CGRC Practice Test 15 — 15 Questions

Question 1

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Accepted Answer

Segmenting the system into a separate, isolated network zone.. Compensating controls provide an alternative way to achieve the security objective; examples include increased monitoring, network isolation, or enhanced access auditing.

Answer

Providing the system administrator with a larger office.

Answer

Installing a new air conditioning unit in the server room.

Question 2

The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?

Accepted Answer

Configure a 'Dynamic Link' between Audit Testing Results and Risk Rating calculations.. The calculation engine must be linked to the latest audit evidence object to dynamically update the risk residual score.

Answer

Update the manual risk assessment survey annually.

Answer

Increase the frequency of full organizational risk assessments.

Answer

Require the CISO to manually approve all risk score changes.

Question 3

You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?

Accepted Answer

Set up a Workflow Transition Condition triggered by the 'Severity' field.. Workflow automation engines in GRC platforms use conditional logic transitions to route tasks based on field values like 'Severity'.

Answer

Configure a global Business Rule to auto-close all findings.

Answer

Change the default notification email template for findings.

Answer

Modify the User Permission set for the CISO account.

Question 4

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Accepted Answer

Explicit assignment of policy ownership and accountability.. Policy statements and ownership are core components for governance and compliance.

Answer

The home address of the CISO.

Answer

A list of all employees' social media handles.

Answer

The exact color scheme of the company website.

Question 5

When aligning GRC with business objectives, which THREE of the following represent effective strategic alignment?

Accepted Answer

Mapping risk categories to specific business processes.. Alignment is achieved by mapping risks to objectives, involving stakeholders, and measuring impact.

Answer

Focusing exclusively on technical vulnerability patching.

Answer

Allowing IT teams to ignore GRC policies for speed.

Question 6

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

Accepted Answer

The vulnerability scan was not performed after the patch was applied.. This discrepancy indicates a failure in the synchronization between the patch management process and the vulnerability management detection phase.

Answer

The Nessus scanner plugin needs an update to recognize the patch.

Answer

The scan policy is set to 'Discovery' instead of 'Audit'.

Answer

The scan agent was decommissioned prematurely.

Question 7

During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?

Accepted Answer

Testing technical controls. Testing is considered objective because it involves hands-on verification of a system's configuration or behavior, rather than relying on subjective human input (interview).

Answer

Reviewing policies

Answer

Interviewing the IT manager

Answer

Observing physical access

Question 8

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Accepted Answer

Verifying user account permissions and group assignments. Reviewing /etc/passwd and /etc/group files and comparing user permissions against assigned roles is a direct method to verify least privilege.

Answer

Running a Nessus vulnerability scan

Answer

Checking for physical server room access

Answer

Reviewing system logs for failed login attempts

Question 9

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Accepted Answer

The percentage reduction in repeat audit findings.. 'Reduction in audit findings' directly correlates to lower operational risk and better compliance posture, which resonates with stakeholders.

Answer

The number of tickets opened in the GRC helpdesk.

Answer

The total storage space consumed by evidence files.

Answer

The number of users logged into the GRC platform daily.

Question 10

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

Accepted Answer

Document the compensating control and assess its effectiveness. Documenting compensating controls allows the assessor to show how the security objective is met despite the missing control.

Answer

Force an upgrade to the application

Answer

Immediately revoke the Authorization to Operate (ATO)

Answer

Mark the control as 'Not Applicable'

Question 11

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

Accepted Answer

Perform a cryptographic erase by deleting the associated encryption keys.. Deleting the VM is not enough; you must verify that the underlying storage blocks have been properly sanitized or that the keys used to encrypt the data have been destroyed.

Answer

Delete the VM snapshot from the management console.

Answer

Revoke the access rights of the VM administrator.

Answer

Shut down the VM and wait for the provider to recycle the hardware.

Question 12

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Accepted Answer

S3 Block Public Access. S3 Block Public Access settings provide a centralized, account-wide or bucket-level override to prevent accidental exposure.

Answer

Encryption at Rest

Answer

Bucket ACLs

Answer

IAM User Permissions

Question 13

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

Accepted Answer

Accepting the residual risk associated with the POA&M. The AO is accountable for the risk the system poses to the organization and must approve the mitigation strategy outlined in the POA&M.

Answer

Drafting the mitigation tasks

Answer

Conducting the security controls assessment

Answer

Implementing the technical patches

Question 14

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary defines the scope of the system and everything subject to the security controls, including interconnected systems.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 15

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

Accepted Answer

Assess Security Controls. According to NIST SP 800-53A, the assessment process is a linear flow where the 'Prepare for Assessment' phase leads directly into the 'Assess Security Controls' phase to execute the test procedures.

Answer

Analyze Security Assessment Results

Answer

Develop the Plan of Action and Milestones (POA&M)

Answer

Authorize the Information System