CGRC Practice Test 1 — 10 Questions

Question 1

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Accepted Answer

It reduces the level of effort for the security assessment. A FedRAMP-authorized CSP has already undergone an independent, NIST SP 800-53-based security assessment by a Third-Party Assessment Organization (3PAO) and received an Authority to Operate (ATO) from a federal agency. Federal agencies (and organizations leveraging FedRAMP reciprocity) can reuse that assessment package—the SSP, SAR, and POA&M—rather than performing a full independent assessment of the CSP's environment. This reuse dramatically reduces the level of effort, cost, and time required for the customer's own security authorization activities.

Answer

It guarantees the system will never be breached

Answer

It eliminates the need for any internal security oversight

Answer

It allows the organization to bypass the RMF

Question 2

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

Accepted Answer

Update the SSP to reflect the actual implementation and document the change in the configuration management process.. The correct answer is to update the SSP to reflect the actual implementation. The SSP is a living document that must accurately describe the system's security controls. When an effective control is implemented differently than documented, the SSP should be revised to maintain consistency. This ensures that continuous monitoring and future assessments are based on accurate information.

Answer

Revert the control to match the SSP because the SSP is the authoritative document.

Answer

Initiate a security impact analysis to determine if the change is significant.

Answer

Take no action because the control is still effective and the discrepancy is minor.

Question 3

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. A self-assessment is an audit performed by an internal department to evaluate the effectiveness of security controls without external pressure. It is a proactive internal review that helps identify gaps and improve security posture before external audits occur. This type of audit is typically conducted by internal audit teams or security personnel within the organization.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 4

You are the GRC lead for a U.S. federal agency. A system has an Authorization to Operate (ATO) that expires in 90 days. The system owner submits a revised System Security Plan (SSP) and a new security assessment report showing all controls are still effective, but no changes have been made to the system since the last authorization. According to NIST SP 800-37 Rev. 2, what is the most appropriate action to maintain the authorization?

Accepted Answer

Update the authorization package with the new SSP and assessment results, and continue ongoing authorization without a new authorization decision.. Ongoing authorization allows a system to maintain its ATO through continuous monitoring rather than periodic reauthorization. When no significant changes have occurred and controls are assessed as effective, the authorizing official can continue the authorization based on updated documentation. This approach is risk-based and avoids unnecessary reassessment while ensuring the system remains compliant.

Answer

Allow the ATO to expire and operate the system under an interim authority to test (IATT) until a new authorization can be completed.

Answer

Request a waiver from the authorizing official to extend the ATO indefinitely without any further monitoring or documentation.

Answer

Initiate a full reauthorization process, including a new security assessment of all controls and a new authorization decision.

Question 5

Which document provides the formal authority to operate a system?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document (also called the Authorization to Operate, ATO, or in NIST RMF terms the authorization package's decision) is the formal artifact in which the Authorizing Official accepts the risk and grants authority to operate the system. It is the official record that the system may be placed into operation based on the assessed controls and residual risk.

Answer

System Security Plan

Answer

Risk Assessment Report

Answer

Security Control Assessment

Question 6

A GRC officer is preparing for an annual assessment of a system's continuous monitoring program. The officer must ensure that the program's documentation reflects the current state of security controls. Which of the following artifacts is MOST important to review to verify that the continuous monitoring program is effectively tracking control changes?

Accepted Answer

The continuous monitoring strategy and the associated metrics and reports.. The continuous monitoring strategy and its associated metrics and reports are the most important artifacts because they directly document how controls are monitored, what data is collected, and how that data is reported. This provides verifiable evidence that the program is actively tracking control changes and effectiveness, as required by NIST SP 800-137. Other documents support the program but do not replace the core monitoring artifacts.

Answer

The configuration management plan and change logs.

Answer

The plan of action and milestones (POA&M) and its status reports.

Answer

The system security plan (SSP) and its recent updates.

Question 7

A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact is specifically designed to depict the system boundary and its interfaces?

Accepted Answer

Authorization Boundary Diagram. The Authorization Boundary Diagram is the artifact specifically created to depict the system boundary, including components and interfaces. It provides a clear visual scope for the assessment and is essential for the Authorizing Official to understand what is being authorized. Other documents like the SSP reference the boundary but do not serve as the primary depiction.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Privacy Impact Assessment (PIA)

Question 8

During a system compliance review, the Security Control Assessor (SCA) issues a finding that a critical security control is only partially implemented. The system owner disagrees and wants to proceed with authorization. As the Information System Security Officer (ISSO), what should you do FIRST?

Accepted Answer

Request that the SCA reconsider the finding by providing additional evidence that demonstrates the control is fully implemented.. The ISSO should first attempt to resolve the disagreement by providing additional evidence to the SCA. If the SCA maintains the finding, it becomes a risk that the AO must accept or mitigate. Proceeding directly to a POA&M or AO escalation skips the necessary step of validating the assessment finding.

Answer

Advise the system owner to submit a Plan of Action and Milestones (POA&M) for the partial control and proceed with authorization.

Answer

Escalate the issue to the Authorizing Official (AO) immediately and recommend denying the Authorization to Operate (ATO).

Answer

Document the disagreement in the System Security Plan (SSP) and allow the Authorizing Official (AO) to make the final risk-based decision.

Question 9

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Accepted Answer

The percentage reduction in repeat audit findings.. A Board of Directors cares about outcomes that reduce organizational risk and cost while improving compliance posture. A reduction in repeat audit findings demonstrates that the GRC program is not just identifying issues but driving durable remediation — the same problems are not recurring. This metric ties GRC activity directly to improved control effectiveness and lower regulatory exposure, which is the language of the boardroom.

Answer

The number of tickets opened in the GRC helpdesk.

Answer

The total storage space consumed by evidence files.

Answer

The number of users logged into the GRC platform daily.

Question 10

You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a commercial cloud service provider (CSP) for infrastructure as a service (IaaS). The CSP has a FedRAMP authorization at the Moderate impact level. Your system requires additional controls beyond the CSP's baseline. Which action should you take first to address the gap?

Accepted Answer

Implement a control overlay that adds the necessary controls and documents them in the system security plan.. The first step is to implement a control overlay to add the necessary controls to the CSP's Moderate baseline. Overlays are designed to tailor baselines for specific environments or impact levels, enabling the system to meet its security requirements without disrupting the CSP's authorization. This approach is efficient and aligns with NIST guidance.

Answer

Require the CSP to obtain a new FedRAMP authorization at the High impact level before proceeding.

Answer

Document the gap as a risk and accept it without additional controls, since the CSP is already authorized.

Answer

Select a different CSP that already has a FedRAMP High authorization and migrate the system.