(ISC)² · Free Practice Questions · Last reviewed May 2026
42 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which of the following is an example of a 'System Boundary' document that assists with the RMF process?
The System Security Plan (SSP) boundary description.
The SSP's boundary description explicitly documents the authorisation boundary — the people, processes, and information systems comprising the system — which directly satisfies the RMF requirement for a defined System Boundary artefact used during categorisation and control scoping.
The Annual Security Awareness Training log.
The Privacy Threshold Analysis (PTA).
The System Development Life Cycle (SDLC) policy.
A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?
Not Categorized
Low
High
Moderate
FIPS 199 applies the high-water mark rule: the overall categorisation equals the highest impact value across confidentiality, integrity and availability. Integrity and availability are both Moderate, exceeding the Low confidentiality rating, so the system is categorised Moderate.
When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?
The Lead System Administrator.
The Information System Owner (ISO).
The Information System Owner holds operational accountability for the system and its security posture, so they formally approve the FIPS 199 categorization. Authorising officials and security officers contribute input, but the ISO signs off on the final impact level.
The Chief Information Security Officer (CISO).
The Third-Party Auditor.
When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?
To ensure they are manually tested for every individual system.
To increase the system's FIPS 199 impact level.
To identify controls that are implemented once and applied to multiple systems.
Common controls are security measures inherited by multiple systems from a shared provider, such as an enterprise data centre's physical access controls. Identifying them during scoping avoids duplicating assessment effort, letting each system document inheritance rather than reimplementing the same control.
To exclude them from the System Security Plan (SSP).
Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?
Define the boundary based on the specific services and data flows owned by the sub-system.
Anchoring the boundary to services and data flows the sub-system actually owns creates an explicit, verifiable interface contract. This constrains scope to defined responsibilities, preventing adjacent capabilities from being absorbed and satisfying the System of Systems need to avoid scope creep.
Include only the database tier.
Include the entire enterprise infrastructure to be safe.
Include all internal network segments regardless of use.
You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?
The system's latest vulnerability scan report.
A comprehensive network topology diagram showing external service endpoints.
A network topology diagram maps every interconnection and external service endpoint, directly satisfying the SAP requirement to demonstrate complete interconnection inventory. Unlike prose lists, its visual structure exposes undocumented links and data flows, making omissions immediately apparent during assessment. This evidentiary completeness is what proves all system interconnections have been properly inventoried.
The organization's enterprise risk register.
A listing of all installed software patches.
Want more Scope OF System practice?
Practice this domainDuring the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?
Force an upgrade to the application
Document the compensating control and assess its effectiveness
Documenting the physically secured enclave as a compensating control directly addresses the MFA deficiency, since the SAR must record how residual risk is mitigated when a required control is absent. Assessing its effectiveness confirms the enclave genuinely constrains access, satisfying the compliance determination requirement to justify accepting the legacy application's deviation.
Immediately revoke the Authorization to Operate (ATO)
Mark the control as 'Not Applicable'
An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?
Drafting the mitigation tasks
Conducting the security controls assessment
Implementing the technical patches
Accepting the residual risk associated with the POA&M
The Authorizing Official holds risk acceptance authority, so their primary duty on a POA&M for a high-impact system is formally accepting the residual risk documented in it. That satisfies the stem's focus on the AO's decision role rather than remediation or milestone tracking.
An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?
The system is unauthorized for production use
The system is prohibited from processing sensitive data
The system must meet specific security requirements to remain authorized
An ATO with Conditions authorises operation only while the system owner remediates specified weaknesses within agreed timeframes. The authorisation remains valid contingent on meeting those security requirements; failure to satisfy them can trigger revocation or suspension of the authority to operate.
The system is permanently compliant
You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?
During the 'Categorize' step
After the 'Monitor' step
During the 'Prepare' step
After the 'Assess' step and before the 'Authorize' step
Under NIST SP 800-37 R2, the Assess step produces the Security Assessment Report, which the security assessor delivers to the Authorizing Official as evidence supporting the Authorize decision. The SAR therefore precedes authorisation, not the reverse.
You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?
The ownership and control of the components
The authorization boundary is drawn around components the organisation owns and controls, since shared external partner systems fall outside its direct authority. Ownership and control therefore determine what the boundary legitimately encompasses when data is shared externally.
The cost of the hardware
The physical location of the server racks
The number of users accessing the system
While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?
Accept the findings as-is
Escalate to the Chief Information Officer (CIO)
Request a re-assessment using the 'Test' method
Automated technical controls must be verified through testing, not interviews, which only capture assertions. Requesting reassessment using the Test method obtains objective evidence that the control operates as specified, satisfying the assessment procedure's required method.
Update the System Security Plan (SSP) to match the interview
Want more System Compliance practice?
Practice this domainYou are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?
Create a Path Rule for C:\Program Files\*
Configure the 'Audit only' mode in Group Policy
Create a Hash Rule for every existing executable
Create a Publisher Rule based on the certificate issuer and product name
A Publisher Rule validates binaries against certificate issuer and product name, so only signed software from the organisation's certificate runs. This satisfies the stem's requirement that only organisation-signed binaries execute, unlike path or hash rules which do not enforce publisher identity.
To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?
BitLocker
IPsec
dm-crypt/LUKS
dm-crypt is the Linux kernel's native transparent disk-encryption subsystem, and LUKS provides the standard on-disk format and key management on top of it. Together they deliver full disk encryption for a Linux server, meeting the PCI-DSS requirement without third-party software.
VeraCrypt
You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?
Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0
An inbound rule permitting TCP port 443 from 0.0.0.0/0 satisfies the requirement to accept HTTPS from any internet source. Security groups are stateful and default-deny all other inbound traffic, so no explicit deny rule is needed; every non-443 packet is dropped automatically.
Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0
Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0
Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32
You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?
Directly on the public ISP router
Inside the isolated guest Wi-Fi network
On a Span Port of the core distribution switch
A SPAN port mirrors traffic from the core distribution switch, so the sensor sees both internal east-west flows and external north-south traffic crossing that choke point. Placing it inline or on an access switch would miss one direction, failing the requirement to monitor both.
On the WAN interface of the firewall
You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?
OCSP Responder
Certificate Revocation List (CRL) Distribution Point
A CRL Distribution Point publishes the signed list of revoked certificates so relying parties can check revocation status during validation. Configuring it in AD CS satisfies the stem's requirement that compromised certificates be revocable, since revocation only takes effect when clients can retrieve the CRL from that location.
Key Archival
Trust Anchor
You need to enforce MFA on Microsoft Entra ID (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?
Password Protection Policy
Security Defaults
Microsoft Entra Conditional Access Policy
Conditional Access evaluates sign-in signals and enforces MFA at authentication time, covering all modern protocols and clients. This satisfies the stem's demand for the most recommended modern authentication control, unlike per-user MFA, which is legacy and cannot apply granular, signal-based conditions.
Identity Protection User Risk Policy
Want more Control Implementation practice?
Practice this domainYour organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?
The Nessus scanner plugin needs an update to recognize the patch.
The scan policy is set to 'Discovery' instead of 'Audit'.
The scan agent was decommissioned prematurely.
The vulnerability scan was not performed after the patch was applied.
Tenable.io reports status from its own scan data, not the configuration management database. If no scan ran after the patch was deployed, the vulnerability remains 'open' in Tenable despite the CMDB marking it patched, explaining the mismatch between the two records.
You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?
Immediately decommission the system.
Update the System Security Plan (SSP) and submit for re-certification.
Wait until the annual assessment cycle to review the change.
Perform a security impact analysis on the change.
NIST SP 800-37 R2 continuous monitoring requires that significant changes be assessed before authorisation continues. A security impact analysis determines whether the software update alters the system's risk posture, controls, or authorisation boundary, informing whether reauthorisation or control updates are needed.
You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?
Configuration Items (CIs).
Configuration Items define the registry key settings to detect and remediate, then deploy them through a baseline to every workstation. This directly satisfies the requirement to verify specific registry keys across all workstations, since CIs are the compliance-rule building block MECM evaluates.
Application Catalog.
Client Health Reports.
Software Metering.
When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?
Sanitize the storage media according to an approved standard.
Sanitisation removes or destroys residual data on the storage media using an approved method such as cryptographic erase or degaussing, ensuring sensitive information cannot be recovered after the hardware leaves the organisation's control. This satisfies the stem's constraint of protecting stored sensitive data before disposal, which no other decommissioning step addresses.
Update the asset inventory list.
Remove the BIOS password.
Format the primary operating system partition.
Deactivate the user accounts associated with the system.
A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?
AWS Config Remediation Actions.
AWS Config Remediation Actions pair a rule with an SSM Automation document, so non-compliant S3 buckets are corrected automatically without manual intervention. This directly satisfies the stem's requirement for automatic remediation, since Config continuously evaluates bucket ACLs and public access settings, then triggers the remediation action whenever a bucket is detected as public.
AWS CloudTrail Event Selectors.
AWS Config Aggregators.
AWS Config Conformance Packs.
You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?
Clear the file system using a standard OS format command.
Destroy the hard drive via shredding or incineration.
Shredding or incineration physically destroys the platter, so no residual magnetic state remains for laboratory recovery. This satisfies NIST SP 800-88's Purge/Destroy level for PII, exceeding cryptographic erase or degaussing where media reuse is not intended.
Overwrite the drive once with zeros.
Purge the data using a cryptographic erase (CE) method.
Want more Compliance Maintenance practice?
Practice this domainWhen selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?
To define specific parameters for control implementation.
Assignment statements in NIST 800-53 controls mark organisation-defined values, letting each organisation insert its own specifics such as frequency, roles or thresholds. They parameterise the control so it can be tailored to the organisation's risk context.
To categorize the control by its priority level.
To link the control to a regulatory requirement.
To assign the control to a specific system administrator.
An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?
Replace a control with a vendor-provided security feature.
Add additional controls to the baseline to address specific threat vectors.
Supplementing adds controls beyond the NIST SP 800-53 Rev. 5 baseline when the organisation's specific threat environment, mission, or technologies demand extra protection. Adding controls to counter identified threat vectors satisfies the authorization official's tailoring request, distinguishing supplementing from scoping or compensating control selection.
Remove controls from the baseline that are technically infeasible.
Adjust the parameters of existing controls to lower operational impact.
A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?
Risk Acceptance.
Baseline Tailoring.
Control Supplementation.
Compensating Control.
Legacy hardware prevents the baseline NIST 800-53 control from being met, so an alternative control is applied to reduce the same risk to an acceptable level. That substitution, driven by the implementation constraint, is precisely what defines a compensating control.
When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?
Control priority tag.
The assignment statement.
Control ID prefix.
Each NIST 800-53 control identifier begins with a two-letter prefix denoting its family, such as AC for access control or AU for audit. The prefix therefore identifies family membership directly, satisfying the stem's requirement without needing the control title or enhancement fields.
The control parameter list.
You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?
Replace the family with general security controls.
Keep the controls but set them to 'manual' mode.
Document the removal of the family with a justification.
Tailoring permits removal of controls that are not applicable, but the decision must be documented with justification to preserve the audit trail. Since the system processes no PII, the Privacy family can be excluded, provided the rationale is recorded in the tailoring documentation.
Implement the controls as high-priority items.
During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?
Individual systems must override the common control.
Common controls cannot be used for password complexity.
Individual systems must report their own password status.
Individual systems do not need to address password complexity.
A common control is implemented once and inherited by multiple systems, so individual systems inherit password complexity rather than reimplementing it. This satisfies the audit finding by avoiding duplicate controls across systems covered by the common control.
Want more Control Selection practice?
Practice this domainWhen conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?
To provide a language for checking system configuration state
OVAL defines an XML-based language for expressing system configuration checks, enabling SCAP tools to assess and report on a target's state. It satisfies the stem's configuration-state assessment purpose, distinct from CVE identifiers or CVSS scoring.
To standardize the transfer of vulnerability data
To define the severity of a vulnerability
To manage the lifecycle of a POA&M
You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?
Analyze Security Assessment Results
Develop the Plan of Action and Milestones (POA&M)
Assess Security Controls
Following the Prepare for Assessment phase, NIST SP 800-53A directs assessors to conduct the assessment itself, gathering evidence and examining, interviewing and testing controls against the defined scope. This 'Assess Security Controls' step produces the findings later consolidated during reporting.
Authorize the Information System
Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?
Interconnection Security Agreement
Rules of Engagement
Rules of Engagement define the authorised scope, boundaries, timing, and constraints of an assessment, forming the primary agreement between assessor and target organisation. They establish what systems may be tested, satisfying the requirement to outline audit scope before work begins.
Security Assessment Plan
Risk Assessment Report
System Security Plan
You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?
Privacy policy publication
Encryption of data at rest
Disaster recovery plan test results
The Availability criterion measures whether systems remain operable and recoverable. Disaster recovery plan test results directly evidence recovery capability and uptime commitments, unlike confidentiality or processing integrity artefacts, making them the most relevant proof for that criterion.
User access review logs
During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?
Document the weakness in a Plan of Action and Milestones (POA&M)
Documenting the weakness in a Plan of Action and Milestones satisfies FedRAMP's continuous monitoring requirement: POA&Ms formally record each identified control deficiency, assign remediation milestones, and track progress to closure. This is the mandatory mechanism auditors expect when a required control is unmet, ensuring the finding is tracked rather than left unresolved.
Immediately terminate the cloud service
Perform a penetration test
Request a waiver from the JAB
Update the System Security Plan (SSP) to reflect compliance
A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?
Running a Nessus vulnerability scan
Verifying user account permissions and group assignments
Least privilege means each account holds only the rights its role requires. Reviewing user account permissions and group assignments reveals excessive sudo, group or file access, directly satisfying the stem's requirement to verify least privilege on the Linux server.
Checking for physical server room access
Reviewing system logs for failed login attempts
Want more Assessment And Audit practice?
Practice this domainWhen aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?
The number of tickets opened in the GRC helpdesk.
The total storage space consumed by evidence files.
The number of users logged into the GRC platform daily.
The percentage reduction in repeat audit findings.
Repeat audit findings indicate control failures recurring across cycles. A reduction in these demonstrates that integrated GRC is remediating root causes and improving control effectiveness, a measurable outcome Boards understand, unlike activity or coverage metrics.
Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?
Applying an 'Evidence Lock' or 'Retention Policy' to the record.
An Evidence Lock or Retention Policy prevents modification or deletion of the stored record for the defined period, preserving it in an immutable state. This directly enforces the three-year immutability constraint the GRC programme requires for assessment evidence.
Disabling the record deletion permission for all users.
Setting the record visibility to 'Public'.
Setting the 'Draft' workflow state to permanent.
You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?
Set up a Workflow Transition Condition triggered by the 'Severity' field.
Workflow transitions allow for conditional routing based on specific metadata values.
Configure a global Business Rule to auto-close all findings.
Change the default notification email template for findings.
Modify the User Permission set for the CISO account.
An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?
Create manual spreadsheets to reconcile the data outside the GRC platform.
Force all business units to use identical risk taxonomy naming conventions.
Disable the Regulatory Requirement module to focus only on Risks.
Implement a 'Many-to-Many' relationship mapping between Controls and Regulatory Requirements.
A many-to-many mapping lets one control satisfy multiple regulatory requirements and vice versa, eliminating duplicated entries across the Risk Register and Compliance Control library. This shared relationship model is the mechanism that enables Common Control Framework reuse, resolving the data inconsistency described.
A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?
Setting all user passwords to match the local language.
Encrypting the entire GRC database with one key.
Implementing 'Data Partitioning' or 'Regional Access Scoping'.
Partitioning or scoping data by region physically constrains where records reside and who may query them, directly satisfying the residency constraint. Access is bounded by the regional boundary rather than by role alone, so cross-border reads cannot occur.
Conducting a system-wide vulnerability scan.
The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?
Update the manual risk assessment survey annually.
Configure a 'Dynamic Link' between Audit Testing Results and Risk Rating calculations.
A dynamic link propagates audit testing results directly into the control effectiveness score, so residual risk recalculates from current evidence rather than stale manual values. This satisfies the requirement that control effectiveness reflect the latest audit results automatically.
Increase the frequency of full organizational risk assessments.
Require the CISO to manually approve all risk score changes.
Want more GRC Program practice?
Practice this domainThe CGRC exam has 125 questions and must be completed in 180 minutes. The passing score is 700 out of 1,000. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 7 domains: Scope OF System, System Compliance, Control Implementation, Compliance Maintenance, Control Selection, Assessment And Audit, GRC Program. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official (ISC)² CGRC exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.