepted Answer

Physical

Answer

Technical

Answer

Managerial

Answer

Administrative

Question 23

Which risk response transfers financial impact to a third party?

Accepted Answer

Cyber insurance

Answer

Risk acceptance

Answer

Risk avoidance only

Answer

Disabling controls

Question 24

Which document defines expected uptime and support responsibilities for a vendor service?

Accepted Answer

SLA

Answer

NDA

Answer

AUP

Answer

MOU only

Question 25

Which activity helps employees practice incident response roles without disrupting production systems?

Accepted Answer

Tabletop exercise

Answer

Unannounced data deletion

Answer

Credential sharing drill

Answer

Patch rollback removal

Question 26

Which concept separates duties so no single person can complete a sensitive process alone?

Accepted Answer

Separation of duties

Answer

Implicit trust

Answer

Privilege creep

Answer

Open access

Question 27

Which document tells users what they may and may not do with company systems?

Accepted Answer

Acceptable use policy

Answer

Certificate signing request

Answer

Data flow diagram only

Answer

Chain of custody form

Question 28

Which risk treatment accepts the risk because mitigation cost exceeds expected loss?

Accepted Answer

Risk acceptance

Answer

Risk transference only

Answer

Risk avoidance only

Answer

Risk exploitation

CompTIA Security+ Practice Questions: Governance, Risk & Compliance

Q1. Which document outlines rules for acceptable use of company resources?

Q2. Which principle ensures users have only the access needed for their job?

Q3. Which regulation protects healthcare information in the US?

Q4. What is the PRIMARY purpose of a business impact analysis (BIA)?

Q5. Which principle ensures no single person controls all critical functions?

Q6. What is the PRIMARY purpose of a risk assessment?

Q7. What is the PRIMARY purpose of a data retention policy?

Q8. What is the PRIMARY purpose of a non-disclosure agreement (NDA)?

Q9. Which regulation governs credit card data security?

Q10. What is the PRIMARY purpose of PII (Personally Identifiable Information) protection?

Q11. What is the PRIMARY purpose of a security awareness program?

Q12. What is the PRIMARY purpose of a security policy?

Q13. What is the PRIMARY purpose of a security baseline?

Q14. What is the PRIMARY purpose of a data classification policy?

Q15. What is the PRIMARY purpose of change management?

Q16. Which of the following BEST describes the concept of 'confidentiality' in the CIA triad?

Q17. What is the primary goal of performing a security audit?

Q18. What is the process of identifying, quantifying, and prioritizing risks to an organization called?

Q19. Which software development practice involves integrating security testing early and throughout the software development lifecycle (SDLC)?

Q20. Which concept refers to the legal requirement that data collected on citizens must be stored and processed within the physical borders of the country where the citizen resides?

Q21. Which privacy regulation grants European Union citizens the 'right to be forgotten' (erasure of personal data)?

Q22. Which control category describes security measures like security guards, fences, and lighting?

Q23. Which risk response transfers financial impact to a third party?

Q24. Which document defines expected uptime and support responsibilities for a vendor service?

Q25. Which activity helps employees practice incident response roles without disrupting production systems?

Q26. Which concept separates duties so no single person can complete a sensitive process alone?

Q27. Which document tells users what they may and may not do with company systems?

Q28. Which risk treatment accepts the risk because mitigation cost exceeds expected loss?

More CompTIA Security+ practice topics