CGRC Practice Test 13 — 15 Questions

Question 1

A retail company is deploying a new point-of-sale (POS) system. The GRC analyst is asked to recommend a control that will reduce the risk of card skimming and tampering. Which type of control is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical control. Card skimming and tampering are physical threats that require physical controls such as tamper-evident seals, locks, and surveillance. These controls prevent unauthorized access to POS devices. Technical, administrative, and compensating controls do not directly address the physical nature of the threat, making them less appropriate.

Answer

Compensating control

Answer

Technical control

Answer

Administrative control

Question 2

You are the lead auditor for a CGRC assessment of a government agency's financial system. The system owner claims that a new access control mechanism has been implemented and is operating effectively. You need to gather sufficient appropriate evidence to support your conclusion. Which evidence-gathering technique provides the MOST reliable evidence regarding the operating effectiveness of this control?

Accepted Answer

Observing the system administrator perform a user provisioning task and reperforming the access review process. Observation and reperformance yield direct, objective evidence about a control's operating effectiveness. Observing the administrator perform provisioning confirms the control is executed as intended, while reperforming the access review independently validates the outcome. These techniques reduce reliance on management assertions and provide stronger assurance than interviews, document reviews, or surveys.

Answer

Interviewing the system administrator who configured the access control mechanism

Answer

Distributing a survey to all employees asking whether they believe access controls are effective

Answer

Reviewing the system security plan to confirm the control is documented

Question 3

You are conducting an audit of a cloud service provider's continuous monitoring program. The provider claims to follow NIST SP 800-137 guidelines. You need to verify that the organization's continuous monitoring strategy includes the required elements for ongoing assessment of security controls. Which TWO elements are essential components of an effective continuous monitoring program according to NIST SP 800-137? (Choose two.)

Accepted Answer

A configuration management process that tracks changes to the system. NIST SP 800-137 emphasizes a risk-based approach to continuous monitoring, including configuration management to track changes and a defined frequency for assessing controls. These elements ensure the organization maintains an accurate baseline and evaluates controls at appropriate intervals. Annual penetration tests and board-only reporting are not required, and automation is encouraged but not mandated.

Answer

An annual penetration test performed by an external third party

Answer

A process for reporting monitoring results to the board of directors only

Answer

A requirement to use only automated tools for all monitoring activities

Question 4

An organization is preparing for a compliance audit against ISO/IEC 27001. The internal audit team needs to gather evidence that the information security management system (ISMS) is operating effectively. Which activity is MOST appropriate for the team to perform?

Accepted Answer

Reviewing the ISMS scope statement and security policy. An ISO/IEC 27001 internal audit should focus on the ISMS processes and documentation. Reviewing the ISMS scope statement and security policy is a direct way to verify that the organization has established the framework for its information security management. This activity aligns with the standard's requirements for audit evidence. Other options are technical tests that do not comprehensively assess the ISMS.

Answer

Interviewing the IT manager about server uptime

Answer

Conducting a penetration test on the external network

Answer

Testing the performance of a new firewall

Question 5

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

Accepted Answer

To provide a language for checking system configuration state. OVAL (Open Vulnerability and Assessment Language) is the SCAP component that provides a standardized language for expressing system state checks — it defines how to test for specific configurations, patches, and vulnerabilities on a host. OVAL definitions contain tests, objects, states, and variables that an OVAL interpreter evaluates to produce a true/false result. This makes OVAL the 'checking' language of SCAP, distinct from other components like XCCDF (benchmarks) and CVE (vulnerability naming).

Answer

To standardize the transfer of vulnerability data

Answer

To define the severity of a vulnerability

Answer

To manage the lifecycle of a POA&M

Question 6

A system owner is defining the authorization boundary for a new information system that will process personally identifiable information (PII). The system will use a cloud-based customer relationship management (CRM) service, an on-premises database, and a web application hosted on a government-furnished server. Which TWO components should be included within the authorization boundary? (Choose two.)

Accepted Answer

The cloud-based CRM service that stores and processes PII.. The authorization boundary must include all components that process, store, or transmit system data. The cloud CRM service and the on-premises database both handle PII, so they are within the boundary. Physical security controls from a separate unit are common controls, while the ISP and web browser are external to the system's data processing. Correctly scoping the boundary ensures a complete risk assessment and accurate FIPS 199 categorization.

Answer

The web browser used by end users to access the web application.

Answer

The internet service provider (ISP) that provides connectivity to the cloud CRM service.

Answer

The physical security controls of the data center hosting the on-premises database, if they are provided by a separate facility management unit.

Question 7

You are a GRC analyst responsible for continuous monitoring of a federal information system. The system has a current ATO and is in the operations and maintenance phase. Which TWO of the following activities are required to maintain the authorization according to NIST SP 800-37 Rev. 2? (Choose two.)

Accepted Answer

Conduct ongoing security control assessments in accordance with the continuous monitoring strategy.. Maintaining an authorization in the operations and maintenance phase requires ongoing security control assessments and regular reporting to the authorizing official. These activities are part of the continuous monitoring strategy and enable ongoing authorization. They ensure that the authorizing official has current information to determine if the system's risk remains acceptable, allowing the ATO to remain valid without a full reauthorization.

Answer

Reassess all security controls at the same frequency, regardless of their criticality.

Answer

Perform a full reauthorization every three years regardless of system changes.

Answer

Update the system security plan (SSP) only when a major upgrade occurs.

Question 8

You are conducting a security assessment of a government agency's network. During evidence collection, you must ensure the integrity and authenticity of the evidence. Which TWO of the following actions are most critical to maintain the integrity of audit evidence? (Choose two.)

Accepted Answer

Document a clear chain of custody for all evidence.. Maintaining the integrity of audit evidence requires both procedural and technical controls. A chain of custody documents the handling of evidence, preventing tampering and providing accountability. Cryptographic hashing creates a unique fingerprint that detects any modification. Together, they ensure evidence remains trustworthy and verifiable. Other actions like secure storage or encryption support confidentiality but do not directly prove integrity.

Answer

Store all evidence in a centralized, access-controlled repository.

Answer

Obtain written statements from all personnel interviewed.

Answer

Encrypt evidence at rest using AES-256.

Question 9

A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which TWO factors should the analyst consider when evaluating this proposal? (Choose two.)

Accepted Answer

The current threat environment and recent vulnerability trends.. The correct answers are the criticality of the system and the sensitivity of the data it processes, and the current threat environment and recent vulnerability trends. For a high-impact system, monitoring frequency must be based on risk. System criticality and data sensitivity determine the potential impact of a compromise, while the threat environment and vulnerability trends indicate the likelihood of exploitation. These factors together inform the appropriate frequency.

Answer

The availability of automated patching tools.

Answer

The number of users who access the system daily.

Answer

The cost savings achieved by reducing the scan frequency.

Question 10

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Account management lifecycle controls govern the creation, review, disabling, and deletion of accounts, including timely disabling of inactive accounts. The failure to disable inactive accounts is a direct breakdown of the lifecycle control, which typically specifies inactivity thresholds (e.g., 30, 60, or 90 days) and automated or manual review processes. This maps to NIST SP 800-53 AC-2 (Account Management) and its enhancement AC-2(3) for disabling inactive accounts.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication

Question 11

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner wants to use automated tools to collect and analyze security-related data. Which of the following should the analyst ensure is in place to support this automation?

Accepted Answer

A security automation and continuous monitoring (SACM) architecture.. To support automated data collection and analysis in continuous monitoring, a SACM architecture is essential. It provides the standards, tools, and processes to automate the monitoring of security controls. This includes data feeds from sensors, scanners, and logs, as well as automated analysis and reporting. Without such an architecture, automation would be ad hoc and difficult to manage. The GRC analyst should ensure this foundational element is in place.

Answer

An incident response plan that includes automated containment procedures.

Answer

A manual process for correlating data from multiple sources.

Answer

A configuration management plan that defines baseline configurations.

Question 12

You are an assessor for a cloud service provider (CSP) undergoing a FedRAMP Moderate baseline assessment. During the assessment, you discover that a required control (AC-2 Account Management) is not fully implemented. According to the FedRAMP assessment process, what is the next step you must take?

Accepted Answer

Document the finding in the security assessment report (SAR) and allow the CSP to develop a plan of action and milestones (POA&M).. In the FedRAMP assessment process, when a control is found to be not fully implemented, the assessor documents it in the Security Assessment Report (SAR). The Cloud Service Provider (CSP) then creates a Plan of Action and Milestones (POA&M) to address the finding. This allows the Authorizing Official (AO) to make a risk-based decision. The assessor does not halt the assessment or immediately escalate; the process is designed to capture all findings and track remediation.

Answer

Escalate the finding to the FedRAMP Program Management Office (PMO) for immediate action.

Answer

Immediately halt the assessment and require the CSP to fix the control before continuing.

Answer

Immediately notify the CSP'sauthorizing official (AO) and recommend revocation of the authority to operate (ATO).

Question 13

A GRC analyst is reviewing the continuous monitoring results for a system that has been in operation for two years. The analyst notices that a security control for access control (AC-2) has been consistently failing automated checks for the past three months. The system owner argues that the control is not critical and wants to accept the risk. What is the most appropriate action for the analyst to take?

Accepted Answer

Escalate the finding to the authorizing official for a risk-based decision, providing details of the control failure and potential impact.. The most appropriate action is to escalate the persistent control failure to the authorizing official. This ensures that a risk-based decision is made by the proper authority, in line with continuous monitoring and RMF processes. The analyst should provide comprehensive details to support the decision, including the control's importance and the duration of the failure. This maintains compliance and security.

Answer

Modify the automated check to ignore the control failure and reduce false positives.

Answer

Document the risk acceptance in the system's risk register and continue monitoring without escalation.

Answer

Immediately disable the system until the access control issue is resolved.

Question 14

A security assessment team is planning to assess an organization's incident response capability. The team lead must ensure that the assessment covers the necessary components to evaluate the effectiveness of the incident response process. Which TWO of the following should be included in the assessment scope? (Choose two.)

Accepted Answer

Interviews with incident response team members to assess their knowledge and roles. To assess incident response capability, the team must evaluate both the documented plan and the team's readiness. Reviewing the incident response plan and procedures ensures that the organization has a structured approach. Interviewing team members verifies that they understand their roles and can execute the plan. Together, these provide a comprehensive view of the incident response process. Other options, such as backup testing or physical security, are outside the core scope of incident response assessment.

Answer

Review of the organization's acceptable use policy

Answer

Testing of the organization's backup and recovery procedures

Answer

Evaluation of the physical security controls at the data center

Question 15

You are conducting a security impact analysis for a proposed change to a system that has an existing Authority to Operate (ATO). The change involves migrating the database to a new cloud service provider. Which TWO of the following factors are most critical to evaluate in this analysis? (Choose two.)

Accepted Answer

The new provider's data encryption methods for data at rest and in transit.. The most critical factors in a security impact analysis for a cloud migration are the new provider's FedRAMP authorization status and inherited controls, and the provider's encryption methods for data at rest and in transit. These directly affect the system's control baseline and data protection. Cost, staffing, and timeline are not security impact factors and do not determine whether the ATO remains valid.

Answer

The cost difference between the old and new cloud service providers.

Answer

The migration timeline and project milestones.

Answer

The number of database administrators employed by the new provider.