Quick assessment — UprootSecurity Bootcamp

Twenty questions across five skill domains. Each one tests a different capability the GRC Engineer role requires. Get them right and you know where to skip ahead. Get them wrong and you know exactly which phase to spend more time in.

There is no failure here. The quiz is for your benefit, not gatekeeping.

Reading your self-assessment results

Frameworks

Quick check

Which SOC 2 Trust Services Criterion covers logical access controls — the place IAM policies, MFA, and IdP configuration land?

CC1.1 — Control Environment

CC6.1 — Logical and Physical Access Controls

CC7.4 — Security Incidents

A1.2 — System Availability

Identity

Quick check

In AWS IAM, you want to allow a role to read objects from `s3://audit-bucket/*` but explicitly nothing else. What's the smallest correct policy shape?

"Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::audit-bucket/*"

"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::audit-bucket/*"

"Effect": "Allow", "Action": "s3:Get*", "Resource": "*"

"Effect": "Deny", "Action": "s3:DeleteObject", "Resource": "*"

Cloud fundamentals

Quick check

Your CISO asks: 'For SOC 2 CC6.1, what does AWS handle vs. what do we handle?' What's the cleanest answer?

AWS handles everything because they have their own SOC 2 report

AWS handles the physical security of the data center and hypervisor isolation; we handle IAM configuration, MFA enforcement, and access reviews

We handle everything because IAM is in our account

It depends on the contract — sometimes AWS handles MFA, sometimes we do

Code reading

Quick check

You see this in a Terraform module review. Should it pass?

aws_s3_bucket_public_access_block with all four flags set to true — yes, pass

aws_s3_bucket with acl = "public-read" — yes, pass because we control which bucket

aws_iam_policy with Resource = "*" on PutObject — yes, pass because least privilege only applies to read actions

A bucket with no encryption configuration — yes, pass because S3 enables encryption by default

Audit thinking

Quick check

An external auditor asks for evidence that you remove access when an employee leaves. What's the best response?

Email screenshots of three recent terminations showing accounts being disabled

Show the offboarding playbook, the SCIM deprovisioning workflow in Okta, and the last 90 days of automated termination events from the IGA system

Show the HR policy document that says we offboard people

Ask the auditor to interview the IT manager

Data Protection

Quick check

Your company stores customer credit card numbers. Which standard specifically governs how you handle that data?

SOC 2 Type II

PCI DSS

ISO 27001

NIST CSF

Quick check

What is the difference between encryption at rest and encryption in transit?

At rest = data on disk, in transit = data moving over a network

At rest = data in RAM, in transit = data being processed by the CPU

At rest = data in a backup, in transit = data being restored

They are the same thing with different names

Quick check

An AWS KMS key has a key policy that grants Encrypt and Decrypt to a role, but also has a condition key requiring kms:ViaService = s3.us-east-1.amazonaws.com. What does the condition do?

Restricts the key to only be used by S3 in us-east-1

Allows any service to use the key as long as it is in us-east-1

Prevents the key from being deleted

Enables automatic key rotation

Endpoint Security

Quick check

What does MDM (Mobile Device Management) primarily give a security team?

The ability to monitor employee keystrokes

Visibility into device compliance (patches, encryption, security software) and the ability to enforce policies remotely

Faster internet speeds on company devices

The ability to read employee emails

Quick check

Your company uses Conditional Access policies that require a compliant device to access cloud apps. An employee complains they cannot log in from their personal laptop. What is happening?

The VPN is down

Their personal laptop is not MDM-enrolled, so the IdP blocks access because the device is not compliant

Their password expired

The cloud app is experiencing an outage

Network & Infrastructure

Quick check

What is the primary purpose of network segmentation in a cloud environment?

Making the network faster

Limiting the blast radius of a compromise — if one segment is breached, the attacker cannot move laterally to other segments

Saving money on bandwidth

Making it easier for employees to find resources

Quick check

A security group in AWS has an inbound rule allowing 0.0.0.0/0 on port 22 (SSH). Should this pass a compliance review?

Yes, SSH is encrypted so it is safe

No — 0.0.0.0/0 means the entire internet can attempt SSH connections to this resource

Yes, if the instance has a strong password

It depends on the time of day

Compliance Automation

Quick check

What is the difference between a policy and a control?

A policy says what should happen. A control is the mechanism that enforces it.

They are the same thing

A policy is technical, a control is non-technical

A control is written by management, a policy is written by engineers

Quick check

You need to prove to an auditor that your S3 buckets have been encrypted for the entire audit period (12 months). What is the strongest evidence?

A screenshot of the current S3 settings

AWS Config rule evaluation history showing s3-bucket-server-side-encryption-enabled was compliant for all 12 months

An email from the CTO saying buckets are encrypted

The AWS documentation page about S3 encryption

Quick check

What does OPA (Open Policy Agent) do?

It is an antivirus program

It evaluates policies written in Rego against structured data — used for Terraform plan validation, Kubernetes admission control, and API authorization

It manages SSL certificates

It is a log aggregation tool

Risk Management

Quick check

What is the relationship between likelihood and impact in a risk assessment?

They are added together to get the risk score

Likelihood measures how often a risk materializes, impact measures the damage when it does — they are multiplied to prioritize

Impact is always more important than likelihood

They are the same measurement on different scales

Quick check

What is the purpose of a risk register?

To list every vulnerability scan finding

To document identified risks, their likelihood, impact, and mitigation plans — connecting business objectives to security controls

To track employee performance reviews

To store backup encryption keys

Incident Response

Quick check

Under HIPAA, how many days does a covered entity have to notify affected individuals after discovering a breach of unsecured PHI?

24 hours

60 days

1 year

There is no deadline

Quick check

During an incident, what should happen BEFORE any remediation begins?

Delete the compromised server immediately

Contain the threat and preserve evidence — isolate the affected system without destroying forensic data

Send an email to all employees about the breach

Change all passwords company-wide

Quick check

What is the difference between a SOC 2 Type I and a SOC 2 Type II report?

Type I covers more controls than Type II

Type I evaluates control design at a point in time. Type II evaluates operating effectiveness over a period (typically 6-12 months).

Type II is only for healthcare companies

There is no difference — they are interchangeable

What your score tells you

16-20 correct: You have strong fundamentals across all domains. Jump to Phase 2 (Identity & Access) or Phase 8 (Translation Layer) for the depth that makes you dangerous.

11-15 correct: Solid foundation with some gaps. Start at Phase 1 (Foundations) to fill them, then move to Phase 2. Pay extra attention to the domains where you missed questions.

6-10 correct: You know some domains well and others not at all. That is the most common profile. Start at Phase 1 and work through sequentially. The phases you are strong in will go fast.

0-5 correct: Start at the beginning. The bootcamp assumes zero prerequisites. Every concept is explained from first principles. You will not be lost. Phase 0 → Phase 1 → Phase 2.

There is no leaderboard for the assessment. The point is honest calibration.