CGRC Practice Test 12 — 15 Questions

Question 1

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Moderate. FIPS 199 defines the high-water mark based on the highest value among the three security objectives.

Answer

Not Categorized

Answer

Low

Answer

High

Question 2

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

Accepted Answer

Implementing consistent security controls across all boundary nodes regardless of location.. Centralizing the security management and standardizing controls across locations ensures uniform protection.

Answer

Categorizing each site as a separate information system.

Answer

Excluding remote offices from the authorization boundary.

Answer

Allowing each site to define its own unique security policy.

Question 3

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Accepted Answer

Monitor. The 'Monitor' step is the final phase of the RMF, focused on ongoing compliance.

Answer

Authorize

Answer

Select

Answer

Categorize

Question 4

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

Accepted Answer

Define the boundary based on the specific services and data flows owned by the sub-system.. Clearly defining trust zones and interface points prevents the boundary from expanding unnecessarily.

Answer

Include only the database tier.

Answer

Include the entire enterprise infrastructure to be safe.

Answer

Include all internal network segments regardless of use.

Question 5

In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?

Accepted Answer

Developing treatment plans for risks exceeding appetite.. Risk identification and treatment are the primary functions of risk management within GRC.

Answer

Designing new corporate office layouts.

Answer

Writing marketing brochures for the company.

Answer

Resetting all employee passwords every 30 days.

Question 6

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

Accepted Answer

The Information System Owner (ISO).. The Information System Owner (ISO) is responsible for the categorization, which is then approved by the Authorizing Official (AO).

Answer

The Lead System Administrator.

Answer

The Chief Information Security Officer (CISO).

Answer

The Third-Party Auditor.

Question 7

Which document is mandatory to finalize the system categorization and begin the RMF process?

Accepted Answer

The FIPS 199 Security Categorization document.. The FIPS 199 Categorization document (or the categorization section of the SSP) is required to select appropriate security controls.

Answer

The Incident Response Policy.

Answer

The Penetration Test Report.

Answer

The Contingency Plan.

Question 8

Which THREE of the following are valid components of an Authorization Package?

Accepted Answer

Security Assessment Report (SAR). The Authorization Package consists of the SSP, SAR, and POA&M as the core elements for the AO.

Answer

Vendor invoices

Answer

User training records

Question 9

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

Accepted Answer

To identify controls that are implemented once and applied to multiple systems.. Common controls are inherited from the organization or another system, reducing the burden on the individual system owner.

Answer

To ensure they are manually tested for every individual system.

Answer

To increase the system's FIPS 199 impact level.

Answer

To exclude them from the System Security Plan (SSP).

Question 10

An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?

Accepted Answer

The dependency of the system on the database for operational integrity.. If the new application relies on the database for security or operational functionality, it must be included.

Answer

Whether the database is hosted in the same physical rack.

Answer

The age of the hardware.

Answer

The amount of data stored.

Question 11

When a system is undergoing a major change, what is the impact on the existing ATO?

Accepted Answer

The ATO must be re-evaluated. A major change invalidates the existing ATO because the security posture has fundamentally changed, requiring a re-assessment.

Answer

The ATO is suspended until the next fiscal year

Answer

The ATO remains valid until the expiration date

Answer

The ATO is automatically extended

Question 12

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

Accepted Answer

NIST SP 800-60.. NIST SP 800-60 is the guide for mapping information types to FIPS 199 security objectives.

Answer

NIST SP 800-37.

Answer

NIST SP 800-53.

Answer

FIPS 140-3.

Question 13

Which THREE elements are necessary for a compliant continuous monitoring program?

Accepted Answer

Configuration management of the system. Continuous monitoring requires regular assessment, tracking of changes, and reporting of the security posture.

Answer

Full system replacement every year

Answer

Daily physical site visits

Question 14

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

Accepted Answer

List the identity service as an external provider and inherit the controls.. When using shared services, the system owner documents the inheritance of controls from the shared service provider.

Answer

Force the service provider to sign a full system authorization for you.

Answer

The identity service must be fully assessed as part of your system.

Answer

Exclude the identity service from the documentation entirely.

Question 15

Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)

Accepted Answer

System interconnections and data flow paths.. An inventory must track hardware, software, and operational connections to be useful for risk management.

Answer

The employee performance evaluation score for the system admin.

Answer

The exact date of the last office coffee machine maintenance.