WGU D486 DFN1 TASK 1: GOVERNANCE, RISK, AND COMPLIANCE
EXAM 2026 NEWEST EXAM WITH COMPLETE QUESTIONS AND
CORRECT ANSWERS WITH RATIONALES | ALREADY GRADED A+|
|BRAND NEW VERSION!!
SECTION 1: GRC FUNDAMENTALS AND CORE CONCEPTS (Questions 1-25)
1. What is the primary purpose of governance in the context of information
security?
A) To ensure the organization makes a profit
B) To align an organization's information security program with its long-term
strategic goals and regulatory policies
C) To reduce the number of employees
D) To eliminate all risks
Answer: B
Rationale: Governance is the framework that ensures information security
strategy aligns with business objectives and regulatory requirements. It provides
oversight and direction to ensure security decisions support the organization's
mission and risk appetite. GRC is about building resilient organizations, not just
avoiding fines.
2. Which of the following is NOT a key component of GRC (Governance, Risk, and
Compliance)?
A) Governance
B) Risk Management
C) Compliance
D) Marketing Strategy
Answer: D
Rationale: GRC stands for Governance, Risk, and Compliance. Marketing strategy
is not a component of GRC. The three pillars are interconnected: governance
provides the framework, risk management identifies and mitigates threats, and
compliance ensures adherence to laws and regulations.
1
,3. What does "alignment" mean in the context of information security
governance?
A) Ensuring security controls are applied equally to all systems
B) Aligning security controls with business strategy so that security becomes an
enabler, not a blocker
C) Making sure all employees have the same access level
D) Aligning all systems to use the same operating system
Answer: B
Rationale: Alignment means that security controls and strategies are designed to
support and enable business objectives rather than impede them. When security
is aligned with business strategy, it becomes a value-adding function rather than a
hindrance.
4. What is meant by "tone at the top" in governance?
A) The volume of the CEO's voice
B) The ethical and risk management culture established by leadership
C) The number of executives in the organization
D) The organization's marketing message
Answer: B
Rationale: "Tone at the top" refers to the ethical culture and risk management
mindset set by senior leadership. When leaders demonstrate commitment to
governance and compliance, it permeates throughout the organization and
influences employee behavior and decision-making.
5. The "Three Lines of Defense" model in GRC includes:
A) IT, HR, and Finance
B) Operational Management, Risk and Compliance Functions, and Internal Audit
C) Firewall, Antivirus, and IDS
D) Physical, Administrative, and Technical Controls
Answer: B
2
,Rationale: The Three Lines of Defense model is a widely accepted framework for
GRC. The first line is operational management (front-line risk owners). The second
line includes risk management and compliance functions (risk oversight). The
third line is internal audit (independent assurance). This structure ensures clear
accountability and separation of duties.
6. Which of the following best describes "risk appetite"?
A) The total amount of risk an organization is willing to accept in pursuit of its
objectives
B) The complete elimination of all risk
C) The maximum fine an organization can pay
D) The number of security incidents per year
Answer: A
Rationale: Risk appetite is the amount of risk an organization is willing to accept in
pursuit of its strategic objectives. It is a key input to risk management decisions
and helps determine which risks to accept, mitigate, transfer, or avoid.
7. "Risk tolerance" differs from risk appetite in that it refers to:
A) The total risk the organization faces
B) The specific level of risk that is acceptable for a particular risk category or
objective
C) The organization's ability to recover from a risk event
D) The regulatory requirements for risk management
Answer: B
Rationale: Risk tolerance is the specific, measurable level of acceptable variation
from the risk appetite for a particular risk category. While risk appetite is broad
and strategic, risk tolerance is more granular and operational.
8. Which of the following is the correct order of the risk management process?
A) Identify, Assess, Respond, Monitor, Communicate
B) Assess, Identify, Respond, Monitor, Communicate
C) Respond, Assess, Identify, Monitor, Communicate
D) Monitor, Identify, Assess, Respond, Communicate
3
, Answer: A
Rationale: The risk management process follows a logical flow: Identify the risks,
Assess (analyze and evaluate) them, Respond (treat, transfer, accept, or avoid),
Monitor (track changes), and Communicate (report to stakeholders). This is a
continuous cycle.
9. Compliance in the GRC context refers to:
A) Following only internal policies
B) Adhering to laws, regulations, and internal policies
C) Only following industry best practices
D) Avoiding all legal action
Answer: B
Rationale: Compliance means adhering to all applicable laws, regulations,
standards, and internal policies. It ensures the organization meets its legal and
regulatory obligations and operates within acceptable ethical boundaries.
10. Which of the following is an example of a "regulatory compliance"
requirement?
A) ISO 27001 certification
B) COBIT framework implementation
C) HIPAA Privacy Rule
D) PCI DSS self-assessment
Answer: C
Rationale: HIPAA (Health Insurance Portability and Accountability Act) Privacy
Rule is a federal regulation that mandates how protected health information must
be handled. This is a regulatory compliance requirement, while ISO 27001 is a
voluntary standard, COBIT is a framework, and PCI DSS applies to organizations
handling cardholder data.
11. The primary responsibility of a board of directors in GRC is:
A) To manage daily security operations
4
EXAM 2026 NEWEST EXAM WITH COMPLETE QUESTIONS AND
CORRECT ANSWERS WITH RATIONALES | ALREADY GRADED A+|
|BRAND NEW VERSION!!
SECTION 1: GRC FUNDAMENTALS AND CORE CONCEPTS (Questions 1-25)
1. What is the primary purpose of governance in the context of information
security?
A) To ensure the organization makes a profit
B) To align an organization's information security program with its long-term
strategic goals and regulatory policies
C) To reduce the number of employees
D) To eliminate all risks
Answer: B
Rationale: Governance is the framework that ensures information security
strategy aligns with business objectives and regulatory requirements. It provides
oversight and direction to ensure security decisions support the organization's
mission and risk appetite. GRC is about building resilient organizations, not just
avoiding fines.
2. Which of the following is NOT a key component of GRC (Governance, Risk, and
Compliance)?
A) Governance
B) Risk Management
C) Compliance
D) Marketing Strategy
Answer: D
Rationale: GRC stands for Governance, Risk, and Compliance. Marketing strategy
is not a component of GRC. The three pillars are interconnected: governance
provides the framework, risk management identifies and mitigates threats, and
compliance ensures adherence to laws and regulations.
1
,3. What does "alignment" mean in the context of information security
governance?
A) Ensuring security controls are applied equally to all systems
B) Aligning security controls with business strategy so that security becomes an
enabler, not a blocker
C) Making sure all employees have the same access level
D) Aligning all systems to use the same operating system
Answer: B
Rationale: Alignment means that security controls and strategies are designed to
support and enable business objectives rather than impede them. When security
is aligned with business strategy, it becomes a value-adding function rather than a
hindrance.
4. What is meant by "tone at the top" in governance?
A) The volume of the CEO's voice
B) The ethical and risk management culture established by leadership
C) The number of executives in the organization
D) The organization's marketing message
Answer: B
Rationale: "Tone at the top" refers to the ethical culture and risk management
mindset set by senior leadership. When leaders demonstrate commitment to
governance and compliance, it permeates throughout the organization and
influences employee behavior and decision-making.
5. The "Three Lines of Defense" model in GRC includes:
A) IT, HR, and Finance
B) Operational Management, Risk and Compliance Functions, and Internal Audit
C) Firewall, Antivirus, and IDS
D) Physical, Administrative, and Technical Controls
Answer: B
2
,Rationale: The Three Lines of Defense model is a widely accepted framework for
GRC. The first line is operational management (front-line risk owners). The second
line includes risk management and compliance functions (risk oversight). The
third line is internal audit (independent assurance). This structure ensures clear
accountability and separation of duties.
6. Which of the following best describes "risk appetite"?
A) The total amount of risk an organization is willing to accept in pursuit of its
objectives
B) The complete elimination of all risk
C) The maximum fine an organization can pay
D) The number of security incidents per year
Answer: A
Rationale: Risk appetite is the amount of risk an organization is willing to accept in
pursuit of its strategic objectives. It is a key input to risk management decisions
and helps determine which risks to accept, mitigate, transfer, or avoid.
7. "Risk tolerance" differs from risk appetite in that it refers to:
A) The total risk the organization faces
B) The specific level of risk that is acceptable for a particular risk category or
objective
C) The organization's ability to recover from a risk event
D) The regulatory requirements for risk management
Answer: B
Rationale: Risk tolerance is the specific, measurable level of acceptable variation
from the risk appetite for a particular risk category. While risk appetite is broad
and strategic, risk tolerance is more granular and operational.
8. Which of the following is the correct order of the risk management process?
A) Identify, Assess, Respond, Monitor, Communicate
B) Assess, Identify, Respond, Monitor, Communicate
C) Respond, Assess, Identify, Monitor, Communicate
D) Monitor, Identify, Assess, Respond, Communicate
3
, Answer: A
Rationale: The risk management process follows a logical flow: Identify the risks,
Assess (analyze and evaluate) them, Respond (treat, transfer, accept, or avoid),
Monitor (track changes), and Communicate (report to stakeholders). This is a
continuous cycle.
9. Compliance in the GRC context refers to:
A) Following only internal policies
B) Adhering to laws, regulations, and internal policies
C) Only following industry best practices
D) Avoiding all legal action
Answer: B
Rationale: Compliance means adhering to all applicable laws, regulations,
standards, and internal policies. It ensures the organization meets its legal and
regulatory obligations and operates within acceptable ethical boundaries.
10. Which of the following is an example of a "regulatory compliance"
requirement?
A) ISO 27001 certification
B) COBIT framework implementation
C) HIPAA Privacy Rule
D) PCI DSS self-assessment
Answer: C
Rationale: HIPAA (Health Insurance Portability and Accountability Act) Privacy
Rule is a federal regulation that mandates how protected health information must
be handled. This is a regulatory compliance requirement, while ISO 27001 is a
voluntary standard, COBIT is a framework, and PCI DSS applies to organizations
handling cardholder data.
11. The primary responsibility of a board of directors in GRC is:
A) To manage daily security operations
4
