LATEST GRC GENERAL PEST AND RODENT CONTROL
TEST ALL 160 ACTUAL TEST QUESTIONS AND CORRECT
DETAILED ANSWERS (100% CORRECT VERIFIED
ANSWERS) LATEST UPDATES 2024 |ALREADY GRADED
A+ (FULL REVISED EXAM)
Information on the Cards - ANSWER: GRC Fundamentals is from Card 1 - 197
R&C Implementation is from Card 198 onwards
What is GRC? - ANSWER: System of people, processes and technology that allows an
organisation to achieve goals while addressing potential risk and acting within legal
boundaries
What are the GRC related applications? - ANSWER: - Policy and Compliance
- Risk
- Audit
- Vendor Risk
Issue with GRC in an 'old-work' model? - ANSWER: Work is too manual, slow and
siloed
Different types of departments that use GRC? - ANSWER: - IT
- Finance
- HR
- Audit
- Security
What are 3 core Applications GRC is divided into? - ANSWER: - Policy and Compliance
- Risk
- Audit Management
Explain the Policy and Compliance application - ANSWER: Allows for the creation of
policies, standards and controls that can be mapped to regulations and best
practices. It also provides structured workflows for identification, assessment and
monitoring of controls
Explain the Risk application - ANSWER: Allows for enterprise and IT risks to be
identified, assessed and monitored. It also provide structured workflows for risk
assessments, risk indicators and risk issues
Explain the Audit Management application - ANSWER: Allows audit engagement to
be planned, executed and reported on. It helps to ensure the risk and compliance
strategies being implemented, are effective.
,What's the other GRC Application and what does it do? - ANSWER: Vendor Risk -
Ensures that the use of service providers and third party suppliers has no potential
impact on business health.
Note: Vendor Risk App can be used with GRC application or can be standalone.
What are the 4 types of GRC roles? - ANSWER: - Governance (e.g - approver_user)
- Admins (e.g - sn_compliance.admin)
- Managers (e.g - sn_compliance.manager)
- Users (e.g - sn_compliance.user)
What kind of hierarchy are GRC roles in? - ANSWER: Parallel hierarchy
What is the hierarchy? - ANSWER: Admin -> Manager -> User -> Reader
What is special about the sn_audit.user role? - ANSWER: It contains
sn_compliance.reader and sn_risk.reader roles to allow access to audit that data
Whats an Authority Document? - ANSWER: The regulations, certifications, standards
and best practices than an organisation requires to be compliant with their
regulations
Whats a Control? - ANSWER: The actual activity performed by the organisation to be
compliant. Contains information such as owner, frequency, status. Can be linked to
policies, authority documents and Risks
Whats a Citation? - ANSWER: A section of an Authority Document that defines a
standard to which a business process must comply. It is used to relate Controls to
Authority Documents.
Whats an Indicator? - ANSWER: Metric used to measure data against Controls and
Risks.
Whats an Issue? - ANSWER: A GRC task that allows user to document Control and
Risk Issues and monitor if the Issue has been accepted or remediated.
Whats a Policy? - ANSWER: An internal practice that a business process performs to
stay compliant and reduce risks. Approved policies are published to the KB.
Whats a Policy Statement / Control Objective - ANSWER: Details about a single
internal practice that a business process follows within a Policy
Whats a Test Plan? - ANSWER: A audit test of the design and operating effectiveness
of a Control
,Whats UCF (Unified Compliance Framework)? - ANSWER: A database serving as a
single point of management over hundreds of complex IT requirements from around
the world. Contains all available Authority Documents.
Risk Framework - ANSWER: Contains Risk Statements and accountability for the
associated risks. Its a process of managing risks.
Risk Statement - ANSWER: A defined consequence that can occur if a vulnerability is
exploited
Risk - ANSWER: A vulnerability that could adversely affect the organisation if
exploited. Can be related to any item such as Policy, Control and Remediation Task.
Risk Criteria - ANSWER: Quantitative or Qualitative values against which the level of
a Risk is evaluated
Residual Score, Risk and Likelihood - ANSWER: The score, level and likelihood of a
risk AFTER a response strategy is implemented
Inherent Score, Risk and Likelihood - ANSWER: The score, level and likelihood of a
risk BEFORE a response strategy is implemented
Qualitative Impact - ANSWER: Risk Impact x Risk Likelihood
Quantitative Impact - ANSWER: SLE x ARO = ALE
Calculated Score - ANSWER: Derived from the inherent score and the residual score
as an overall outcome
Whose in the Implementation team? - ANSWER: Platform Team
CMDB Builder
ServiceNow Dev
UI Designer
Internal Audit
CMDB Process Owner
Security Operations
Can Authority Documents be downloaded from the UCF? - ANSWER: Yes, they can be
downloaded and they're updated quarterly by the UCF.
Can anyone user download and import data from the UCF into ServiceNow? -
ANSWER: No, if a user is downloading Authority Documents and the linked citations
+ control objectives, they must have UCF account to import the data.
What are the fields in an Authority Document? - ANSWER: Source, Source ID, Valid
From, Valid To, Version, Citations (in related list).
, - Source and Source ID are used to compare new content in UCF to existing content
in the GRC Application
- Valid From and Valid To date arent imported when a document is downloaded from
UCF
Can Citations have children - ANSWER: Yes, child citations are listed in the Citations
related list. There is also a field on the form, used to hold the Parent Citation.
Why is a lot of data greyed out? - ANSWER: All information imported from the UCF is
read-only regardless of role. Only the UCF can update this info.
Authority Document Types - ANSWER: - Standard - Defines measurable attributes of
process that must be satisfied to be compliant.
- Contractual Obligation - Agreement with an outside Organisation.
- Guideline - Best practice for implementing a process
- Bill or Acts - Contains laws, created by a legislative authority.
- Documentation - Containing evidence/instructions/other info
- Regulation or Statute - Rules of Procedures, sourced from a government or
regulatory authority
What is 'test once, satisfy many'? - ANSWER: A setting in GRC that allows Control
Objectives to be mapped to many Citations from different Authority Documents.
What can be downloaded from the UCF? - ANSWER: - Authority Documents
- Citations
- Control Objectives
Controls can't be downloaded
Aim of the Source field on an Authority Document - ANSWER: Used to show if the
Document is from the UCF or not.
Value = UCF, if it is
Value = Blank, if it isnt. Instead imported from a file such as Excel or CSV
Any Document imported from UCF also had a Source ID attached to it.
What can actually be selected from UCF to download - ANSWER: Only Authority
Documents!
TEST ALL 160 ACTUAL TEST QUESTIONS AND CORRECT
DETAILED ANSWERS (100% CORRECT VERIFIED
ANSWERS) LATEST UPDATES 2024 |ALREADY GRADED
A+ (FULL REVISED EXAM)
Information on the Cards - ANSWER: GRC Fundamentals is from Card 1 - 197
R&C Implementation is from Card 198 onwards
What is GRC? - ANSWER: System of people, processes and technology that allows an
organisation to achieve goals while addressing potential risk and acting within legal
boundaries
What are the GRC related applications? - ANSWER: - Policy and Compliance
- Risk
- Audit
- Vendor Risk
Issue with GRC in an 'old-work' model? - ANSWER: Work is too manual, slow and
siloed
Different types of departments that use GRC? - ANSWER: - IT
- Finance
- HR
- Audit
- Security
What are 3 core Applications GRC is divided into? - ANSWER: - Policy and Compliance
- Risk
- Audit Management
Explain the Policy and Compliance application - ANSWER: Allows for the creation of
policies, standards and controls that can be mapped to regulations and best
practices. It also provides structured workflows for identification, assessment and
monitoring of controls
Explain the Risk application - ANSWER: Allows for enterprise and IT risks to be
identified, assessed and monitored. It also provide structured workflows for risk
assessments, risk indicators and risk issues
Explain the Audit Management application - ANSWER: Allows audit engagement to
be planned, executed and reported on. It helps to ensure the risk and compliance
strategies being implemented, are effective.
,What's the other GRC Application and what does it do? - ANSWER: Vendor Risk -
Ensures that the use of service providers and third party suppliers has no potential
impact on business health.
Note: Vendor Risk App can be used with GRC application or can be standalone.
What are the 4 types of GRC roles? - ANSWER: - Governance (e.g - approver_user)
- Admins (e.g - sn_compliance.admin)
- Managers (e.g - sn_compliance.manager)
- Users (e.g - sn_compliance.user)
What kind of hierarchy are GRC roles in? - ANSWER: Parallel hierarchy
What is the hierarchy? - ANSWER: Admin -> Manager -> User -> Reader
What is special about the sn_audit.user role? - ANSWER: It contains
sn_compliance.reader and sn_risk.reader roles to allow access to audit that data
Whats an Authority Document? - ANSWER: The regulations, certifications, standards
and best practices than an organisation requires to be compliant with their
regulations
Whats a Control? - ANSWER: The actual activity performed by the organisation to be
compliant. Contains information such as owner, frequency, status. Can be linked to
policies, authority documents and Risks
Whats a Citation? - ANSWER: A section of an Authority Document that defines a
standard to which a business process must comply. It is used to relate Controls to
Authority Documents.
Whats an Indicator? - ANSWER: Metric used to measure data against Controls and
Risks.
Whats an Issue? - ANSWER: A GRC task that allows user to document Control and
Risk Issues and monitor if the Issue has been accepted or remediated.
Whats a Policy? - ANSWER: An internal practice that a business process performs to
stay compliant and reduce risks. Approved policies are published to the KB.
Whats a Policy Statement / Control Objective - ANSWER: Details about a single
internal practice that a business process follows within a Policy
Whats a Test Plan? - ANSWER: A audit test of the design and operating effectiveness
of a Control
,Whats UCF (Unified Compliance Framework)? - ANSWER: A database serving as a
single point of management over hundreds of complex IT requirements from around
the world. Contains all available Authority Documents.
Risk Framework - ANSWER: Contains Risk Statements and accountability for the
associated risks. Its a process of managing risks.
Risk Statement - ANSWER: A defined consequence that can occur if a vulnerability is
exploited
Risk - ANSWER: A vulnerability that could adversely affect the organisation if
exploited. Can be related to any item such as Policy, Control and Remediation Task.
Risk Criteria - ANSWER: Quantitative or Qualitative values against which the level of
a Risk is evaluated
Residual Score, Risk and Likelihood - ANSWER: The score, level and likelihood of a
risk AFTER a response strategy is implemented
Inherent Score, Risk and Likelihood - ANSWER: The score, level and likelihood of a
risk BEFORE a response strategy is implemented
Qualitative Impact - ANSWER: Risk Impact x Risk Likelihood
Quantitative Impact - ANSWER: SLE x ARO = ALE
Calculated Score - ANSWER: Derived from the inherent score and the residual score
as an overall outcome
Whose in the Implementation team? - ANSWER: Platform Team
CMDB Builder
ServiceNow Dev
UI Designer
Internal Audit
CMDB Process Owner
Security Operations
Can Authority Documents be downloaded from the UCF? - ANSWER: Yes, they can be
downloaded and they're updated quarterly by the UCF.
Can anyone user download and import data from the UCF into ServiceNow? -
ANSWER: No, if a user is downloading Authority Documents and the linked citations
+ control objectives, they must have UCF account to import the data.
What are the fields in an Authority Document? - ANSWER: Source, Source ID, Valid
From, Valid To, Version, Citations (in related list).
, - Source and Source ID are used to compare new content in UCF to existing content
in the GRC Application
- Valid From and Valid To date arent imported when a document is downloaded from
UCF
Can Citations have children - ANSWER: Yes, child citations are listed in the Citations
related list. There is also a field on the form, used to hold the Parent Citation.
Why is a lot of data greyed out? - ANSWER: All information imported from the UCF is
read-only regardless of role. Only the UCF can update this info.
Authority Document Types - ANSWER: - Standard - Defines measurable attributes of
process that must be satisfied to be compliant.
- Contractual Obligation - Agreement with an outside Organisation.
- Guideline - Best practice for implementing a process
- Bill or Acts - Contains laws, created by a legislative authority.
- Documentation - Containing evidence/instructions/other info
- Regulation or Statute - Rules of Procedures, sourced from a government or
regulatory authority
What is 'test once, satisfy many'? - ANSWER: A setting in GRC that allows Control
Objectives to be mapped to many Citations from different Authority Documents.
What can be downloaded from the UCF? - ANSWER: - Authority Documents
- Citations
- Control Objectives
Controls can't be downloaded
Aim of the Source field on an Authority Document - ANSWER: Used to show if the
Document is from the UCF or not.
Value = UCF, if it is
Value = Blank, if it isnt. Instead imported from a file such as Excel or CSV
Any Document imported from UCF also had a Source ID attached to it.
What can actually be selected from UCF to download - ANSWER: Only Authority
Documents!
