WGU D486 DFN1 TASK 1: GOVERNANCE, RISK, AND COMPLIANCE | 2026 UPDATE | WITH
COMPLETE SOLUTIONS/NEWEST UPDATE!!!
Question 1
Which of the following best describes the primary goal of IT Governance within an
organization?
A) Ensuring that the IT department has the newest hardware available.
B) Aligning IT investments and activities with the overall business strategy and goals.
C) Maximizing the number of help desk tickets resolved per hour.
D) Outsourcing all security functions to third-party vendors to reduce liability.
E) Restricting all employee access to the internet to prevent data leaks.
Correct Answer: B) Aligning IT investments and activities with the overall business strategy
and goals.
Rationale: IT Governance is about ensuring that IT provides value to the business and that
IT risks are mitigated. Its primary function is "strategic alignment," ensuring that what IT
does actually helps the company achieve its mission and objectives.
Question 2
In the "Three Lines of Defense" model for risk and control, which group constitutes the "First
Line"?
A) External Auditors and Regulators.
B) The Board of Directors and the Audit Committee.
C) Operational Management (the business units owning and managing risks).
D) Internal Audit functions providing independent assurance.
E) The Risk Management and Compliance departments.
Correct Answer: C) Operational Management (the business units owning and managing
risks).
Rationale: The first line consists of the people performing the day-to-day work who are
responsible for identifying and managing risks in their own processes. The second line
includes risk/compliance oversight, and the third line is independent internal audit.
Question 3
Which of the following is a quantitative risk assessment metric used to determine the expected
annual financial loss for a specific asset and threat?
A) Single Loss Expectancy (SLE)
B) Annual Rate of Occurrence (ARO)
C) Annual Loss Expectancy (ALE)
D) Exposure Factor (EF)
E) Risk Priority Number (RPN)
Correct Answer: C) Annual Loss Expectancy (ALE)
Rationale: ALE is calculated by multiplying the SLE (the cost of a single event) by the ARO
, 2
(how many times that event happens per year). This provides a dollar value that helps
management decide how much to spend on a control.
Question 4
A company decides to purchase a cyber-insurance policy to cover potential losses from a data
breach. Which risk treatment strategy is the company employing?
A) Risk Mitigation
B) Risk Avoidance
C) Risk Acceptance
D) Risk Transference
E) Risk Rejection
Correct Answer: D) Risk Transference
Rationale: Risk transference involves shifting the financial impact of a risk to a third party,
such as an insurance company. The risk still exists, but the burden of payment for the loss
is shared or moved.
Question 5
Which regulation primarily governs the privacy and security of "Protected Health Information"
(PHI) in the United States?
A) Sarbanes-Oxley Act (SOX)
B) General Data Protection Regulation (GDPR)
C) Health Insurance Portability and Accountability Act (HIPAA)
D) Payment Card Industry Data Security Standard (PCI-DSS)
E) Gramm-Leach-Bliley Act (GLBA)
Correct Answer: C) Health Insurance Portability and Accountability Act (HIPAA)
Rationale: HIPAA sets the national standard for protecting sensitive patient health
information from being disclosed without the patient’s consent or knowledge.
Question 6
What is the main purpose of a Business Impact Analysis (BIA)?
A) To identify the specific hacker group likely to attack the company.
B) To determine the criticality of business processes and the impact of their interruption.
C) To list all the software versions currently running on the server.
D) To provide a legal defense in the event of a compliance audit.
E) To calculate the exact cost of a new firewall.
Correct Answer: B) To determine the criticality of business processes and the impact of their
interruption.
Rationale: The BIA is a foundational step in Business Continuity Planning. it identifies
which business functions are most vital and establishes Recovery Time Objectives (RTO)
and Recovery Point Objectives (RPO).
, 3
Question 7
Under the GDPR, what is the maximum fine for a severe violation?
A) $10,000 USD.
B) 2% of annual global turnover or €10 million, whichever is higher.
C) 4% of annual global turnover or €20 million, whichever is higher.
D) A temporary suspension of all business activities in Europe.
E) Mandatory jail time for the Chief Information Officer (CISO).
Correct Answer: C) 4% of annual global turnover or €20 million, whichever is higher.
Rationale: GDPR is known for its heavy enforcement. Serious infringements, such as
violating the basic principles for processing or data subject rights, can lead to these
substantial fines.
Question 8
Which of the following is considered a "Detective" control?
A) A firewall blocking unauthorized incoming traffic.
B) Security awareness training for employees.
C) Reviewing system access logs to identify unauthorized login attempts.
D) Locking the door to the server room.
E) Using a complex password policy.
Correct Answer: C) Reviewing system access logs to identify unauthorized login attempts.
Rationale: Detective controls are designed to identify that an event has already occurred or
is in progress. Log reviews, motion sensors, and intrusion detection systems (IDS) are
classic examples.
Question 9
The "COBIT" framework (Control Objectives for Information and Related Technologies) is most
closely associated with which pillar of GRC?
A) Government.
B) Risk.
C) Compliance.
D) Governance.
E) Resilience.
Correct Answer: D) Governance.
Rationale: COBIT is a world-renowned framework for the governance and management of
enterprise IT. It provides a comprehensive set of "enablers" to help businesses bridge the
gap between technical issues and business risks.
Question 10
An organization identifies a risk but determines that the cost of a countermeasure is higher than
the potential loss. They decide to take no further action. This is called:
A) Risk Avoidance.
COMPLETE SOLUTIONS/NEWEST UPDATE!!!
Question 1
Which of the following best describes the primary goal of IT Governance within an
organization?
A) Ensuring that the IT department has the newest hardware available.
B) Aligning IT investments and activities with the overall business strategy and goals.
C) Maximizing the number of help desk tickets resolved per hour.
D) Outsourcing all security functions to third-party vendors to reduce liability.
E) Restricting all employee access to the internet to prevent data leaks.
Correct Answer: B) Aligning IT investments and activities with the overall business strategy
and goals.
Rationale: IT Governance is about ensuring that IT provides value to the business and that
IT risks are mitigated. Its primary function is "strategic alignment," ensuring that what IT
does actually helps the company achieve its mission and objectives.
Question 2
In the "Three Lines of Defense" model for risk and control, which group constitutes the "First
Line"?
A) External Auditors and Regulators.
B) The Board of Directors and the Audit Committee.
C) Operational Management (the business units owning and managing risks).
D) Internal Audit functions providing independent assurance.
E) The Risk Management and Compliance departments.
Correct Answer: C) Operational Management (the business units owning and managing
risks).
Rationale: The first line consists of the people performing the day-to-day work who are
responsible for identifying and managing risks in their own processes. The second line
includes risk/compliance oversight, and the third line is independent internal audit.
Question 3
Which of the following is a quantitative risk assessment metric used to determine the expected
annual financial loss for a specific asset and threat?
A) Single Loss Expectancy (SLE)
B) Annual Rate of Occurrence (ARO)
C) Annual Loss Expectancy (ALE)
D) Exposure Factor (EF)
E) Risk Priority Number (RPN)
Correct Answer: C) Annual Loss Expectancy (ALE)
Rationale: ALE is calculated by multiplying the SLE (the cost of a single event) by the ARO
, 2
(how many times that event happens per year). This provides a dollar value that helps
management decide how much to spend on a control.
Question 4
A company decides to purchase a cyber-insurance policy to cover potential losses from a data
breach. Which risk treatment strategy is the company employing?
A) Risk Mitigation
B) Risk Avoidance
C) Risk Acceptance
D) Risk Transference
E) Risk Rejection
Correct Answer: D) Risk Transference
Rationale: Risk transference involves shifting the financial impact of a risk to a third party,
such as an insurance company. The risk still exists, but the burden of payment for the loss
is shared or moved.
Question 5
Which regulation primarily governs the privacy and security of "Protected Health Information"
(PHI) in the United States?
A) Sarbanes-Oxley Act (SOX)
B) General Data Protection Regulation (GDPR)
C) Health Insurance Portability and Accountability Act (HIPAA)
D) Payment Card Industry Data Security Standard (PCI-DSS)
E) Gramm-Leach-Bliley Act (GLBA)
Correct Answer: C) Health Insurance Portability and Accountability Act (HIPAA)
Rationale: HIPAA sets the national standard for protecting sensitive patient health
information from being disclosed without the patient’s consent or knowledge.
Question 6
What is the main purpose of a Business Impact Analysis (BIA)?
A) To identify the specific hacker group likely to attack the company.
B) To determine the criticality of business processes and the impact of their interruption.
C) To list all the software versions currently running on the server.
D) To provide a legal defense in the event of a compliance audit.
E) To calculate the exact cost of a new firewall.
Correct Answer: B) To determine the criticality of business processes and the impact of their
interruption.
Rationale: The BIA is a foundational step in Business Continuity Planning. it identifies
which business functions are most vital and establishes Recovery Time Objectives (RTO)
and Recovery Point Objectives (RPO).
, 3
Question 7
Under the GDPR, what is the maximum fine for a severe violation?
A) $10,000 USD.
B) 2% of annual global turnover or €10 million, whichever is higher.
C) 4% of annual global turnover or €20 million, whichever is higher.
D) A temporary suspension of all business activities in Europe.
E) Mandatory jail time for the Chief Information Officer (CISO).
Correct Answer: C) 4% of annual global turnover or €20 million, whichever is higher.
Rationale: GDPR is known for its heavy enforcement. Serious infringements, such as
violating the basic principles for processing or data subject rights, can lead to these
substantial fines.
Question 8
Which of the following is considered a "Detective" control?
A) A firewall blocking unauthorized incoming traffic.
B) Security awareness training for employees.
C) Reviewing system access logs to identify unauthorized login attempts.
D) Locking the door to the server room.
E) Using a complex password policy.
Correct Answer: C) Reviewing system access logs to identify unauthorized login attempts.
Rationale: Detective controls are designed to identify that an event has already occurred or
is in progress. Log reviews, motion sensors, and intrusion detection systems (IDS) are
classic examples.
Question 9
The "COBIT" framework (Control Objectives for Information and Related Technologies) is most
closely associated with which pillar of GRC?
A) Government.
B) Risk.
C) Compliance.
D) Governance.
E) Resilience.
Correct Answer: D) Governance.
Rationale: COBIT is a world-renowned framework for the governance and management of
enterprise IT. It provides a comprehensive set of "enablers" to help businesses bridge the
gap between technical issues and business risks.
Question 10
An organization identifies a risk but determines that the cost of a countermeasure is higher than
the potential loss. They decide to take no further action. This is called:
A) Risk Avoidance.
