CGRC Practice Test 15 — 15 Questions

Question 1

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

Accepted Answer

List the identity service as an external provider and inherit the controls.. When a system relies on a shared service for identity management, that service is typically outside the system's authorization boundary. The correct approach is to list the identity service as an external provider and inherit its controls, documenting the reliance and the controls it provides. This reflects the shared responsibility model and avoids duplicating assessments.

Answer

Force the service provider to sign a full system authorization for you.

Answer

The identity service must be fully assessed as part of your system.

Answer

Exclude the identity service from the documentation entirely.

Question 2

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

Accepted Answer

Moderate. Per FIPS 199, the overall security categorization of an information system is determined by the high-water mark of the three security objectives: confidentiality, integrity, and availability. Since integrity and availability are both Moderate and confidentiality is Low, the highest impact level is Moderate, making the overall system categorization Moderate. This ensures that the system is protected at the level of its most critical security objective.

Answer

Not Categorized

Answer

Low

Answer

High

Question 3

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

Accepted Answer

Running automated configuration compliance scans.. Option A is correct because automated configuration compliance scans (e.g., using SCAP, CIS-CAT, or Nessus audit policies) directly test whether systems still match the hardened baselines and control settings that were implemented, which is a core continuous-monitoring verification technique. Option C is correct because reviewing system and audit logs (e.g., Windows Event Log, syslog, SIEM correlation) provides evidence that controls such as access enforcement, logging, and intrusion detection are actually operating and generating expected events. Option E is correct because physical inspections of the server room verify that physical and environmental controls (badge access, locks, cameras, HVAC, fire suppression) are present and functioning, which is a legitimate continuous-monitoring activity for the physical domain. Option B does not belong because user productivity interviews measure business performance, not the operational effectiveness of security controls. Option D does not belong because a vendor's assurance claim is not independent verification that the controls are functioning in the organization's own environment.

Answer

Interviewing the system users about their productivity.

Answer

Asking the vendor if the product is secure.

Question 4

Which technique is best to detect 'false negatives' during a security control assessment?

Accepted Answer

Reviewing security log correlation. False negatives occur when a vulnerability or malicious activity exists but the assessment fails to detect it. Correlating security logs from multiple sources (endpoint, network, authentication, application) surfaces events that a single control or tool missed, revealing gaps in detection coverage. This cross-source correlation is the most reliable technique for exposing false negatives in a control assessment.

Answer

Interviewing developers

Answer

Checking server physical locks

Answer

Single tool vulnerability scanning

Question 5

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

Accepted Answer

Document the compensating control and assess its effectiveness. When a required control (MFA) is absent but an alternative control (physically secured enclave) provides equivalent or compensating protection, the correct action is to document the compensating control and assess whether it effectively mitigates the risk. The SAR should record the gap, the compensating control, the assessment of its effectiveness, and any residual risk so the Authorizing Official can make an informed risk decision.

Answer

Force an upgrade to the application

Answer

Immediately revoke the Authorization to Operate (ATO)

Answer

Mark the control as 'Not Applicable'

Question 6

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

Accepted Answer

Request a re-assessment using the 'Test' method. Requesting a re-assessment using the 'Test' method is correct because technical controls require objective, hands-on examination (e.g., scanning, configuration review, penetration testing) rather than subjective interviews. An interview alone cannot verify that a technical control is implemented and operating effectively. The assessor must use the appropriate assessment method defined in the assessment plan.

Answer

Accept the findings as-is

Answer

Escalate to the Chief Information Officer (CIO)

Answer

Update the System Security Plan (SSP) to match the interview

Question 7

Which TWO of the following are recommended practices for managing firewall rules?

Accepted Answer

Documenting the business justification for each rule. Option A is correct because documenting the business justification for each firewall rule provides an audit trail and ensures that every rule has a legitimate, approved purpose, which is essential for accountability and change management. Option B is correct because periodically reviewing rules to remove unnecessary ones (rule recertification) reduces the attack surface and prevents rule bloat that can degrade performance and introduce security gaps. Option C is incorrect because disabling logging removes visibility into allowed and denied traffic, undermining incident detection and forensic analysis; logging should generally be enabled for critical rules. Option D is incorrect because applying rules in random order is dangerous—firewalls evaluate rules top-down, so order must be deliberate to ensure correct permit/deny behavior. Option E is incorrect because using 'Any' as the destination for all rules creates overly permissive policies that violate the principle of least privilege and expose systems to unnecessary risk.

Answer

Disabling logging for all rules to improve performance

Answer

Applying rules in random order

Answer

Using 'Any' as the destination for all rules

Question 8

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. The most appropriate recommendation when an organization is not logging administrative access is to configure audit logging for administrative actions. This directly addresses the gap by enabling the collection of audit trails for privileged activities, which is essential for detecting and investigating security incidents, meeting compliance requirements, and ensuring accountability.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 9

Which THREE of the following represent common challenges in maintaining an integrated GRC program?

Accepted Answer

Ensuring leadership support is sustained over time.. Option A is correct because sustained executive sponsorship is one of the most frequently cited challenges in integrated GRC programs; leadership priorities shift, budgets get reallocated, and momentum fades, so keeping continuous top-management commitment is difficult. Option D is correct because integrated GRC requires sharing risk, compliance, and control data across functions such as legal, IT, audit, and operations, and entrenched departmental silos block that information flow and create duplicated or conflicting risk views. Option E is correct because regulations, standards, and threat landscapes change continuously (for example GDPR, HIPAA, PCI DSS updates), forcing the GRC program to constantly re-map controls, reassess risks, and update reporting. Option B is not a core GRC challenge because branding and visual identity are cosmetic concerns that do not affect governance, risk, or compliance integration. Option C is not a challenge to maintaining an integrated program but rather the opposite of integration—restricting the platform to one department defeats the purpose of an enterprise-wide GRC program and is a design flaw, not a common maintenance challenge.

Answer

Ensuring the GRC platform looks visually identical to the company brand.

Answer

Limiting the GRC platform to only one department.

Question 10

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Accepted Answer

Segmenting the system into a separate, isolated network zone.. Compensating controls are alternative safeguards that provide equivalent risk reduction when the prescribed control cannot be implemented exactly as required. Option A is correct because isolating the system in a separate, segmented network zone (e.g., a VLAN or DMZ with restrictive firewall/ACL rules) reduces the attack surface and lateral-movement risk, compensating for a control that cannot be applied as specified. Option C is correct because enhanced logging and monitoring (e.g., forwarding audit logs to a SIEM, enabling verbose event auditing) provides detective coverage that offsets a missing or weakened preventive control. Option E is correct because requiring multi-factor authentication for all administrative access adds a strong authentication factor, compensating for weaknesses such as inadequate password policy or missing privileged-access controls. Option B is not a security control at all—a larger office has no bearing on risk mitigation. Option D is a physical environmental control for availability (HVAC/cooling), not a compensating security control for the scenario described.

Answer

Providing the system administrator with a larger office.

Answer

Installing a new air conditioning unit in the server room.

Question 11

Which THREE factors should an organization consider when applying control overlays?

Accepted Answer

The mission or business requirements of the system.. Control overlays are tailored sets of controls applied on top of a baseline, so they must be driven by the system's mission or business requirements (C), since the overlay exists to address specific needs such as privacy, cloud, or industrial control environments that the baseline alone does not cover. The impact level of the underlying system (D) matters because FIPS 199/SP 800-53 baselines are selected by impact (low, moderate, high), and the overlay must be consistent with that categorization and the associated control rigor. The existing control baseline of the system (E) is also essential, because an overlay is applied relative to an already-selected baseline, and knowing which controls are already implemented or inherited prevents duplication and gaps. By contrast, the personal preference of the system administrator (A) is not a valid factor, since overlays must be justified by mission, risk, and compliance needs rather than individual taste, and the date the system was originally purchased (B) is irrelevant to overlay selection, as age of hardware does not determine which controls are required.

Answer

The personal preference of the system administrator.

Answer

The date the system was originally purchased.

Question 12

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. An ATO with conditions means the Authorizing Official has accepted the system for operation but requires specific actions (e.g., additional controls, mitigations, or monitoring) to be completed. These conditions are documented as weaknesses and must be entered into the Plan of Action and Milestones (POA&M) so they are tracked, resourced, and remediated within agreed timeframes during continuous monitoring. The POA&M is the authoritative mechanism for managing outstanding risk items post-authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 13

Which TWO of the following are responsibilities of the Authorizing Official?

Accepted Answer

Signing the authorization decision. The Authorizing Official (AO) is the senior official who formally accepts the risk of operating a system, so option B, signing the authorization decision, is correct because the AO issues the authorization to operate (ATO) or denial based on the security assessment. Option C, accepting the residual risk, is also correct because after reviewing the Security Assessment Report and Plan of Action and Milestones, the AO formally accepts any remaining risk that cannot be mitigated. The other options do not belong: conducting the scan (A) is a technical task performed by assessors or security personnel, writing the user manual (D) is a documentation task typically done by system owners or technical writers, and updating firewall rules (E) is an operational security administration duty, not an AO responsibility.

Answer

Conducting the scan

Answer

Writing the user manual

Answer

Updating the firewall rules

Question 14

When setting up a new GRC program, which TWO of the following are essential for ensuring successful adoption across the business?

Accepted Answer

Obtaining formal executive sponsorship for the initiative.. Option B is correct because formal executive sponsorship gives the GRC program the authority, budget, and cross-functional influence needed to drive adoption and enforce accountability across business units. Option D is correct because clearly defining roles and responsibilities ensures every user knows their specific GRC obligations, such as risk owners, control owners, and evidence providers, which prevents gaps and confusion during rollout. The remaining options do not belong: hiring only external consultants (A) creates dependency rather than internal ownership, disabling audit logs (C) destroys the evidence trail required for governance and compliance, and buying the most expensive GRC module (E) is a cost decision unrelated to adoption success.

Answer

Hiring only external consultants to manage the GRC tool.

Answer

Disabling all audit logs to improve system performance.

Answer

Purchasing the most expensive GRC module available.

Question 15

Which THREE of the following are valid components of an Authorization Package?

Accepted Answer

Security Assessment Report (SAR). The Authorization Package in the RMF (Risk Management Framework) consists of three core documents: the System Security Plan (SSP), the Security Assessment Report (SAR), and the Plan of Action and Milestones (POA&M). Option B (Security Assessment Report) is correct because the SAR documents the results of the security control assessment, including findings, vulnerabilities, and the assessor's recommendations. Option D (System Security Plan) is correct because the SSP describes the system boundary, the security controls implemented or planned, and the environment of operation, serving as the foundational document of the package. Option E (Plan of Action and Milestones) is correct because the POA&M identifies tasks to remediate weaknesses found during assessment, along with resources, milestones, and timelines, and is required for the Authorizing Official's risk decision. Options A (Vendor invoices) and C (User training records) are not components of the Authorization Package; invoices are procurement artifacts, and training records are supporting evidence that may inform the SSP or assessment but are not one of the three required package documents.

Answer

Vendor invoices

Answer

User training records