CGRC Practice Test 19 — 15 Questions

Question 1

A multinational corporation is implementing controls to comply with the General Data Protection Regulation (GDPR). The security team must ensure that personal data of EU citizens is protected during processing. Which control best addresses the GDPR principle of data protection by design and by default?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implementing pseudonymization of personal data in all processing systems.. GDPR Article 25 mandates data protection by design and by default, requiring technical and organizational measures such as pseudonymization. Pseudonymization reduces privacy risks by making data less identifiable, directly embedding protection into processing. The other options are important GDPR elements but do not constitute the technical control that implements this principle.

Answer

Obtaining explicit consent from data subjects for all processing.

Answer

Appointing a Data Protection Officer (DPO) to oversee compliance.

Answer

Conducting annual privacy impact assessments for all projects.

Question 2

A security manager is tailoring a NIST SP 800-53 control baseline for a system that processes sensitive but unclassified information. The system owner proposes to remove a control that requires continuous monitoring because the system is in a low-risk environment. What should the security manager do?

Accepted Answer

Perform a risk assessment to determine if compensating controls can provide equivalent protection.. The correct action is to perform a risk assessment to determine if compensating controls can provide equivalent protection. Tailoring is risk-based, and removing a control requires justification. The assessment ensures that any modification maintains the system's security posture and is documented appropriately.

Answer

Approve the removal because the system is low-risk and continuous monitoring is expensive.

Answer

Deny the removal and require the control to be implemented as written.

Answer

Escalate to the authorizing official for a final decision without further analysis.

Question 3

You are preparing a continuous monitoring strategy for a federal information system in accordance with NIST SP 800-137. Which TWO activities are essential components of the continuous monitoring program? (Choose two.)

Accepted Answer

Performing ongoing assessments of security control effectiveness.. Continuous monitoring, as defined in NIST SP 800-137, requires ongoing assessment of control effectiveness and the collection and analysis of security-related information. These activities enable real-time risk management. Training, SSP documentation, and full pre-change assessments are important but not core continuous monitoring activities.

Answer

Documenting the results of security assessments in the System Security Plan (SSP).

Answer

Conducting annual security awareness training for all users.

Answer

Conducting a full security assessment before every major system change.

Question 4

A system owner is preparing to authorize a system for operation. The Security Assessment Report (SAR) contains a finding that a high-impact security control is not implemented. The Authorizing Official (AO) decides to accept the risk and grant an Authorization to Operate (ATO). What document must the AO sign to formally accept the risk?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document is the formal artifact where the AO accepts risk and grants the ATO. It includes any conditions and the authorization termination date. The POA&M, SSP, and SAR are inputs to the decision but do not themselves constitute risk acceptance.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Question 5

An organization is selecting controls for a new information system. The system is categorized as low impact. According to NIST SP 800-53B, which baseline should be used as the starting point?

Accepted Answer

Low baseline. The correct answer is the low baseline. NIST SP 800-53B defines baselines for low, moderate, and high impact systems. Starting with the low baseline for a low-impact system ensures that the appropriate minimum controls are selected, which can then be tailored based on specific needs.

Answer

Moderate baseline

Answer

Privacy baseline

Answer

High baseline

Question 6

What is the primary function of an assessor's 'working papers'?

Accepted Answer

To document evidence and support the findings. Working papers are the assessor's documented evidence — records of tests performed, observations, interviews, and artifacts collected — that substantiate the audit findings and conclusions. They provide the traceable link between raw evidence and reported results, enabling independent review and defending the assessment if challenged.

Answer

To list the audit team members

Answer

To submit to the regulator

Answer

To replace the need for an audit

Question 7

A GRC analyst is designing a process to continuously identify changes in the external regulatory environment that could affect the organization's compliance posture. The organization operates in multiple jurisdictions and wants to avoid manual, ad-hoc tracking. Which approach best supports this requirement?

Accepted Answer

Subscribe to regulatory intelligence feeds and integrate them into the GRC platform to automatically flag relevant changes.. Integrating regulatory intelligence feeds into the GRC platform enables automated, continuous tracking of regulatory changes across jurisdictions. This allows the organization to quickly assess impact, map changes to controls, and take action, which is essential for maintaining compliance in a dynamic environment. Manual or periodic methods are insufficient for timely identification and response.

Answer

Assign a compliance officer to manually review government websites weekly and log changes in a spreadsheet.

Answer

Rely on external auditors to identify regulatory changes during annual audits.

Answer

Conduct an annual internal review of all regulations and update the compliance register accordingly.

Question 8

A GRC analyst is evaluating the effectiveness of a continuous monitoring program for a system that has been operational for two years. The analyst notices that several security controls have not been assessed since the initial authorization. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The continuous monitoring strategy does not define assessment frequencies for all controls.. The most likely cause is that the continuous monitoring strategy does not define assessment frequencies for all controls. A comprehensive strategy specifies how often each control should be assessed, based on risk. Without these frequencies, some controls may not be reassessed after initial authorization. This leads to gaps in monitoring and potential compliance issues. The GRC analyst should update the strategy to include clear frequencies for all controls and ensure they are followed.

Answer

The security assessment report (SAR) from the initial authorization did not include those controls.

Answer

The system owner has not allocated sufficient budget for continuous monitoring activities.

Answer

The authorizing official has not required reassessment of those controls.

Question 9

During a security assessment, the assessor discovers that a system's audit logging control is implemented but the logs are not being reviewed regularly. The control is technically configured correctly. How should the assessor document this finding in the Security Assessment Report (SAR)?

Accepted Answer

The control is partially implemented; the SAR should note that while logging is configured, the lack of regular review represents a gap that affects the control's effectiveness.. Audit logging controls require both the generation and review of logs. If logs are not reviewed, the control is only partially implemented and the SAR must reflect that gap. This finding informs the Authorizing Official of the reduced detection capability and supports remediation planning. Treating the control as satisfied or not applicable would misrepresent the system's security posture.

Answer

The control is implemented with a finding only if the logs contain evidence of a security incident that was missed.

Answer

The control is satisfied because the technical configuration is correct; log review is an operational process outside the control's scope.

Answer

The control is not applicable because log review is a management responsibility, not a technical control.

Question 10

A retail company is implementing controls to comply with the Payment Card Industry Data Security Standard (PCI DSS). The security manager needs to ensure that cardholder data is protected when stored on backup tapes. Which control should be implemented to meet PCI DSS Requirement 3?

Accepted Answer

Encrypt backup tapes using strong cryptography.. PCI DSS Requirement 3 requires that stored cardholder data be rendered unreadable, typically through encryption. For backup tapes, encryption with strong cryptography is the appropriate control. Physical security, segmentation, and vulnerability scanning, while valuable, do not fulfill the specific requirement to protect data at rest on backup media.

Answer

Implement network segmentation to isolate backup servers.

Answer

Conduct quarterly vulnerability scans of backup infrastructure.

Answer

Store backup tapes in a locked room with access badges.

Question 11

A security assessor is reviewing audit logs from a critical server. The logs show that a user account with administrative privileges was used to access sensitive files outside of normal business hours. The assessor needs to determine whether this activity was authorized. Which type of evidence would BEST support this determination?

Accepted Answer

A signed change request or maintenance window approval from management. To determine whether after-hours administrative access was authorized, the assessor needs evidence that links the activity to an approved business process. A signed change request or maintenance window approval is documentary evidence that explicitly authorizes the access. It is objective, verifiable, and directly relevant. Other types of evidence, such as logs or interviews, may support the timeline but do not establish authorization.

Answer

Interview notes from the system administrator stating they sometimes work late

Answer

A screenshot of the file directory showing the sensitive files

Answer

System-generated audit logs showing the access time and user ID

Question 12

You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?

Accepted Answer

On a Span Port of the core distribution switch. A SPAN (Switched Port Analyzer) port on the core distribution switch mirrors traffic from multiple VLANs and internal segments, allowing the IDS/IPS sensor to see both internal east-west traffic and external north-south traffic traversing the core. Placing the sensor at the core distribution layer provides the broadest visibility without disrupting production traffic, since SPAN ports are passive copies. This is the standard architectural recommendation for monitoring both internal and external communications in a switched environment.

Answer

Directly on the public ISP router

Answer

Inside the isolated guest Wi-Fi network

Answer

On the WAN interface of the firewall

Question 13

A security manager is leading an effort to define the authorization boundary for a system that uses a virtualized environment. The system consists of multiple virtual machines (VMs) on a hypervisor that also hosts VMs for other systems. How should the security manager address the hypervisor when defining the boundary?

Accepted Answer

Treat the hypervisor as a common control and document the inheritance of its security controls in the system security plan.. In a virtualized environment, the hypervisor is typically a shared component that provides security controls to multiple systems. It should be treated as a common control, and the system security plan should document the inheritance of its controls. This approach maintains a clear boundary for the system while ensuring that the hypervisor's security is properly assessed and managed. The other options either incorrectly include or exclude the hypervisor without proper documentation.

Answer

Exclude the hypervisor entirely from the boundary and from any security documentation.

Answer

Include the hypervisor within the system boundary because it provides essential virtualization services.

Answer

Include only the VMs used by the system in the boundary, and ignore the hypervisor because it is not a VM.

Question 14

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

Accepted Answer

Firewall audit/management logs.. Firewall configuration changes are recorded in the firewall's own audit and management logs, which capture administrative actions such as rule additions, deletions, modifications, and policy commits. To alert on configuration changes in a SIEM, the firewall audit/management log is the authoritative source because it directly records who changed what and when on the device itself. Other log sources do not contain firewall configuration change events.

Answer

Domain controller event logs.

Answer

DHCP server logs.

Answer

Endpoint antivirus logs.

Question 15

A program manager is preparing to categorize a new information system under FIPS 199. The system will handle financial data, and the program manager wants to ensure the categorization is accurate. Which document should the program manager reference to identify the potential impact levels for confidentiality, integrity, and availability?

Accepted Answer

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems. FIPS 199 establishes the security categorization standard, defining the potential impact levels for confidentiality, integrity, and availability. It is the authoritative document for determining the security category of an information system. While SP 800-37 describes the RMF process and SP 800-60 offers mapping guidance, FIPS 199 is the specific standard that provides the impact criteria. Using it ensures the categorization is compliant and accurate.

Answer

NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

Answer

NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories

Answer

NIST SP 800-37, Risk Management Framework for Information Systems and Organizations