CGRC Practice Test 16 — 15 Questions

Question 1

Which TWO of the following are considered 'technical' security controls?

Accepted Answer

Encryption of data in transit. Technical controls (also called logical controls) use technology to enforce security.

Answer

Annual risk assessment

Answer

Security policies

Answer

Fencing around the data center

Question 2

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

Accepted Answer

Adjust the 'Assessment Trigger' logic based on the 'Criticality' score.. Linking a workflow trigger to a 'Control Criticality' attribute ensures that high-impact controls are assessed more frequently.

Answer

Change the global password policy for GRC users.

Answer

Require the GRC admin to manually assign tasks to users.

Answer

Disable the self-assessment feature to force all audits to be external.

Question 3

When structuring a GRC program, which THREE components are critical for compliance management?

Accepted Answer

Centralized Policy Management library.. Policy management, control libraries, and audit tracking are core components of any compliance framework.

Answer

A feature to change the font of the system interface.

Answer

A marketing tool for company social events.

Question 4

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

Accepted Answer

The POA&M lists items with no completion dates. POA&Ms must include completion dates. Without them, there is no accountability for remediation.

Answer

The POA&M contains vulnerabilities found by automated scans

Answer

The POA&M is stored in a secure repository

Answer

The POA&M is reviewed by the CISO

Question 5

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

Accepted Answer

Disaster recovery plan test results. Availability requires that systems be available for operation as agreed. Business continuity and disaster recovery testing provide evidence of this.

Answer

Privacy policy publication

Answer

Encryption of data at rest

Answer

User access review logs

Question 6

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Accepted Answer

Document the weakness in a Plan of Action and Milestones (POA&M). FedRAMP requires that all open vulnerabilities and control weaknesses identified during an assessment be documented in a POA&M for tracking and remediation.

Answer

Immediately terminate the cloud service

Answer

Perform a penetration test

Answer

Request a waiver from the JAB

Answer

Update the System Security Plan (SSP) to reflect compliance

Question 7

Which THREE roles are typically involved in a security assessment?

Accepted Answer

Assessor / Auditor. The assessor (auditor), the system owner (responsible party), and the security officer (compliance expert) are key participants.

Answer

Customer support agents

Answer

External public relations firm

Question 8

When configuring Cisco ASA firewall rules, you notice that traffic is being dropped despite an 'allow' access-list. What is the most likely cause?

Accepted Answer

The rule is placed after a 'deny ip any any' rule in the same list. The Cisco ASA uses an 'implicit deny' at the end of every access-list, and the order of rules matters.

Answer

The interface is not assigned to a security zone

Answer

The traffic is encrypted by VPN

Answer

Missing 'permit ip any any' at the top

Question 9

Which TWO documents are essential for an Authorizing Official to make an informed risk-based decision?

Accepted Answer

Plan of Action and Milestones (POA&M). The SAR provides the technical assessment, and the POA&M identifies how identified weaknesses will be addressed.

Answer

System Security Plan (SSP)

Answer

Hardware inventory list

Answer

Network diagram

Question 10

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

Accepted Answer

System Security Plan (SSP). NIST compliance requires a review of the SSP, the assessment of the controls, and the documentation of any deficiencies in a POA&M.

Answer

Annual report of stock performance

Answer

Internal marketing strategy

Question 11

Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?

Accepted Answer

Information System Security Officer (ISSO). The ISSO is responsible for the day-to-day management and monitoring of the security controls.

Answer

Authorizing Official

Answer

Chief Information Security Officer (CISO)

Answer

Security Control Assessor (SCA)

Question 12

When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?

Accepted Answer

To provide a 'Single Source of Truth' for audit and compliance data.. Defining a single 'System of Record' ensures 'Single Source of Truth' for audit and risk reporting.

Answer

To allow every department to have its own data repository.

Answer

To minimize the cost of software licenses.

Answer

To make the GRC platform run faster.

Question 13

What is the purpose of the Security Assessment Report (SAR)?

Accepted Answer

To provide a snapshot of the control implementation effectiveness. The SAR documents the results of the control assessment, including findings and recommendations.

Answer

To request funding for security improvements

Answer

To authorize the system for production

Answer

To list all authorized users

Question 14

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

Accepted Answer

Updating the asset inventory database. Secure data destruction, removing the server from the network, and updating the asset register are standard procedures.

Answer

Reformatting the drive once

Answer

Leaving the server powered on in the rack

Question 15

The organization's GRC workflow has a 'Request for Exception' process. The goal is to ensure that temporary risk exceptions are automatically reviewed before they expire. Which mechanism is most appropriate?

Accepted Answer

Configuring a 'Workflow Notification' triggered by a field-based 'Expiration Date'.. Automated workflow notifications tied to the 'Expiration Date' field ensure that exceptions do not remain active indefinitely without review.

Answer

Requiring the Risk Owner to sign a hard copy document.

Answer

Disallowing all risk exceptions in the system configuration.

Answer

Setting a manual reminder on the CISO's calendar.