CGRC Practice Test 16 — 15 Questions

Question 1

A financial services firm is implementing a new credit-scoring application that processes consumer PII. The CISO mandates that the application must enforce a control that restricts access based on the sensitivity of the data and the user's role, and that the control must be evaluated during the design phase. Which type of control is the CISO requiring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preventive technical control. The requirement is for a control that enforces access restrictions based on data sensitivity and user role, and it must be considered during design. This describes a preventive technical control, such as RBAC or ABAC, which stops unauthorized access before it happens. Detective, corrective, and compensating controls do not proactively enforce access based on these criteria during the design phase, making them incorrect.

Answer

Compensating operational control

Answer

Corrective physical control

Answer

Detective administrative control

Question 2

Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)

Accepted Answer

System interconnections and data flow paths.. Option A is correct because an effective system inventory must document system interconnections and data flow paths, which are required by NIST SP 800-53 controls (e.g., CA-3, AC-4) to understand boundary crossings, shared interfaces, and information exchange flows for authorization and risk assessment. Option B is correct because hardware serial numbers and physical asset tags provide unique identification and traceability of assets, supporting configuration management (CM-8) and enabling accurate tracking of ownership, location, and lifecycle status. Option E is correct because recording software versions and patch levels is essential for vulnerability management (RA-5, SI-2), allowing the agency to identify outdated or unpatched components and prioritize remediation. Option C does not belong because employee performance evaluation scores are personnel records unrelated to technical system inventory or security posture. Option D does not belong because coffee machine maintenance dates are facility trivia with no bearing on IT asset inventory, configuration management, or federal security requirements.

Answer

The employee performance evaluation score for the system admin.

Answer

The exact date of the last office coffee machine maintenance.

Question 3

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

Accepted Answer

Document the removal of the family with a justification.. NIST SP 800-53B and the RMF allow organizations to tailor the control baseline by removing controls that are not applicable — but any removal must be documented with a justification in the system security plan or tailoring worksheet. Since the system does not process PII, the PRIV family is not applicable, so the correct action is to document the removal with a rationale rather than silently dropping it or implementing it anyway.

Answer

Replace the family with general security controls.

Answer

Keep the controls but set them to 'manual' mode.

Answer

Implement the controls as high-priority items.

Question 4

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Accepted Answer

A formal process for tracking and remediating vulnerabilities.. Option D is correct because an effective continuous monitoring program requires a formal, repeatable process for tracking identified vulnerabilities and ensuring they are remediated in a timely manner, which is central to maintaining an ongoing risk posture. Option E is correct because automated security configuration assessment tools (e.g., SCAP-validated scanners, CIS-CAT, or Nessus-type configuration audits) provide the continuous, repeatable visibility into system hardening and configuration drift that manual reviews cannot sustain. Option A is not essential because a weekly complete physical audit of all hardware is operationally impractical and does not address logical/configuration monitoring. Option B is not essential because forcing daily password changes is a poor practice that increases help-desk load and weakens password quality, and it is not a monitoring control. Option C is not essential because outsourcing all monitoring to a third party removes organizational visibility and accountability; continuous monitoring can be performed internally or in hybrid models.

Answer

A complete physical audit of all hardware every week.

Answer

Requiring all users to change passwords daily.

Answer

Outsourcing all security monitoring to a third party.

Question 5

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

Accepted Answer

Plan of Action and Milestones (POA&M).. The Plan of Action and Milestones (POA&M) is the RMF artifact specifically designed to document, track, and manage identified security control weaknesses, including those discovered during continuous monitoring. It records each weakness, the planned remediation action, the responsible party, and the milestone dates for completion. The SSP describes the system and its controls, but the POA&M is the tracking document for changes and deficiencies.

Answer

System Security Plan (SSP).

Answer

Risk Assessment Report (RAR).

Answer

Authority to Operate (ATO).

Question 6

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

Accepted Answer

Certificate Revocation List (CRL) Distribution Point. To enable revocation, a Certificate Revocation List (CRL) Distribution Point must be configured in the certificate templates and CA settings. This CDP URL is embedded in issued certificates, allowing clients to download the CRL and check revocation status. Without a CDP, clients cannot locate the CRL, and revocation checks fail.

Answer

OCSP Responder

Answer

Key Archival

Answer

Trust Anchor

Question 7

You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?

Accepted Answer

Azure AD Conditional Access Policy. Microsoft Entra Conditional Access Policy is the most recommended modern authentication control because it allows granular, signal-based enforcement of MFA — evaluating user, device, location, application, and risk signals before granting access. Unlike Security Defaults, which apply a blunt tenant-wide MFA requirement, Conditional Access supports targeted policies (e.g., require MFA for admins or external access) and integrates with Identity Protection risk signals. This makes it the Microsoft-recommended path for organizations that need flexible, zero-trust-aligned MFA enforcement.

Answer

Password Protection Policy

Answer

Security Defaults

Answer

Identity Protection User Risk Policy

Question 8

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Accepted Answer

To provide a standardized starting point based on impact level.. NIST SP 800-53B defines control baselines (Low, Moderate, High, Privacy) as standardized sets of controls derived from SP 800-53 that serve as a starting point for any system at a given impact level. For a MODERATE-impact federal system, the initial baseline is the Moderate baseline, which the organization then tailors (scoping, parameterization, compensating controls) to fit the specific system. The baseline's purpose is to give a consistent, defensible foundation rather than a system-specific final control set.

Answer

To remove all controls that do not apply to the local network.

Answer

To define the continuous monitoring strategy for the system.

Answer

To identify all system-specific compensations.

Question 9

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Accepted Answer

Greater reliance on third-party audit reports. In cloud-native environments, organizations inherit controls from cloud providers and must rely on third-party audit reports such as SOC 2, ISO 27001, or FedRAMP to assess those inherited controls. This is the most significant change because you cannot directly audit the provider's infrastructure. The other options are not accurate descriptions of the change.

Answer

POA&M is prohibited for cloud providers

Answer

Physical security is no longer assessed

Answer

Manual testing is mandated for all controls

Question 10

Which document defines the specific security controls that an organization must implement based on its risk assessment?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the document that describes the system boundary, operational environment, and — critically — the security controls selected and implemented based on the organization's risk assessment (typically derived from NIST SP 800-53 via the RMF process). It maps each control to its implementation status and is the primary artifact reviewed during assessment and authorization. The SSP is what the assessor tests against and what the Authorizing Official uses to grant an ATO.

Answer

Incident Response Plan

Answer

Risk Management Plan

Answer

Security Assessment Report (SAR)

Question 11

Which of the following activities is a core component of the 'Ongoing Authorization' process?

Accepted Answer

Periodically reviewing security assessment results.. Ongoing Authorization (formerly Continuous Monitoring under RMF) requires the Authorizing Official to maintain situational awareness of the system's security posture after the initial ATO. Periodically reviewing security assessment results — including updated SCA scans, POA&M status, and control assessment findings — is a core activity that feeds the ongoing authorization decision. This review ensures the AO can determine whether the system's risk level remains acceptable or whether reauthorization or remediation is needed.

Answer

Performing a full system re-installation annually.

Answer

Changing the system administrator's password every month.

Answer

Increasing the budget for information security.

Question 12

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Accepted Answer

To define specific parameters for control implementation.. In NIST SP 800-53, assignment statements are placeholders within a control that the organization must fill in with specific values or parameters tailored to its environment. For example, a control might say 'the organization reviews audit records [Assignment: organization-defined frequency]' — the organization defines that frequency. This makes controls adaptable rather than one-size-fits-all.

Answer

To categorize the control by its priority level.

Answer

To link the control to a regulatory requirement.

Answer

To assign the control to a specific system administrator.

Question 13

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

Accepted Answer

Exclude known safe processes and signers. Excluding known safe processes and signers reduces false positives by allowing legitimate applications to run without triggering alerts, while still monitoring for anomalous behavior. This maintains visibility because the EDR continues to log and analyze all other activities, only suppressing noise from trusted sources.

Answer

Only monitor server logs

Answer

Set to 'Block All' mode

Answer

Disable real-time scanning

Question 14

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

Accepted Answer

To document the approved security configuration of a system.. A Configuration Baseline is the documented, approved security configuration of a system — the authoritative reference of how the system should be set up (OS hardening settings, service states, registry values, file permissions). It is the 'known good' state against which ongoing configurations are compared during audits and continuous monitoring, forming the foundation of CM-2 and CM-6 controls in NIST SP 800-53.

Answer

To automate the deployment of new software patches.

Answer

To identify all users with administrative privileges.

Answer

To serve as a temporary backup for system files.

Question 15

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

Accepted Answer

The server's TLS configuration file. TLS cipher suites and protocol versions are configured in the web server's TLS/SSL configuration — for example, Apache's ssl.conf (SSLCipherSuite, SSLProtocol), Nginx's nginx.conf (ssl_ciphers, ssl_protocols), or IIS's SCHANNEL registry and site bindings. This is where administrators disable weak ciphers like RC4, 3DES, and NULL, and restrict protocols to TLS 1.2/1.3. The other options affect unrelated layers and cannot control which cipher suites the server negotiates during the TLS handshake.

Answer

The server's BIOS settings

Answer

The web application's root directory

Answer

The firewall access control list