CGRC Practice Test 10 — 10 Questions

Question 1

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

Accepted Answer

Control ID prefix.. Control identifiers in NIST 800-53 follow a format such as AC-2, where 'AC' refers to the Access Control family.

Answer

Control priority tag.

Answer

The assignment statement.

Answer

The control parameter list.

Question 2

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Accepted Answer

The overlay supplements the baseline.. Overlays are used to augment the base control set; they don't replace the baseline but tailor it for a specific context.

Answer

The overlay is used only if the system is High impact.

Answer

The baseline is discarded if an overlay is used.

Answer

The overlay replaces the entire baseline.

Question 3

Which THREE factors should an organization consider when applying control overlays?

Accepted Answer

The mission or business requirements of the system.. Overlays must be carefully integrated to ensure they maintain compliance while addressing specific environmental factors.

Answer

The personal preference of the system administrator.

Answer

The date the system was originally purchased.

Question 4

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. A boundary diagram or description is required for the System Security Plan to define what is subject to assessment.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 5

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

Accepted Answer

Apply a 'Status Filter' to the dashboard widget on 'Verified'.. Workflow-driven reporting or 'Dashboard Filters' based on record state ensure that reports only reflect validated data.

Answer

Create a separate dashboard for every assessment status.

Answer

Restrict user access to the 'Verified' status.

Answer

Set the report to auto-refresh every minute.

Question 6

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

Accepted Answer

To serve as a comprehensive list of all possible security controls.. The catalog serves as the central repository from which organizations select appropriate controls based on their system-specific security needs.

Answer

To automate the scanning process.

Answer

To mandate the order of implementation.

Answer

To identify which vendors are compliant.

Question 7

Which TWO of the following are considered 'common controls'?

Accepted Answer

Physical building access badges.. Common controls are typically provided by centralized entities, such as physical security or network boundary protection.

Answer

The custom source code of a business logic application.

Answer

Application-specific encryption keys.

Answer

The specific database schema of a custom app.

Question 8

You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?

Accepted Answer

That the common control provider provides evidence of compliance.. For inherited controls, the system owner must verify the 'Inheritance Agreement' or the 'Common Control Provider' documentation to ensure the control is actually in place and operating correctly.

Answer

That the control is listed in the system's own configuration guide.

Answer

That the system owner has full administrative control.

Answer

That the control is manually tested by the system team.

Question 9

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Accepted Answer

Availability.. FIPS 199 defines three objectives: Confidentiality, Integrity, and Availability. You are selecting two from this list.

Answer

Authentication.

Answer

Accountability.

Answer

Non-repudiation.

Question 10

Which of the following describes a 'Hybrid' control?

Accepted Answer

A control with shared responsibility between the organization and the system.. A hybrid control is a control where both the organization (or provider) and the information system share responsibility for implementation.

Answer

A control that covers both physical and logical security.

Answer

A control that is always automated.

Answer

A control that is used in both cloud and on-premise environments.