stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
GRC Idiocy Flashcards | StudBud
Explore
/
GRC Idiocy
GRC Idiocy
32 terms
·
StudBud Administration
·
65 plays
Imported from external platform
Flashcards
32 cards
F
Practice quiz
P
Host live
L
Questions
32
Answers
1
What OWASP issue arises from using old and unpatched software?
Encryption weakness
Vulnerable or outdated components
Security misconfiguration
Injection attacks
2
According to the COSO framework, which of the following is not listed as a component of enterprise risk management?
Risk Assessment
External Oversight
monitoring
Control Environment
3
Which of these is not listed as one of the six core functions in NIST Cybersecurity Framework 2.0?
Identify
Protect
Recover
Encrypt
4
In the Three Lines Model, what is the key duty of the first line of defense?
Daily oporations
Predict future risks
Analyse threat visualizations
Record previous incidents
5
Who should define cybersecurity responsibilities within a GRC structure?
Technical support staff
Executive or senior leaders
SOC level 1 workers
External contractors
6
What is the role of a cybersecurity policy in an organization?
Block all internet activity
Update passwordxs
Monitor staff behavior
Provide rules for secure behavior and data protection
7
What is the goal of the Recover function in the NIST Cybersecurity Framework?
Restore operations after an incident
Stop cyberattacks before they happen
Assess risks and impacts
Protectr data before an incident
8
What is a GRC platform mainly used for in cybersecurity?
Manage public websites
Find malware
Manage public websites
Track risks, policies, and compliance activities
9
Why is governance important for cybersecurity programs?
It helps meet regulations and control risk effectively
It upgrades infrastructure
It replaces internal audits
It allows for freedom to choose rules
10
During which phase of the Secure Software Development Lifecycle are risks identified and security goals set?
Secure Design
Deployment
Deployment
Planning
11
What type of audit checks if employees follow cybersecurity rules?
Hardware check
Finacial Audit
Compliance audit
Legal audit
12
What does a risk register usually contain?
List of known attackers
Risks, their likelihood, and possible impact
Staff contact details
Staff contact details
13
Which international standard helps measure risk management maturity in cybersecurity?
OWASP
ISO/31000
ISO/14001
GDPR
14
During which phase of the Secure Software Development Lifecycle are risks identified and security goals set?
Secure Design
Deployment
Planning
Deployment
15
What action is forbidden under HIPAA without a patient’s permission?
Installing firewalls
Sharing private data with unauthorized people
Saving health records
Selling data and sharing profits
16
How does HIPAA protect personal health information?
Requiring security policies and technical controls
Physical security
Blocking internet use
Using locked file cabinets
17
Which NIST 2.0 function helps ensure systems can take action after a cyber incident?
Business Continuity
Business Continuity
Risk Avoidance
Incident Response
18
Which of these is not considered a pillar of the Qatar 2022 Cybersecurity Framework?
Detection
response
Prevention
Monitoring
19
Which OWASP risk is related to gaining access without proper authorization?
Phishing
Injection
Cryptographic Failures
Poor/weakAccess control
20
In Business Continuity Planning, what is the main focus of the “Recover” function under NIST 2.0?
Ending the need for recovery systems
Ensuring operations continue during and after incidents
Stopping attacks before they occur
Changing passwords
21
What is one advantage of having a strong cybersecurity culture in an organization?
Less need for security software
Less need for security software
Better compliance and fewer insider risks
Increased profit margins
22
Which phrase best describes GRC in the context of cybersecurity?
Antivirus software package
A structured mix of governance, risk management, and compliance
A checklist of legal items
Physical security
23
Why do many cybersecurity frameworks recommend using encryption?
It removes all insider threats
It blocks every type of data breach
It helps stop unauthorized access to data
It improves both physical and digital security
24
What do risk mitigation strategies primarily focus on?
Lowering the effects of possible risks
Eliminating all risks
Ignoring low-level threats
Ignoring low-level threats
25
What was the main purpose of Qatar’s 2022 Cybersecurity Framework?
Provide a national approach to managing cybersecurity
Apply GDPR rules locally
Protect World Cup financial transactions
Bulid Encrptiion for banks
26
What does the Risk Assessment step in COSO aim to do?
Enforce legal policies
Build firewalls
Find and evaluate risks
Naming APTs
27
What is the main responsibility of Internal Audit under the Three Lines Model?
Watch for cybersecurity threats
Set up IT controls
Give independent advice on governance and controls
Enforce External laws
28
What is the top cause of compliance failures according to the 2024 Verizon Data Breach Report?
Accidental human errors
Poor frameworks
purposful human errors
Weak internal systems
29
Which NIST 2.0 function helps ensure systems can take action after a cyber incident?
Business Continuity
disastor recovery
Incident Response
Risk Avoidance
30
What OWASP issue arises from using old and unpatched software?
Injection attacks
Security misconfiguration
Vulnerable or outdated components
Vulnerable or outdated components
31
What is one core feature of strong compliance in cybersecurity?
Ongoing checks and improvements
You needn't do repeated training
Once-a-year assessments
Avoiding all regulations
32
What is the main goal of cybersecurity governance within an organization?
Block access to all devices
Train employees in technical tasks
Align security actions with business or mission goals
Allow for freedom when following recomendations
