Compliance & Risk Questions

Summary

'What's the difference between SOC 2 and ISO 27001?' or 'how would you assess this vendor's risk?' — testing Phase 11's GRC knowledge, common in security analyst and GRC-track interviews.

• 1Review Phase 11 and practice explaining each compliance standard's basic purpose.
• 2Prepare to discuss how you'd build or use a risk register for a hypothetical scenario.
• 3Practice connecting a specific technical control to a specific compliance requirement.