CGRC Practice Test 14 — 15 Questions

Question 1

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

Accepted Answer

Disaster recovery plan test results. The Availability criterion in SOC 2 Trust Services Criteria focuses on ensuring systems are available for operation and use as committed or agreed. Disaster recovery plan test results are the most relevant evidence because they demonstrate the organization's ability to recover from disruptions and maintain availability. The other options relate to different criteria: privacy, confidentiality, or security.

Answer

Privacy policy publication

Answer

Encryption of data at rest

Answer

User access review logs

Question 2

What is the primary role of the Security Control Assessor (SCA)?

Accepted Answer

To determine the effectiveness of the security controls. The Security Control Assessor (SCA) is responsible for evaluating the security controls implemented in an information system to determine their effectiveness in meeting the security requirements. This role is defined in NIST SP 800-37, the Risk Management Framework (RMF), where the SCA conducts assessments to produce evidence for the Authorizing Official's risk-based decision. The SCA does not implement controls, remediate vulnerabilities, or accept risk; those are the responsibilities of the system owner, information system security officer, and authorizing official, respectively.

Answer

To implement the security controls

Answer

To remediate vulnerabilities

Answer

To accept the risk on behalf of the agency

Question 3

A global retailer's GRC team is preparing for an external audit and must demonstrate that a specific regulatory requirement has been satisfied over the past twelve months, not merely at a point in time. Which evidence-collection strategy best supports this assertion?

Accepted Answer

Retaining time-stamped system logs and automated control test results spanning the full audit period. Demonstrating that a control operated over a twelve-month period requires evidence generated throughout that period. Time-stamped logs and recurring automated test results provide that continuous record and reveal any gaps or failures. Point-in-time screenshots, verbal assurances, and policy documents each establish something weaker, such as configuration at a moment, belief, or intent.

Answer

Interviewing the control owner and documenting their verbal assurance that the control operated all year

Answer

Collecting a single screenshot of the control configuration taken on the last day of the audit period

Answer

Providing the original policy document that mandates the control, signed by the Chief Information Security Officer

Question 4

A financial services firm's GRC team is defining measurable objectives for its governance program. The chief risk officer wants to demonstrate that the program is not only operating but also improving over time. Which set of performance indicators BEST supports this goal?

Accepted Answer

Percentage of high risks with approved treatment plans and trend in overdue remediation items. Demonstrating improvement requires outcome-oriented indicators, not activity or volume counts. Tracking the share of high risks with approved treatment plans shows governance rigor, while the trend in overdue remediation items reveals whether execution is getting better or worse. Together they provide a directional view of program effectiveness that activity metrics cannot deliver.

Answer

Average time to close audit findings and number of audit findings per year

Answer

Total number of controls documented and total number of risk assessments completed

Answer

Number of policies published and number of committee meetings held per quarter

Question 5

What is the primary benefit of mapping regulatory requirements to internal controls in a GRC platform?

Accepted Answer

It reduces the burden of redundant testing for multiple frameworks.. Mapping regulatory requirements to internal controls creates a many-to-many relationship where a single control can satisfy multiple regulations (e.g., one access-control policy satisfies SOX, PCI DSS, and ISO 27001). This eliminates duplicate testing and evidence collection, reducing the total compliance workload. It is the core value proposition of a GRC platform.

Answer

It reduces the number of employees required to manage the platform.

Answer

It makes the GRC platform look more professional.

Answer

It hides the compliance gaps from external auditors.

Question 6

Which TWO of the following should be considered when selecting a GRC platform for an enterprise-wide program?

Accepted Answer

Scalability of the platform to handle increasing data volumes.. Option C is correct because an enterprise-wide GRC program accumulates large volumes of risk, control, and compliance data across business units, so the platform must scale to handle increasing data volumes without performance degradation. Option D is correct because a GRC platform must integrate with existing IT and security infrastructure (e.g., SIEM, vulnerability scanners, CMDB, identity systems) via APIs or connectors to automate evidence collection and maintain accurate, real-time risk visibility. Options A, B, and E are not valid selection criteria: free testing hardware, vendor headquarters location, and logo design have no bearing on the functional capability, scalability, or integration fitness of a GRC platform.

Answer

The vendor's ability to provide free hardware for testing.

Answer

The physical location of the vendor's headquarters.

Answer

The complexity of the vendor's logo design.

Question 7

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Accepted Answer

Network architecture diagrams.. The Authorizing Official validates the system boundary using artifacts that define what is inside the authorization boundary and how it connects to external systems. Option B, network architecture diagrams, is correct because they show the topology, subnetting, and placement of components (routers, firewalls, servers) that delineate where the boundary begins and ends. Option C, data flow diagrams illustrating external interfaces, is correct because they trace information entering and leaving the system, making explicit which external connections and interconnections cross the boundary. Option D, the System Security Plan (SSP) boundary description, is correct because the SSP formally documents the authorization boundary, including the components, users, and interconnections covered by the authorization. Options A and E are incorrect because a janitorial service contract and a holiday schedule are administrative/logistical documents unrelated to the technical or documented definition of an information system boundary.

Answer

The janitorial service contract for the building.

Answer

The organization's holiday schedule.

Question 8

When structuring a GRC program, which THREE components are critical for compliance management?

Accepted Answer

Centralized Policy Management library.. Centralized Policy Management library (A) is critical because it provides a single authoritative repository where policies are authored, versioned, approved, and distributed, ensuring consistent compliance obligations across the organization. A Comprehensive Control Library for mapping (B) is essential because it lets controls be mapped to frameworks, regulations, and risks, enabling gap analysis and evidence reuse across standards such as ISO 27001, SOC 2, and NIST. Audit and Issue tracking workflows (E) are required to log findings, assign remediation owners, track due dates, and retain evidence of corrective actions, which is the operational backbone of compliance monitoring. The remaining options do not belong: changing the system interface font (C) is a cosmetic UI preference with no bearing on governance, risk, or compliance, and a marketing tool for company social events (D) is unrelated to compliance management.

Answer

A feature to change the font of the system interface.

Answer

A marketing tool for company social events.

Question 9

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. This is an example of a compensating control. A compensating control is an alternative control implemented when the original control cannot be applied due to constraints, but it still mitigates the same risk. The system owner is substituting a different control to achieve the same security objective, which is the definition of a compensating control.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 10

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

Accepted Answer

Implement Separation of Duties. Separation of Duties (SoD) is an administrative control that divides critical functions among different individuals so that no single person has enough privileges to compromise the system. For a DBA account, SoD ensures that the ability to modify data, change schemas, and manage backups or audit logs is split across multiple roles, so a compromised DBA account cannot unilaterally cause widespread damage or cover tracks. This minimizes impact by limiting the blast radius of a single compromised account.

Answer

Disable all auditing

Answer

Store passwords in plain text

Answer

Use a single shared account

Question 11

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

Accepted Answer

Apply a 'Status Filter' to the dashboard widget on 'Verified'.. Applying a status filter to the dashboard widget so it only displays records where Assessment Completion equals 'Verified' ensures the Compliance Dashboard reflects only verified assessments. This is the standard GRC platform pattern: the widget queries the underlying assessment object and filters on the status field, so unverified or in-progress assessments are excluded from the dashboard view.

Answer

Create a separate dashboard for every assessment status.

Answer

Restrict user access to the 'Verified' status.

Answer

Set the report to auto-refresh every minute.

Question 12

When a system is undergoing a major change, what is the impact on the existing ATO?

Accepted Answer

The ATO must be re-evaluated. Under NIST RMF (SP 800-37) and FedRAMP continuous monitoring guidance, an ATO is tied to a specific, baselined system configuration and the risk determination made at the time of authorization. A major change—such as new functionality, a new data type, a new interconnection, or a significant architecture shift—invalidates that risk determination because the security posture may have materially changed. The AO must therefore have the change re-assessed (a reauthorization or significant-change review) before the system can continue operating under the existing authorization.

Answer

The ATO is suspended until the next fiscal year

Answer

The ATO remains valid until the expiration date

Answer

The ATO is automatically extended

Question 13

In VMware vSphere, what is the best practice for securing virtual machine consoles?

Accepted Answer

Use the VMRC (VMware Remote Console) with encrypted connections. The VMware Remote Console (VMRC) is the supported, secure method for accessing VM consoles in vSphere. It establishes an encrypted TLS connection to the ESXi host or vCenter, ensuring that console traffic—including keystrokes and screen data—cannot be intercepted. Using VMRC also integrates with vSphere permissions, so access is auditable and role-based, unlike raw VNC or shared credentials.

Answer

Share the ESXi root password

Answer

Disable all logging

Answer

Leave the VNC port open

Question 14

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

Accepted Answer

Destroy the hard drive via shredding or incineration.. NIST SP 800-88 Rev. 1 defines three sanitization categories: Clear, Purge, and Destroy. Destroy—via shredding, incineration, disintegration, or melting—renders the media physically unusable so that data cannot be recovered even with laboratory techniques, which is the highest assurance level. For PII on a legacy drive being decommissioned, destruction is the appropriate method when the media will not be reused.

Answer

Clear the file system using a standard OS format command.

Answer

Overwrite the drive once with zeros.

Answer

Purge the data using a cryptographic erase (CE) method.

Question 15

To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?

Accepted Answer

dm-crypt/LUKS. dm-crypt is the Linux kernel's transparent disk-encryption subsystem, and LUKS (Linux Unified Key Setup) is the standard on-disk format that manages keys, headers, and passphrases. Together they provide full-disk encryption on Linux servers, satisfying PCI-DSS Requirement 3.4/3.5 for rendering stored cardholder data unreadable. Tools like cryptsetup wrap dm-crypt/LUKS, and it works across most distributions without third-party licensing.

Answer

BitLocker

Answer

IPsec

Answer

VeraCrypt