ISC2 ISSAP QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Architect for Governance, Compliance, and Risk Management (16 questions)
1. Which of the following BEST describes the primary purpose of a security architecture review board?
A. To approve all firewall rule changes
B. To ensure security architecture aligns with business strategy and risk appetite
C. To perform penetration testing
D. To manage incident response
Answer: B
Rationale: A security architecture review board provides governance by ensuring architecture decisions align
with business objectives and the organization's risk appetite. Firewall changes, pen testing, and incident
response are operational, not governance-level functions.
2. A company must comply with PCI DSS. Which requirement MOST directly impacts security architecture?
A. Annual security awareness training
B. Network segmentation between cardholder data environment and other networks
,C. Background checks for employees
D. Incident response plan testing
Answer: B
Rationale: PCI DSS requires network segmentation to isolate the cardholder data environment (CDE). This is a
fundamental architectural decision, whereas training, background checks, and IR testing are procedural.
3. Which risk treatment strategy involves transferring risk to a third party?
A. Risk avoidance
B. Risk mitigation
C. Risk transference
D. Risk acceptance
Answer: C
Rationale: Risk transference shifts financial impact to another party, typically via insurance or outsourcing.
Avoidance eliminates the activity; mitigation reduces it; acceptance retains it.
4. In an enterprise architecture, which layer is MOST concerned with business processes and strategy?
, A. Business architecture
B. Data architecture
C. Application architecture
D. Technology architecture
Answer: A
Rationale: Business architecture defines the business strategy, governance, organization, and key business
processes. The other layers support the business layer.
5. Which of the following is the BEST example of a compensating control?
A. Installing antivirus software
B. Using network segmentation when encryption is not feasible
C. Conducting a risk assessment
D. Writing a security policy
Answer: B
Rationale: A compensating control is an alternative measure used when a primary control cannot be
implemented. Segmentation can compensate for lack of encryption. Antivirus is a primary control; risk
assessment and policy are not controls themselves.
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Architect for Governance, Compliance, and Risk Management (16 questions)
1. Which of the following BEST describes the primary purpose of a security architecture review board?
A. To approve all firewall rule changes
B. To ensure security architecture aligns with business strategy and risk appetite
C. To perform penetration testing
D. To manage incident response
Answer: B
Rationale: A security architecture review board provides governance by ensuring architecture decisions align
with business objectives and the organization's risk appetite. Firewall changes, pen testing, and incident
response are operational, not governance-level functions.
2. A company must comply with PCI DSS. Which requirement MOST directly impacts security architecture?
A. Annual security awareness training
B. Network segmentation between cardholder data environment and other networks
,C. Background checks for employees
D. Incident response plan testing
Answer: B
Rationale: PCI DSS requires network segmentation to isolate the cardholder data environment (CDE). This is a
fundamental architectural decision, whereas training, background checks, and IR testing are procedural.
3. Which risk treatment strategy involves transferring risk to a third party?
A. Risk avoidance
B. Risk mitigation
C. Risk transference
D. Risk acceptance
Answer: C
Rationale: Risk transference shifts financial impact to another party, typically via insurance or outsourcing.
Avoidance eliminates the activity; mitigation reduces it; acceptance retains it.
4. In an enterprise architecture, which layer is MOST concerned with business processes and strategy?
, A. Business architecture
B. Data architecture
C. Application architecture
D. Technology architecture
Answer: A
Rationale: Business architecture defines the business strategy, governance, organization, and key business
processes. The other layers support the business layer.
5. Which of the following is the BEST example of a compensating control?
A. Installing antivirus software
B. Using network segmentation when encryption is not feasible
C. Conducting a risk assessment
D. Writing a security policy
Answer: B
Rationale: A compensating control is an alternative measure used when a primary control cannot be
implemented. Segmentation can compensate for lack of encryption. Antivirus is a primary control; risk
assessment and policy are not controls themselves.
