CGRC Practice Test 17 — 15 Questions

Question 1

You are auditing a backup solution. Which metric is most critical for the Availability audit?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disruption, directly measuring the availability of the backup solution. It ensures that backups can be restored within the required timeframe to meet business continuity needs. Thus, RTO is the most critical metric for an availability audit.

Answer

Encryption key rotation

Answer

Tape rotation schedule

Answer

Backup storage capacity

Question 2

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Accepted Answer

System boundary and authorization boundary. Before an ISSO can develop a Security Assessment Plan (SAP), the system boundary and authorization boundary must be defined, because they determine which controls, components, and interfaces fall within assessment scope. Without a clearly identified boundary, assessment coverage cannot be judged adequate and controls may be missed or over-scoped.

Answer

Security control baselines

Answer

Contingency plan testing

Answer

Risk acceptance threshold

Question 3

Which GRC component is used to document the organizational structure, such as business units and departments, to which risks are assigned?

Accepted Answer

The 'Entity' or 'Organization' Manager module.. The 'Entity' or 'Organization' Manager module in a GRC platform is used to document the organizational structure, including business units, departments, and other entities to which risks are assigned. This module provides a hierarchical representation of the organization, enabling risk owners to be mapped to specific units and facilitating roll-up reporting.

Answer

The 'Report' generator.

Answer

The 'Policy' library.

Answer

The 'Incident' tracking module.

Question 4

Which TWO of the following are examples of administrative security controls?

Accepted Answer

Data classification policy. Administrative security controls are the management-oriented, policy and people-based safeguards an organization puts in place, so B (Data classification policy) qualifies because it is a documented governance rule that defines how data is labeled and handled by sensitivity level. C (Security awareness training) also qualifies because it is a personnel-focused program that educates users on policies, phishing, and safe practices, which is a classic administrative control. By contrast, A (Firewall configuration) and E (Intrusion detection systems) are technical/logical controls implemented in hardware or software, and D (Biometric locks) is a physical control, so none of those three belong to the administrative category.

Answer

Firewall configuration

Answer

Biometric locks

Answer

Intrusion detection systems

Question 5

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Accepted Answer

The overlay supplements the baseline.. In NIST SP 800-53, an overlay is a set of additional or modified controls applied to a baseline to address specific technology, environment, or mission needs. The overlay supplements the baseline (Option A) by adding controls or tailoring existing ones; it does not replace or discard the baseline. The baseline remains the foundation, and the overlay enhances it.

Answer

The overlay is used only if the system is High impact.

Answer

The baseline is discarded if an overlay is used.

Answer

The overlay replaces the entire baseline.

Question 6

You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?

Accepted Answer

That the common control provider provides evidence of compliance.. When a control is marked 'Inherited', the system owner is relying on a common control provider (CCP) to implement and assess that control. The most critical verification is that the CCP provides evidence of compliance, such as assessment reports or authorization documentation, to ensure the control is actually effective for the system's scope.

Answer

That the control is listed in the system's own configuration guide.

Answer

That the system owner has full administrative control.

Answer

That the control is manually tested by the system team.

Question 7

Which TWO of the following are considered 'common controls'?

Accepted Answer

Physical building access badges.. In security control categorization, 'common controls' are controls that are inherited by or shared across multiple systems rather than being unique to a single information system. Option C (physical building access badges) is a common control because facility-level physical access mechanisms protect all systems and personnel within the building, not just one application. Option E (network boundary protection/firewall for the data center) is a common control because the firewall at the data center perimeter provides shared network protection for every system hosted behind it. By contrast, options A (custom source code of a business logic application), B (application-specific encryption keys), and D (the specific database schema of a custom app) are all system-specific controls tied to one particular application, so they are not shared or inherited across systems and therefore are not common controls.

Answer

The custom source code of a business logic application.

Answer

Application-specific encryption keys.

Answer

The specific database schema of a custom app.

Question 8

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Accepted Answer

High risk of system instability during patch deployment.. Option B is correct because legacy systems often run outdated or unsupported OS and application versions where applying patches can break dependencies, cause downtime, or trigger instability, making continuous monitoring and remediation risky. Option C is correct because legacy environments frequently lack modern REST APIs, agents, or standardized telemetry interfaces (e.g., syslog, SNMP, WMI, or OpenTelemetry support), forcing manual or custom monitoring workarounds. Option A is incorrect because legacy systems are typically old and well-researched, so bugs are more likely to be known, not undiscovered. Option D is incorrect because legacy systems rarely self-update firmware daily; automatic firmware updates are uncommon and would not represent a monitoring challenge. Option E is incorrect because abundant disk space for logs is not a challenge; insufficient storage or log retention limits would be the actual concern.

Answer

The system is too new for security researchers to find bugs.

Answer

The system automatically updates its own firmware daily.

Answer

Too much disk space available for logging.

Question 9

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

Accepted Answer

To serve as a comprehensive list of all possible security controls.. The NIST SP 800-53 Control Catalog is a comprehensive list of security and privacy controls that organizations use as a source for selecting controls during the RMF process. Its main purpose is to provide the full set of possible controls from which tailored baselines (Low, Moderate, High) are derived for a given system.

Answer

To automate the scanning process.

Answer

To mandate the order of implementation.

Answer

To identify which vendors are compliant.

Question 10

A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?

Accepted Answer

The 'User Permission' or 'Access Control' report.. A 'User Permission' or 'Access Control' report enumerates which users and groups hold which permissions (read, write, delete) on specific objects or modules, including sensitive compliance evidence. This directly answers the question of who has Write access. It is the only report type designed to surface authorization assignments.

Answer

The System Performance Report.

Answer

The Risk Trend Analysis Report.

Answer

The Audit Finding Closure Report.

Question 11

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Accepted Answer

Monitor. The RMF (Risk Management Framework) Monitor phase (Step 6) is where continuous monitoring of security controls takes place. This phase involves ongoing assessment of control effectiveness, tracking changes to the system, and reporting the security posture to authorizing officials. It ensures that the system remains compliant and that any degradation in controls is detected and addressed.

Answer

Authorize

Answer

Select

Answer

Categorize

Question 12

Which document is mandatory to finalize the system categorization and begin the RMF process?

Accepted Answer

The FIPS 199 Security Categorization document.. The FIPS 199 Security Categorization document is mandatory to finalize the system categorization and formally begin the RMF process. It documents the security category of the system based on the potential impact of a breach, and without it, the subsequent RMF steps (selecting controls, assessing, authorizing) cannot be properly executed.

Answer

The Incident Response Policy.

Answer

The Penetration Test Report.

Answer

The Contingency Plan.

Question 13

Which TWO of the following are effective ways to secure endpoints against malware?

Accepted Answer

Implementing a patch management policy. Option A (Implementing a patch management policy) is correct because keeping operating systems and applications up to date closes known vulnerabilities that malware exploits, reducing the attack surface on endpoints. Option E (Deploying EDR software) is correct because Endpoint Detection and Response tools continuously monitor endpoint activity, detect malicious behavior, and can automatically contain or remediate threats that evade signature-based defenses. Option B is wrong because allowing users to install any software increases risk by introducing unvetted, potentially malicious or vulnerable applications. Option C is wrong because turning off all logging destroys the audit trail and telemetry needed to detect, investigate, and respond to malware incidents. Option D is wrong because disabling the OS firewall removes a key network-level control that blocks unauthorized inbound and outbound connections used by malware.

Answer

Allowing users to install any software

Answer

Turning off all logging

Answer

Disabling the OS firewall

Question 14

What is the purpose of the Security Assessment Report (SAR)?

Accepted Answer

To provide a snapshot of the control implementation effectiveness. The Security Assessment Report (SAR) is a key deliverable of the security assessment phase within the Risk Management Framework (RMF). Its primary purpose is to document the findings from assessing the security controls, including whether each control is implemented correctly, operating as intended, and producing the desired outcome. This provides a snapshot of control implementation effectiveness, which decision-makers use to determine residual risk and inform authorization decisions. The SAR does not itself authorize the system; that is the role of the Authorization to Operate (ATO).

Answer

To request funding for security improvements

Answer

To authorize the system for production

Answer

To list all authorized users

Question 15

What is the physical security control used to prevent piggybacking at an entry point?

Accepted Answer

Mantrap. A mantrap is a physical access control consisting of two interlocking doors with a small vestibule between them, designed so that only one door can open at a time. This forces each person to authenticate individually before proceeding, which physically prevents tailgating/piggybacking because an unauthorized follower cannot slip through behind an authenticated user. It is the only option that directly and physically stops the act of piggybacking at the entry point.

Answer

Biometric scanner

Answer

CCTV camera

Answer

Security guard