CGRC無料問題集「ISC Certified in Governance Risk and Compliance」

質問 1

Which of the following access control models uses a predefined set of access privileges for an object of a system?
Response:

（A）Mandatory Access Control

（B）Role-Based Access Control

（C）Policy Access Control

（D）Discretionary Access Control

正解：A 解答を投票する

質問 2

Which of the following is used to indicate that the software has met a defined quality level and is ready for mass distribution either by electronic means or by physical media? Response:

（A）DAA

（B）CRO

（C）RTM

（D）ATM

正解：C 解答を投票する

質問 3

Wendy is about to perform qualitative risk analysis on the identified risks within her project. Which one of the following will NOT help Wendy to perform this project management activity?
Response:

（A）Project scope statement

（B）Stakeholder register

（C）Risk register

（D）Risk management plan

正解：B 解答を投票する

質問 4

Which of the following administrative policy controls requires individuals or organizations to be engaged in good business practices relative to the organization's industry? Response:

（A）Segregation of duties

（B）Separation of duties

（C）Need to Know

（D）Due care

正解：D 解答を投票する

質問 5

Which organization is responsible for procurement, development, integration, modification, operation, maintenance, and disposal of an Information System?
Response:

（A）Chief Information Officer (CIO)

（B）Information system security engineer (ISSE)

（C）Information System Owner

（D）Information security architect

正解：C 解答を投票する

質問 6

The use of automation to conduct security control assessments should be maximized to do the following except one.
Response:

（A）Permit increased frequency and volume of assessments consistent with the organization's monitoring strategy.

（B）Support ongoing monitoring of system security posture.

（C）Increase the speed and overall effectiveness and efficiencies of assessments.

（D）Enable authorizing official to have ready access to the current security state of the system and PTA.

正解：D 解答を投票する

質問 7

Who plays the Central role in that he is responsible for system operation, implementation of security controls, and continuous monitoring.
Response:

（A）Information Systems Security Officer

（B）Authorizing Official

（C）Industry Standard Architecture

（D）Information System Owner

正解：D 解答を投票する

質問 8

Information developed from Federal Information Processing Standard (FIPS) 199 may be used as an input to which authorization package document?
Response:

（A）Authorization decision document

（B）Plan of actions and milestones (POA&M)

（C）Security assessment report (SAR)

（D）System security plan (SSP)

正解：D 解答を投票する

質問 9

An agreement that allows two organizations to back up each other.
Response:

（A）Reciprocal Agreement

（B）Trade Agreement

（C）Contract Agreement

（D）Basic Agreement

正解：A 解答を投票する

質問 10

What is verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.
Response:

（A）Authentication

（B）Verification

（C）Categorization

（D）Organizational

正解：A 解答を投票する

質問 11

Tailored control baselines may also be referred to as
Response:

（A）Tailoring

（B）Countermearsures

（C）Alternative controls

（D）Overlays

正解：D 解答を投票する

質問 12

What does the finding "other than satisfied" reflect in an assessment report? Response:

（A）Information types should be reevaluated

（B）A lack of specified protection

（C）The contingency plan must be revised

（D）An information security incident has occurred

正解：B 解答を投票する

CGRC 無料問題集「ISC Certified in Governance Risk and Compliance」

弊社を連絡する

関連リンク

トップ試験