CGRC Practice Test 18 — 15 Questions

Question 1

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config Remediation Actions.. AWS Config Remediation Actions allow you to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. You can associate a remediation action with a Config rule that checks for private S3 buckets, so when a bucket is non-compliant, the remediation action automatically applies the necessary changes (e.g., setting the bucket ACL to private).

Answer

AWS CloudTrail Event Selectors.

Answer

AWS Config Aggregators.

Answer

AWS Config Conformance Packs.

Question 2

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Accepted Answer

The system must meet specific security requirements to remain authorized. An 'ATO with Conditions' means the Authorizing Official permits the system to operate, but only if the system owner implements and maintains specific security controls, mitigations, or reporting requirements within defined timeframes. Continued authorization is contingent on satisfying those conditions; failure to do so can result in revocation.

Answer

The system is unauthorized for production use

Answer

The system is prohibited from processing sensitive data

Answer

The system is permanently compliant

Question 3

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Accepted Answer

It provides a standardized set of controls for a specific technology stack.. A control overlay is a pre-defined set of controls and control enhancements that can be applied to a baseline to address specific technologies, environments, or mission needs — such as cloud computing. In the NIST RMF context, overlays provide a standardized, reusable way to tailor a baseline for a particular technology stack (e.g., cloud, mobile, industrial control systems) without starting from scratch. The primary benefit is consistency and efficiency: organizations get a vetted set of controls appropriate to the cloud environment, reducing ad hoc tailoring and ensuring coverage of cloud-specific risks.

Answer

It replaces the need for FIPS 199 categorization.

Answer

It eliminates the need for manual tailoring.

Answer

It automatically tests the controls for compliance.

Question 4

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

Accepted Answer

A technical justification for the N/A status. A technical justification for the N/A status is required because the system owner must document why a control does not apply to the system, based on the system's characteristics, environment, or scope. This justification supports the authorization decision and provides an audit trail. It is not a waiver of a required control but an explanation of non-applicability.

Answer

A waiver request to the CISO

Answer

A copy of the vendor's warranty

Answer

The procurement contract

Question 5

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Accepted Answer

Target completion date. Option A (Target completion date) is correct because a POA&M must specify the scheduled date by which each identified weakness will be remediated, which is essential for tracking progress and accountability. Option D (Description of the vulnerability) is correct because a POA&M must clearly identify and describe the weakness or finding being addressed so that remediation efforts can be understood and verified. Options B, C, and E are incorrect because personnel salary data, historical audit logs, and software licensing keys are not required POA&M elements; POA&Ms focus on the weakness, its remediation actions, resources, milestones, and completion dates, not on payroll, raw log history, or license keys.

Answer

Personnel salary data

Answer

Historical audit logs

Answer

Software licensing keys

Question 6

Which THREE categories of controls are identified in NIST SP 800-53?

Accepted Answer

Operational. NIST SP 800-53 organizes its security and privacy controls into three distinct control categories, and the correct answers reflect exactly those categories. Option B (Operational) is correct because operational controls are the people- and process-driven safeguards, such as awareness and training, configuration management, contingency planning, and incident response, that support day-to-day security operations. Option C (Management) is correct because management controls focus on governance, risk assessment, planning, and oversight activities performed by organizational leadership, such as security planning and risk assessment controls. Option E (Technical) is correct because technical controls are the technology-based safeguards implemented in systems, such as access control mechanisms, identification and authentication, audit logging, and encryption. The unmarked options do not belong: Option A (Financial) is not a NIST SP 800-53 control category, and Option D (Environmental) is not one of the three categories either, though environmental controls such as physical protection appear within other frameworks and as specific control families rather than as a top-level category in SP 800-53.

Answer

Financial

Answer

Environmental

Question 7

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

Accepted Answer

The control is not applicable to the system's technology.. Option A is correct because NIST 800-53 baselines are tailored when a control addresses technology that the system does not employ — for example, a wireless access control (AC-18) on a system with no wireless capability — making the control not applicable and eligible for removal or scoping out. Option B is correct because tailoring also includes supplementing or strengthening the baseline with additional controls or more rigorous parameters when the system's environment, threat profile, or mission demands greater assurance than the baseline provides, such as raising an audit frequency parameter. Options C and D are not valid tailoring reasons: cost and monitoring difficulty are not criteria in the NIST RMF tailoring process, which is driven by applicability, risk, and mission/business needs rather than convenience. Option E is incorrect because the system owner cannot unilaterally disagree with a FIPS 199 categorization; the categorization is based on the impact of loss of confidentiality, integrity, and availability, and disputes are resolved through the formal categorization and approval process, not by tailoring the control baseline.

Answer

The control has a high cost of implementation.

Answer

The control is too difficult to monitor.

Answer

The system owner disagrees with the FIPS 199 classification.

Question 8

Which THREE of the following are components that must be included when documenting a compensating control?

Accepted Answer

A detailed explanation of how the compensating control mitigates the risk.. Option B is correct because documenting a compensating control must include a detailed explanation of how the control mitigates the identified risk, demonstrating that the alternative measure provides equivalent protection to the original requirement. Option C is correct because the documentation must clearly describe the risk the control is intended to mitigate, establishing the security objective the compensating control addresses. Option E is correct because the documentation must state the reason the original control could not be implemented, justifying why a compensating control is necessary in the first place. Option A is not required, since the identity of the approving person is not a mandatory element of the compensating control description itself, even though approvals are tracked elsewhere in the risk management process. Option D is not required, as listing every affected user is not a standard component; the documentation focuses on the risk, the mitigation method, and the justification for the alternative control.

Answer

The identity of the person who approved the control.

Answer

A list of every user affected by the control.

Question 9

Which THREE of the following roles are typically involved in a GRC Steering Committee?

Accepted Answer

General Counsel.. A GRC (Governance, Risk, and Compliance) Steering Committee requires senior leaders who own governance, risk, and compliance accountability across the enterprise. A, General Counsel, is correct because legal leadership interprets regulatory and contractual obligations, advises on compliance exposure, and ensures governance decisions align with statutory requirements. C, Chief Risk Officer (CRO), is correct because the CRO owns the enterprise risk management framework, aggregates risk appetite decisions, and reports risk posture to the board. D, Chief Information Security Officer (CISO), is correct because the CISO translates security and privacy compliance requirements (e.g., ISO 27001, NIST CSF, GDPR) into controls and provides the committee with cyber-risk visibility. B, the lead graphic designer, and E, the office maintenance supervisor, are not typically committee members because their roles involve creative production and facilities upkeep, respectively, and carry no enterprise governance, risk, or compliance decision-making authority.

Answer

The lead graphic designer.

Answer

The office maintenance supervisor.

Question 10

When aligning GRC with business objectives, which THREE of the following represent effective strategic alignment?

Accepted Answer

Mapping risk categories to specific business processes.. Option A is correct because mapping risk categories to specific business processes ties governance and risk work directly to the value streams and operations the business cares about, ensuring controls and treatments are relevant rather than generic. Option C is correct because measuring the impact of GRC activities on organizational KPI targets demonstrates and steers GRC toward measurable business outcomes, enabling continuous alignment and prioritization. Option D is correct because involving business owners in the risk assessment process embeds business context, ownership, and accountability into risk decisions, which is a hallmark of strategic alignment between GRC and business objectives. Option B does not belong because focusing exclusively on technical vulnerability patching is a narrow, tactical IT activity that ignores broader business risk and strategic priorities. Option E does not belong because allowing IT teams to ignore GRC policies for speed undermines governance, increases unmanaged risk, and directly conflicts with aligning GRC to business objectives.

Answer

Focusing exclusively on technical vulnerability patching.

Answer

Allowing IT teams to ignore GRC policies for speed.

Question 11

Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?

Accepted Answer

Document the finding in the SAR. Option C is correct because the Security Assessment Report (SAR) is the formal artifact that records assessment results, including any control determined to be ineffective, so documenting the finding there preserves the official record of the deficiency. Option D is correct because an ineffective critical control requires a Plan of Action and Milestones (POA&M) entry to track the weakness, assign responsibility, set milestones, and monitor remediation to closure. Option A is wrong because removing a control from the System Security Plan (SSP) would misrepresent the system's actual security posture rather than address the deficiency. Option B is wrong because changing the system password is an unrelated tactical action that does not remediate or track an ineffective security control. Option E is wrong because immediately disconnecting the system is a drastic operational action not automatically warranted by an assessment finding; the ISSO should document and track remediation through the SAR and POA&M processes.

Answer

Delete the control from the SSP

Answer

Change the system password

Answer

Immediately disconnect the system

Question 12

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

Accepted Answer

The Information System Owner (ISO).. Under FIPS 199 and the NIST RMF, the Information System Owner (ISO) is the stakeholder responsible for the overall procurement, development, integration, modification, operation, and maintenance of the system, and is therefore the appropriate person to sign off on the final security categorization. The ISO ensures the categorization aligns with the system's mission and data sensitivity.

Answer

The Lead System Administrator.

Answer

The Chief Information Security Officer (CISO).

Answer

The Third-Party Auditor.

Question 13

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner asks which document should be updated to reflect changes in the system's security posture resulting from continuous monitoring activities. What is the PRIMARY document that must be kept current?

Accepted Answer

The system security plan (SSP). The system security plan (SSP) is the foundational document that describes the system and its controls. Continuous monitoring results, such as new vulnerabilities or changes in control implementation, must be documented in the SSP to maintain an accurate authorization package. Other documents like the MOU, PIA, or contingency plan serve specific purposes but do not replace the SSP as the primary record of security posture.

Answer

The privacy impact assessment (PIA)

Answer

The memorandum of understanding (MOU) with interconnected systems

Answer

The contingency plan

Question 14

You are selecting controls for a cloud-based system that will be used by a government agency. The cloud service provider (CSP) has a FedRAMP authorization. You need to determine which controls are inherited from the CSP. What should you review to understand the CSP's control implementation and inheritance details?

Accepted Answer

The CSP's FedRAMP authorization package, including the system security plan (SSP) and control assessment results.. The CSP's FedRAMP authorization package, including the system security plan (SSP) and assessment results, is the authoritative source for understanding which controls are implemented and can be inherited. It documents control implementations and provides evidence of effectiveness, allowing the agency to accurately identify inherited, shared, and customer-implemented controls. This ensures proper control selection and avoids duplication or gaps.

Answer

The NIST SP 800-53 catalog of controls, because it lists all possible controls and their inheritance.

Answer

The CSP's marketing materials and service level agreements (SLAs).

Answer

The agency's own security plan from a previous on-premises system.

Question 15

A multinational corporation is implementing a GRC program to manage compliance with GDPR, CCPA, and other privacy regulations. The GRC manager needs to ensure that data subject access requests (DSARs) are handled within regulatory timeframes. Which of the following is the MOST effective way to integrate DSAR processing into the GRC program?

Accepted Answer

Configure the GRC platform to automate DSAR intake, track deadlines, and route requests to responsible teams with escalation alerts.. Integrating DSAR processing into the GRC platform automates intake, tracking, and escalation, ensuring regulatory deadlines are met consistently across jurisdictions. This centralized approach provides audit trails, enables oversight, and aligns privacy compliance with broader GRC objectives. It reduces manual errors and allows the privacy office to manage requests efficiently while demonstrating compliance to regulators.

Answer

Delegate DSAR handling entirely to the legal department and exclude it from the GRC program.

Answer

Implement a standalone privacy tool that is not integrated with the GRC platform.

Answer

Create a manual process where each business unit logs DSARs in a shared spreadsheet and emails the privacy office.