CGRC Practice Test 13 — 15 Questions

Question 1

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Accepted Answer

The system must meet specific security requirements to remain authorized. An ATO with conditions means the system can operate, but specific security gaps must be closed within a defined timeframe to maintain authorization.

Answer

The system is unauthorized for production use

Answer

The system is prohibited from processing sensitive data

Answer

The system is permanently compliant

Question 2

Which TWO of the following are responsibilities of the Authorizing Official?

Accepted Answer

Signing the authorization decision. The AO is the final risk decision maker and is accountable for the system's security status.

Answer

Conducting the scan

Answer

Writing the user manual

Answer

Updating the firewall rules

Question 3

Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?

Accepted Answer

The impact on the security control baseline. The magnitude of the change and the impact on the security controls are the two key triggers for re-authorization.

Answer

The color of the server casing

Answer

The number of administrative staff

Answer

The age of the hardware

Question 4

Which THREE types of information should be included in a risk acceptance memo?

Accepted Answer

Description of the identified risk. Risk acceptance must document the specific risk, the impact, and the duration or justification for accepting it.

Answer

The name of the software vendor

Answer

The technical specifications of the server

Question 5

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

Accepted Answer

Failure to perform annual control testing as part of continuous monitoring.. NIST SP 800-37 R2 requires that security controls are monitored and assessed frequently enough to maintain an ongoing authorization.

Answer

The organization failed to report the breach to the US-CERT.

Answer

The system failed to undergo a full re-accreditation.

Answer

The System Security Plan (SSP) was not updated in the FISMA database.

Question 6

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. Configuration Items (CIs) in MECM allow you to define settings and verify compliance across client systems.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 7

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Accepted Answer

/etc/ssh/sshd_config. The sshd_config file contains the 'PermitRootLogin' directive which must be set to 'no' for compliance.

Answer

/etc/hosts.allow

Answer

/etc/shadow

Answer

/etc/passwd

Question 8

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Accepted Answer

Whether the change negatively impacts existing security controls.. The change's impact on security controls, the risk level of the system, and the requirement for re-testing are critical evaluation points.

Answer

The expected cost savings from the change.

Answer

The color scheme of the new user interface.

Question 9

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Sanitizing the media is the most critical step to prevent unauthorized access to data remaining on the physical hardware.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 10

You are managing access to a file server. You want to ensure that users can read files but not delete them. What is this an example of?

Accepted Answer

Read-Only permission. This is the principle of Least Privilege, specifically using NTFS permissions to restrict write/delete access.

Answer

Modify permission

Answer

Full Control

Answer

Write permission

Question 11

Which TWO of the following should be considered when selecting a GRC platform for an enterprise-wide program?

Accepted Answer

Scalability of the platform to handle increasing data volumes.. Integration capabilities and scalability are vital for enterprise deployments.

Answer

The vendor's ability to provide free hardware for testing.

Answer

The physical location of the vendor's headquarters.

Answer

The complexity of the vendor's logo design.

Question 12

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

Accepted Answer

The cloud provider's System Security Plan (SSP) or Authorization Package. A FedRAMP Authorization Package or a third-party audit report (like SOC 2) is the standard evidence for cloud compliance.

Answer

The service level agreement (SLA)

Answer

The organization's internal risk register

Answer

The network topology map

Question 13

An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?

Accepted Answer

Implement a 'Many-to-Many' relationship mapping between Controls and Regulatory Requirements.. CCF mapping involves linking a single control implementation to multiple regulatory requirements to reduce testing burden.

Answer

Create manual spreadsheets to reconcile the data outside the GRC platform.

Answer

Force all business units to use identical risk taxonomy naming conventions.

Answer

Disable the Regulatory Requirement module to focus only on Risks.

Question 14

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Accepted Answer

System Security Plan (SSP).. The System Security Plan and the associated configuration baselines must be kept current to reflect the system's actual state.

Answer

The vendor's hardware sales catalog.

Answer

Employee Handbook.

Answer

Corporate financial statements.

Question 15

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Accepted Answer

The criticality of the system and the level of change in the environment.. NIST guidance suggests that the frequency of monitoring should be based on the risk level of the system and the volatility of the environment.

Answer

The availability of security personnel to perform the tests.

Answer

The vendor's recommendation for maintenance windows.

Answer

The total number of users accessing the system.