CGRC Practice Test 12 — 15 Questions

Question 1

You are tailoring the NIST SP 800-53 Rev. 5 Moderate baseline for a system that will be deployed in a tactical edge environment with limited network connectivity. The system processes sensitive but unclassified information. Which TWO of the following actions are appropriate when scoping and tailoring controls for this environment? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identify controls that rely on continuous network connectivity and consider compensating controls that operate offline.. The appropriate actions are to identify controls that require network connectivity and implement compensating controls, and to apply an overlay for wireless and ruggedized hardware. These steps tailor the baseline to the tactical edge environment while maintaining necessary security. Removing incident response or contingency controls, or arbitrarily raising the impact level, are not valid tailoring actions.

Answer

Increase the baseline to High impact to compensate for the lack of connectivity.

Answer

Remove all controls related to incident response because the environment is disconnected from the enterprise network.

Answer

Mark the contingency planning controls as Not Applicable because the system is not connected to primary data centers.

Question 2

A financial services firm is expanding its GRC program and needs to establish a formal governance structure. The Chief Information Security Officer (CISO) has been asked to define the roles and responsibilities for overseeing risk decisions across business units. Which of the following is the MOST appropriate first step to ensure accountability and alignment with organizational objectives?

Accepted Answer

Create a Risk Management Charter that defines the governance structure, roles, and decision-making authority.. Establishing a formal governance structure begins with a Risk Management Charter, which defines the program's authority, scope, roles, and decision-making processes. This document ensures that all subsequent activities—such as risk assessments, tool implementation, and register creation—are aligned with organizational objectives and have clear accountability. Without this foundation, GRC efforts risk being fragmented and ineffective.

Answer

Develop a risk register that captures all identified risks and assigns risk owners.

Answer

Conduct a risk assessment workshop with business unit leaders to identify top risks.

Answer

Implement a GRC tool to automate risk assessments and reporting across all business units.

Question 3

A financial services firm is implementing a GRC program to satisfy multiple regulatory frameworks (e.g., GDPR, SOX, PCI DSS). The compliance team currently maps controls separately for each regulation, resulting in duplicated effort and inconsistent evidence. The CISO wants to streamline by identifying common controls that satisfy multiple requirements. Which approach should the GRC practitioner recommend?

Accepted Answer

Implement a control mapping matrix that links each regulatory requirement to a unified set of internal controls, enabling reuse of evidence across frameworks.. The correct answer is to implement a control mapping matrix that links regulatory requirements to a unified set of internal controls. This enables the organization to collect evidence once and reuse it across multiple frameworks, reducing duplication and improving consistency. It is a foundational GRC practice for managing multiple regulations efficiently and is scalable as new requirements emerge.

Answer

Create separate GRC workspaces for each regulation to ensure regulatory-specific evidence is isolated and auditors cannot confuse requirements.

Answer

Outsource all compliance mapping to an external auditor who will provide a unified control set annually.

Answer

Adopt the strictest requirement from each regulation as the baseline control and apply it universally, ignoring overlaps.

Question 4

You are tailoring a NIST SP 800-53 baseline for a new system. The system owner asks you to identify the reasons why a control might be marked as 'Not Applicable' during tailoring. Which two of the following are valid reasons for marking a control as 'Not Applicable'? (Choose two.)

Accepted Answer

The control is not relevant to the system's technology or environment.. A control can be marked Not Applicable during tailoring when it is not relevant to the system's technology or environment, or when the system does not process the type of information the control protects. These are valid, risk-based justifications that must be documented. Cost, inheritance, and personal preference are not valid reasons; inheritance means the control is still applicable, and cost or preference must be addressed through risk acceptance or compensating controls.

Answer

The control is not applicable because the system owner prefers not to implement it.

Answer

The control is too expensive to implement.

Answer

The control is already implemented by a common control provider and is inherited.

Question 5

A financial services firm must comply with GLBA Safeguards Rule. The security team is implementing encryption for data at rest on a new PostgreSQL database. Which of the following is the most appropriate control to protect the data if the underlying storage media is physically stolen?

Accepted Answer

Implement full disk encryption (FDE) on the database server's volumes.. Full disk encryption is the most effective control against physical theft of storage media because it encrypts all data on the disk, including the operating system, database files, and temporary files. Database-level or file-level encryption may leave parts of the system unprotected, allowing an attacker to extract sensitive information from unencrypted areas. For GLBA compliance, FDE provides a strong safeguard for data at rest.

Answer

Apply file-level encryption to the PostgreSQL data directory.

Answer

Use column-level encryption for all sensitive fields.

Answer

Enable Transparent Data Encryption (TDE) at the database level.

Question 6

A security analyst is defining the authorization boundary for a new financial system hosted entirely within a commercial cloud Infrastructure as a Service (IaaS) environment. The system consists of virtual machines, a managed database service, and a load balancer, all provisioned by the organization's cloud team. The cloud provider's physical data center and hypervisor layer are outside the organization's direct control. According to NIST SP 800-37 Rev. 2, which statement best describes how the authorization boundary should be defined?

Accepted Answer

The boundary includes the virtual machines, managed database service, and load balancer, but excludes the cloud provider's hypervisor and physical infrastructure.. The authorization boundary is defined by the components the organization directly controls and that are necessary for the system's operation. In an IaaS deployment, the organization controls the virtual machines, managed database, and load balancer, so these belong inside. The cloud provider's hypervisor and physical infrastructure are outside the boundary and are covered by the provider's own authorizations and FedRAMP packages.

Answer

The boundary must include the entire cloud region, because all resources in a region share the same physical network and management plane.

Answer

The boundary includes only the virtual machines and the managed database, because the load balancer is a shared network device and must be excluded.

Answer

The boundary includes the virtual machines, managed database, load balancer, and the underlying cloud infrastructure because the system cannot operate without it.

Question 7

A GRC analyst is reviewing the organization's risk register and notices that a risk related to third-party data storage has a high inherent risk score but a low residual risk score. The analyst needs to explain to management why the residual risk is low. Which factor should the analyst cite as the primary reason?

Accepted Answer

Effective controls have been implemented to mitigate the risk.. The correct answer is that effective controls have been implemented. Residual risk is calculated by assessing the risk after considering the mitigating effects of controls. If controls are effective, they reduce the likelihood or impact, resulting in a lower residual risk score. This is a core concept in risk management and explains the difference between inherent and residual risk.

Answer

The risk has been transferred to a cyber insurance policy.

Answer

The risk appetite for third-party data storage is very high.

Answer

The risk has been avoided by discontinuing the third-party relationship.

Question 8

A retail company is implementing a new point-of-sale (POS) system that must comply with PCI-DSS. The security manager is reviewing the network architecture and wants to ensure that the POS systems are isolated from the corporate network. Which of the following controls best achieves this isolation while allowing necessary communication with the payment processor?

Accepted Answer

Place the POS systems in a separate VLAN with strict firewall rules.. Placing POS systems in a separate VLAN with strict firewall rules provides network segmentation, which is a PCI-DSS requirement to isolate the cardholder data environment from other networks. This control restricts traffic to only necessary communications, such as with the payment processor, reducing the risk of lateral movement from a compromised corporate network. Other options address different risks and do not achieve the required isolation.

Answer

Use a next-generation firewall (NGFW) at the corporate perimeter.

Answer

Enable full disk encryption on all POS terminals.

Answer

Install host-based intrusion prevention systems (HIPS) on each POS terminal.

Question 9

A GRC analyst is designing a key risk indicator (KRI) dashboard for the executive committee. The goal is to provide early warning signals for risks that could impact strategic objectives. Which TWO of the following characteristics are MOST important for effective KRIs? (Choose two.)

Accepted Answer

KRIs should be predictive and provide leading indicators of risk exposure.. Effective KRIs must be predictive, providing early warning through leading indicators, and quantifiable for consistent measurement and trend analysis. These characteristics enable the executive committee to anticipate risks and take proactive action. Historical data and infrequent updates are lagging and reactive, while uncoordinated KRIs undermine enterprise-wide risk visibility.

Answer

KRIs should be tailored to individual business units without central oversight.

Answer

KRIs should be updated annually to align with strategic planning cycles.

Answer

KRIs should be based on historical loss data to ensure accuracy.

Question 10

A federal agency is deploying a cloud-based case management system. The system uses a virtual private cloud (VPC) for compute, a managed database service, and an external identity provider for authentication. The security team must define the authorization boundary. Which approach best aligns with NIST SP 800-37 and FIPS 199?

Accepted Answer

Define the boundary to include all components that process, store, or transmit system data, including the identity provider if it enforces access to the system.. The authorization boundary must include every component that processes, stores, or transmits system data, as well as those that enforce security controls. The identity provider enforces authentication, so it belongs within the boundary. Excluding it or relying solely on a provider's authorization would leave the agency unable to assess its own risk. A correct boundary ensures accurate FIPS 199 categorization and a valid authorization decision.

Answer

Include only the physical servers and network devices located in the agency's data center, treating all cloud services as external dependencies.

Answer

Include only the VPC and managed database, since the identity provider is a separate external service and always outside the boundary.

Answer

Use the cloud provider's existing FedRAMP authorization for the entire infrastructure and exclude all components from the agency's boundary.

Question 11

A system owner is preparing to submit a system for authorization. The system processes sensitive but unclassified information. The Authorizing Official (AO) requires a formal document that describes the system's security controls and how they are implemented. Which document should the system owner provide?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the document that describes the system's security controls and their implementation. It is a key input to the authorization process and is prepared by the system owner. The SAR is an assessment output, the POA&M addresses weaknesses, and the ATO letter is the authorization decision. Therefore, the system owner must provide the SSP.

Answer

Security Assessment Report (SAR)

Answer

Authorization to Operate (ATO) letter

Answer

Plan of Action and Milestones (POA&M)

Question 12

You are leading a security assessment team using the NIST Risk Management Framework (RMF). During the 'Assess' step, your team must determine the overall effectiveness of the security controls implemented in a new system. The system owner asks which activities are essential to complete this assessment step. (Choose two.)

Accepted Answer

Develop a security assessment plan (SAP) that defines the scope, methods, and procedures for assessing each control.. The Assess step in the RMF requires developing a security assessment plan (SAP) and producing a security assessment report (SAR). These artifacts ensure that the assessment is systematically planned and that results are clearly documented for decision-makers. Tabletop exercises, penetration tests, and continuous monitoring are valuable but belong to other phases or are specialized techniques, not essential activities for completing the Assess step.

Answer

Conduct a tabletop exercise to simulate a cyber attack and evaluate the incident response team's performance.

Answer

Implement a continuous monitoring strategy to track control effectiveness over time.

Answer

Perform a penetration test to identify vulnerabilities in the system's external interfaces.

Question 13

A government agency is implementing a new case management system that will store sensitive law enforcement data. The GRC team must ensure that the system meets the requirements of the Criminal Justice Information Services (CJIS) Security Policy. The agency's CIO asks for a control that ensures only authorized personnel can access the system and that their activities are tracked. Which combination of controls should be implemented?

Accepted Answer

Role-based access control and audit logging. The CJIS Security Policy requires access control and audit logging to protect sensitive data. Role-based access control ensures that only authorized personnel can access the system based on their roles, while audit logging tracks their activities. Other options either do not provide activity tracking or use less appropriate access control models for this context.

Answer

Single sign-on and security awareness training

Answer

Mandatory access control and data encryption

Answer

Discretionary access control and intrusion detection

Question 14

During an assessment of a federal information system, you are evaluating the implementation of the access control policy. You discover that the system administrator has granted temporary elevated privileges to a user for a critical maintenance task, but the privileges were not revoked after the task was completed. According to NIST SP 800-53A, which assessment method would best verify the effectiveness of the account management control?

Accepted Answer

Examine the system's audit logs and account management records to verify that temporary privileges were revoked within the required timeframe.. Examining audit logs and account management records is the best method because it provides objective, verifiable evidence of whether temporary privileges were revoked as required. Interviews and policy reviews are subjective or indirect, and testing may not reveal the full extent of the issue. The assessment should focus on actual system data to determine control effectiveness.

Answer

Test the system by attempting to access resources using the user's account to see if elevated privileges are still active.

Answer

Interview the system administrator to understand the process for granting and revoking temporary privileges.

Answer

Review the organization's access control policy to ensure it requires timely revocation of temporary privileges.

Question 15

You are conducting a security assessment of a cloud service provider's environment. The provider claims that its system meets the FedRAMP Moderate baseline. As part of your assessment, you need to verify that the provider has implemented the required continuous monitoring activities. Which document should you review to find the provider's continuous monitoring strategy and deliverables?

Accepted Answer

The continuous monitoring plan (CMP).. The continuous monitoring plan (CMP) is the correct document because it details the ongoing monitoring strategy, including frequencies, deliverables, and responsibilities. The SSP, SAR, and POA&M serve different purposes and do not contain the comprehensive continuous monitoring strategy. Under FedRAMP, the CMP is a key artifact for ensuring sustained compliance.

Answer

The system security plan (SSP).

Answer

The security assessment report (SAR).

Answer

The plan of action and milestones (POA&M).