CGRC Practice Test 2 — 10 Questions

Question 1

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The System Security Plan (SSP) documents the system boundary, controls selected and implemented, and how they meet requirements. The Security Assessment Report (SAR) is the output of assessing those controls, evaluating whether the controls described in the SSP are effective. Thus the SAR evaluates the SSP's controls, and both feed the authorization decision.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP

Question 2

You are the Information System Security Officer (ISSO) for a federal payroll system undergoing an annual assessment. The Security Control Assessor (SCA) reports that a firewall rule allowing inbound RDP from any source is in place, contradicting the documented configuration in the System Security Plan (SSP). The system owner argues the rule is temporary for a migration. What is the most appropriate immediate action?

Accepted Answer

Instruct the network team to remove or restrict the rule immediately, then update the SSP and POA&M to reflect the change.. An undocumented firewall rule allowing unrestricted RDP is a critical finding that must be addressed immediately. The correct approach is to restrict or remove the rule to eliminate exposure, then update the SSP to reflect the actual configuration and create a POA&M entry to track root-cause remediation. This restores compliance and ensures the system operates within its authorized security posture.

Answer

Document the discrepancy in the Plan of Action and Milestones (POA&M) and allow the migration to complete.

Answer

Accept the risk because the system owner has authority over the system and can approve temporary deviations.

Answer

Suspend the system's Authorization to Operate (ATO) until the migration is complete and the rule is removed.

Question 3

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. During the Control Selection phase, the Authorizing Official (AO) is responsible for approving the tailoring decisions made by the system owner and security team, ensuring the selected controls adequately address the system's risk profile. The AO's approval formalizes the agreed-upon control set before it moves into implementation and assessment. This approval is a key governance step that ties control selection to the authorization decision.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 4

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Accepted Answer

The on-premises servers are included in the boundary because they are under the agency's direct control and process CUI.. The boundary should include components under the agency's direct control that process CUI, such as on-premises servers. For cloud services with FedRAMP authorizations, the agency can exclude those components if it documents inherited controls and accepts residual risk. This approach aligns with NIST guidance on leveraging external authorizations and focusing on the agency's own responsibilities.

Answer

The boundary must include all cloud components regardless of the provider's authorization status to ensure end-to-end security.

Answer

The boundary should be defined based on the physical location of the servers to ensure data sovereignty requirements are met.

Answer

The PaaS provider's underlying infrastructure is included in the boundary because the agency's applications run on it.

Question 5

A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?

Accepted Answer

FedRAMP Customer Responsibility Matrix (CRM). The FedRAMP Customer Responsibility Matrix (CRM) is the key document that defines which security controls are inherited from the CSP and which the agency must implement and assess. By using the CRM, the agency can avoid duplicating assessments and focus on its own responsibilities. This leverages the FedRAMP authorization to streamline the ATO process while ensuring all controls are covered.

Answer

FedRAMP Authority to Operate (ATO) letter

Answer

FedRAMP Security Assessment Report (SAR)

Answer

FedRAMP Continuous Monitoring (ConMon) plan

Question 6

A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common control provided by a separate organizational unit. The common control's assessment was performed by that unit, and the results are documented in a shared assessment report. What should the Assessor do to support the system's authorization?

Accepted Answer

Review the shared assessment report to determine if it meets the system's assurance requirements and document any inheritance of the control in the system security plan.. Common controls can be leveraged across systems, and their assessment results can be reused if they meet the receiving system's assurance requirements. The Assessor should review the shared report for currency, scope, and relevance, then document the inheritance in the system security plan. Re-assessing or excluding the control would be inefficient or incorrect. This practice aligns with the RMF's goal of reuse and reciprocity.

Answer

Re-assess the common control independently because the system's high-impact level requires a full assessment of all controls.

Answer

Perform a penetration test of the common control to validate the shared assessment report before accepting it.

Answer

Exclude the common control from the system's assessment because it is outside the system's authorization boundary.

Question 7

An organization is undergoing a periodic security assessment of its production environment. The assessment team lead needs to ensure that the assessment scope is formally agreed upon and that all relevant stakeholders understand the boundaries. Which document should the team lead produce FIRST to establish this shared understanding?

Accepted Answer

Security Assessment Plan (SAP). The Security Assessment Plan is the key document that formalizes the scope, approach, and logistics of an assessment. It ensures that all stakeholders have a common understanding of what will be assessed, how, and by whom. Without an approved SAP, the assessment lacks a controlled framework, leading to potential misunderstandings and inefficiencies. Thus, the SAP is the correct first step.

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

System Security Plan (SSP)

Question 8

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. Configuring an automated workflow trigger based on vendor tier and date ensures that critical vendors are systematically flagged for annual due diligence without manual intervention. This leverages the GRC platform's scheduling and tiering capabilities to enforce policy consistently, generate tasks, and maintain audit trails. It aligns with TPRM best practices by automating recurring assessments and reducing the risk of missed reviews.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 9

You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?

Accepted Answer

An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold.. An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold is correct because it directly enforces the risk appetite statement by initiating a Risk Treatment Plan whenever a score exceeds the defined tolerance. This creates a deterministic, auditable linkage between risk scoring and treatment workflow. It also ensures consistency across all risk records rather than relying on individual action.

Answer

A manual email notification from the risk owner to the CISO.

Answer

A change in the risk rating calculation formula.

Answer

A daily report showing all risks over the appetite.

Question 10

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Accepted Answer

The cloud service provider (CSP).. Under the shared responsibility model, the cloud service provider (CSP) (D) is responsible for compliance of the cloud itself — the physical datacenters, hardware, hypervisor, and foundational services — while the cloud customer (E) is responsible for compliance in the cloud, including their data, configurations, access controls, and applications they deploy. These two parties split security and compliance duties based on the service model (IaaS, PaaS, SaaS), which is why both are the entities typically accountable. The hardware manufacturer (A) only supplies components and does not bear operational compliance responsibility once equipment is deployed in a CSP's datacenter. The local internet service provider (B) merely transports connectivity and has no role in cloud compliance obligations. The end-user of the application (C) consumes services but is not a distinct compliance-responsible entity separate from the cloud customer organization.

Answer

The hardware manufacturer.

Answer

The local internet service provider.

Answer

The end-user of the application.