ISC2 CGRC (Certified in Governance, Risk and
Compliance) Practice Test Exam
Domain 1: Governance (Questions 1-20)
,Question 1
What is the PRIMARY purpose of an information security governance framework?
A) To eliminate all security risks
B) To align security objectives with business objectives
C) To replace the need for security controls
D) To transfer risk to third parties
Answer: B
Rationale: Information security governance exists to ensure security activities support and align with
organizational goals and objectives. It cannot eliminate all risks (A), does not replace controls (C), and
risk transfer is just one treatment option, not the purpose of governance (D).
Question 2
Which of the following BEST describes the relationship between governance and management?
,A) They are the same thing
B) Governance sets direction; management executes it
C) Management sets direction; governance executes it
D) Governance is only concerned with IT
Answer: B
Rationale: Governance establishes strategic direction, oversight, and accountability, while management
implements and executes those directives. They are distinct but complementary (A is incorrect).
Governance is broader than IT alone (D). Governance does not execute; it directs (C).
Question 3
A Chief Information Security Officer (CISO) reports directly to the Board of Directors. What does this
PRIMARILY demonstrate?
A) The CISO has operational control
, B) Security has appropriate organizational stature and independence
C) The CISO owns all risks
D) IT is unimportant
Answer: B
Rationale: Direct reporting to the Board indicates security is elevated to an appropriate level of visibility
and independence, which is a governance best practice. The CISO doesn't necessarily have operational
control (A), doesn't solely own all risks (C), and this doesn't diminish IT (D).
Question 4
Which framework is MOST commonly used for IT governance?
A) COBIT
B) PCI DSS
C) HIPAA
D) NIST SP 800-53
Compliance) Practice Test Exam
Domain 1: Governance (Questions 1-20)
,Question 1
What is the PRIMARY purpose of an information security governance framework?
A) To eliminate all security risks
B) To align security objectives with business objectives
C) To replace the need for security controls
D) To transfer risk to third parties
Answer: B
Rationale: Information security governance exists to ensure security activities support and align with
organizational goals and objectives. It cannot eliminate all risks (A), does not replace controls (C), and
risk transfer is just one treatment option, not the purpose of governance (D).
Question 2
Which of the following BEST describes the relationship between governance and management?
,A) They are the same thing
B) Governance sets direction; management executes it
C) Management sets direction; governance executes it
D) Governance is only concerned with IT
Answer: B
Rationale: Governance establishes strategic direction, oversight, and accountability, while management
implements and executes those directives. They are distinct but complementary (A is incorrect).
Governance is broader than IT alone (D). Governance does not execute; it directs (C).
Question 3
A Chief Information Security Officer (CISO) reports directly to the Board of Directors. What does this
PRIMARILY demonstrate?
A) The CISO has operational control
, B) Security has appropriate organizational stature and independence
C) The CISO owns all risks
D) IT is unimportant
Answer: B
Rationale: Direct reporting to the Board indicates security is elevated to an appropriate level of visibility
and independence, which is a governance best practice. The CISO doesn't necessarily have operational
control (A), doesn't solely own all risks (C), and this doesn't diminish IT (D).
Question 4
Which framework is MOST commonly used for IT governance?
A) COBIT
B) PCI DSS
C) HIPAA
D) NIST SP 800-53
