ISC2 CGRC QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Governance (Questions 1-20)
Question 1
What is the PRIMARY purpose of an information security governance framework?
A) To eliminate all security risks
B) To align security objectives with business objectives
C) To replace the need for security controls
D) To transfer risk to third parties
Answer: B
,Rationale: Information security governance exists to ensure security activities support and align with
organizational goals and objectives. It cannot eliminate all risks (A), does not replace controls (C), and risk
transfer is just one treatment option, not the purpose of governance (D).
Question 2
Which of the following BEST describes the relationship between governance and management?
A) They are the same thing
B) Governance sets direction; management executes it
C) Management sets direction; governance executes it
D) Governance is only concerned with IT
Answer: B
Rationale: Governance establishes strategic direction, oversight, and accountability, while management
implements and executes those directives. They are distinct but complementary (A is incorrect). Governance is
broader than IT alone (D). Governance does not execute; it directs (C).
, Question 3
A Chief Information Security Officer (CISO) reports directly to the Board of Directors. What does this
PRIMARILY demonstrate?
A) The CISO has operational control
B) Security has appropriate organizational stature and independence
C) The CISO owns all risks
D) IT is unimportant
Answer: B
Rationale: Direct reporting to the Board indicates security is elevated to an appropriate level of visibility and
independence, which is a governance best practice. The CISO doesn't necessarily have operational control (A),
doesn't solely own all risks (C), and this doesn't diminish IT (D).
Question 4
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Governance (Questions 1-20)
Question 1
What is the PRIMARY purpose of an information security governance framework?
A) To eliminate all security risks
B) To align security objectives with business objectives
C) To replace the need for security controls
D) To transfer risk to third parties
Answer: B
,Rationale: Information security governance exists to ensure security activities support and align with
organizational goals and objectives. It cannot eliminate all risks (A), does not replace controls (C), and risk
transfer is just one treatment option, not the purpose of governance (D).
Question 2
Which of the following BEST describes the relationship between governance and management?
A) They are the same thing
B) Governance sets direction; management executes it
C) Management sets direction; governance executes it
D) Governance is only concerned with IT
Answer: B
Rationale: Governance establishes strategic direction, oversight, and accountability, while management
implements and executes those directives. They are distinct but complementary (A is incorrect). Governance is
broader than IT alone (D). Governance does not execute; it directs (C).
, Question 3
A Chief Information Security Officer (CISO) reports directly to the Board of Directors. What does this
PRIMARILY demonstrate?
A) The CISO has operational control
B) Security has appropriate organizational stature and independence
C) The CISO owns all risks
D) IT is unimportant
Answer: B
Rationale: Direct reporting to the Board indicates security is elevated to an appropriate level of visibility and
independence, which is a governance best practice. The CISO doesn't necessarily have operational control (A),
doesn't solely own all risks (C), and this doesn't diminish IT (D).
Question 4
