CGRC Practice Test 10 — 10 Questions

Question 1

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an established 'Data Connector' or 'API Integration' module.. The most efficient configuration approach for ingesting CSPM data into a GRC tool is to use an established 'Data Connector' or 'API Integration' module. These modules are purpose-built to handle authentication, data mapping, scheduling, and error handling, enabling near real-time, automated, and reliable data flow with minimal custom development. This aligns with continuous monitoring principles by ensuring timely and accurate risk data without manual intervention.

Answer

Build a custom script to write directly to the GRC database tables.

Answer

Manually export and import CSV files every hour.

Answer

Have the CSPM tool email screenshots of security alerts to the GRC team.

Question 2

A federal agency is implementing controls to comply with the Federal Information Security Modernization Act (FISMA). The agency uses the NIST Risk Management Framework (RMF). During the control implementation phase, the security team must select controls based on the system's security categorization. Which NIST Special Publication provides the catalog of security and privacy controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the foundational catalog of security and privacy controls for federal information systems. Under FISMA and the RMF, agencies select controls from SP 800-53 based on their system's security categorization. SP 800-37 describes the RMF process, SP 800-30 covers risk assessments, and SP 800-171 is for nonfederal CUI systems, so they are not the control catalog.

Answer

NIST SP 800-37

Answer

NIST SP 800-171

Answer

NIST SP 800-30

Question 3

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data residency laws (e.g., GDPR, PIPEDA, Russia's Federal Law No. 242-FZ) require that certain data remain within specific geographic boundaries. Implementing data partitioning or regional access scoping in a GRC platform ensures that data is stored and processed only in approved regions and that access is restricted based on the user's region. This directly addresses the compliance requirement by enforcing logical or physical separation of data.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.

Question 4

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

Accepted Answer

Updating the asset inventory database. Option A (Updating the asset inventory database) is correct because decommissioning must be reflected in the configuration management database (CMDB) or asset register so the server is no longer tracked as an active, supported asset and any dependencies, licenses, or monitoring are removed. Option B (Cryptographic erase of the storage media) is correct because crypto-erasure destroys or invalidates the encryption key protecting the data at rest (e.g., SED/self-encrypting drive or BitLocker/LUKS key), rendering the sensitive data unrecoverable in a fast, verifiable manner. Option D (Disconnecting from the network and removing physical identity) is correct because the host must be isolated from the production network to prevent unauthorized access or data exfiltration, and asset tags, hostnames, and rack labels should be removed to prevent misidentification or reuse of a still-sensitive system. Option C is not sufficient because a single reformat only removes the file system references and leaves recoverable data remnants on the platters or cells; secure media sanitization (NIST SP 800-88 purge/destroy) is required. Option E is wrong because leaving the server powered on in the rack keeps the data accessible and the system live, which is the opposite of decommissioning.

Answer

Reformatting the drive once

Answer

Leaving the server powered on in the rack

Question 5

You are developing a security plan for a system that uses a NIST SP 800-53 control baseline. During control selection, you determine that a particular control is not applicable because the system does not have the relevant technology. How should you document this decision?

Accepted Answer

Mark the control as 'Not Applicable' and provide a rationale explaining why the control does not apply to the system.. The correct documentation is to mark the control as Not Applicable and provide a rationale. This maintains the integrity of the security plan and ensures that assessors understand the tailoring decision. It aligns with NIST SP 800-53 requirements for documenting control applicability and tailoring actions.

Answer

Replace the control with a different control from the same family that is easier to implement.

Answer

Mark the control as 'Inherited' from the service provider, even though the system does not use that technology.

Answer

Remove the control from the security plan entirely to avoid confusion during assessment.

Question 6

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

Accepted Answer

The potential impact on the organization's mission. The Authorizing Official (AO) is the senior official who accepts risk on behalf of the organization, so the risk acceptance request must articulate the mission/business impact of the unpatched vulnerability. Under NIST RMF (SP 800-37), the AO's decision hinges on how the vulnerability affects organizational operations, assets, and mission/business functions — not on technical severity alone. The potential mission impact is what allows the AO to make an informed, accountable risk decision.

Answer

The estimated cost of an upgrade

Answer

The manufacturer's release notes

Answer

The CVSS score of the vulnerability

Question 7

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

Accepted Answer

Define the frequency based on organizational policy.. In NIST SP 800-53, '[Assignment: organization-defined frequency]' is an explicit placeholder indicating that the organization must fill in the value as part of tailoring the control. The system owner, in coordination with the Authorizing Official and organizational policy, defines the frequency (e.g., annually, quarterly) and documents it in the system security plan. Leaving it blank or removing the control would break the control baseline and fail assessment.

Answer

Use the default value provided in the appendix.

Answer

Remove the control since it is not fully defined.

Answer

Leave the assignment blank.

Question 8

Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?

Accepted Answer

Applying an 'Evidence Lock' or 'Retention Policy' to the record.. An 'Evidence Lock' or 'Retention Policy' is the correct feature because it enforces immutability at the record level, preventing modification or deletion for the defined retention period (three years). This satisfies evidentiary integrity requirements by ensuring the evidence cannot be altered after collection. It also produces an auditable control that maps directly to retention and chain-of-custody obligations.

Answer

Disabling the record deletion permission for all users.

Answer

Setting the record visibility to 'Public'.

Answer

Setting the 'Draft' workflow state to permanent.

Question 9

Which THREE roles are typically involved in a security assessment?

Accepted Answer

Assessor / Auditor. The Assessor/Auditor (C) is correct because this role performs the actual evaluation of controls, gathers evidence, and reports findings against a defined framework or scope. The Chief Information Security Officer (D) is correct because the CISO owns the security program, approves the assessment scope and criteria, and receives and acts on the results at an executive level. The System Owner (E) is correct because this role is accountable for the system being assessed, provides access and documentation, and is responsible for remediating identified weaknesses. Customer support agents (A) and an external public relations firm (B) are not typically core roles in a security assessment; they may be interviewed or consulted in specific cases, but they do not own, conduct, or authorize the assessment.

Answer

Customer support agents

Answer

External public relations firm

Question 10

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Accepted Answer

The criticality of the system and the level of change in the environment.. NIST SP 800-137 (Information Security Continuous Monitoring) and SP 800-53 CA-7 tie assessment frequency to risk-based factors: the impact level of the system and the rate/volatility of change in the environment. A high-impact system with frequent changes (new code, config drift, new threats) warrants more frequent assessments than a stable low-impact system. This ensures monitoring resources are allocated proportionally to risk rather than to convenience or vendor schedules.

Answer

The availability of security personnel to perform the tests.

Answer

The vendor's recommendation for maintenance windows.

Answer

The total number of users accessing the system.