CGRC Practice Test 20 — 15 Questions

Question 1

Which role is typically responsible for defining the 'Risk Appetite' within a GRC governance framework?

Accepted Answer

The Executive Steering Committee.. Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives, which is a strategic business decision rather than a technical or operational one. The Executive Steering Committee (or board-level governance body) owns this decision because it has the authority to balance risk against strategic goals and allocate resources accordingly. GRC frameworks such as COSO ERM and ISO 31000 place risk appetite definition at the top of the governance hierarchy, directly under the board of directors.

Answer

The IT Operations Manager.

Answer

The GRC System Administrator.

Answer

The Internal Audit Manager.

Question 2

You are assessing an organization's compliance with the Payment Card Industry Data Security Standard (PCI DSS). As part of the assessment, you need to verify that the organization has implemented proper access control measures for its cardholder data environment (CDE). Which of the following assessment activities would best provide objective evidence of compliance with PCI DSS Requirement 7 (Restrict access to cardholder data by business need to know)?

Accepted Answer

Attempt to access cardholder data using a user account that should not have privileges, and verify that access is denied.. PCI DSS assessments require a combination of examine, interview, and test methods. For Requirement 7, the most objective evidence comes from testing the access control mechanism. Attempting to access data with an unauthorized account and verifying denial directly confirms that access is restricted as required. Document reviews and interviews are supporting activities but do not prove effectiveness. Thus, the test is the best evidence.

Answer

Review access control lists (ACLs) and interview system administrators to confirm that access is granted based on job roles.

Answer

Observe a security awareness training session for employees who handle cardholder data.

Answer

Examine the written security policy to confirm that it states access is based on least privilege.

Question 3

A financial services firm is embedding risk management into its GRC program. The CISO wants a technique that expresses risk in monetary terms so that the board can compare a database breach scenario against the cost of additional controls. Which approach should the GRC practitioner recommend?

Accepted Answer

Quantitative risk analysis using annualized loss expectancy and single loss expectancy. When the objective is comparing risk exposure against control cost in financial terms, quantitative analysis is required. Annualized loss expectancy expresses expected yearly loss in dollars, allowing direct comparison with the annualized cost of a safeguard and supporting a defensible investment decision. Qualitative and visual methods rank risks but cannot be expressed in currency.

Answer

A control self-assessment questionnaire distributed to business process owners

Answer

A risk heat map plotting likelihood against impact using color-coded cells

Answer

Qualitative risk scoring using a five-point likelihood and impact scale

Question 4

You are selecting controls for a system that must comply with both NIST SP 800-53 and the Payment Card Industry Data Security Standard (PCI DSS). The system processes credit card transactions. You have identified overlapping controls, but some PCI DSS requirements are more prescriptive than the NIST controls. What is the most effective approach to reconcile these differences during control selection?

Accepted Answer

Implement the NIST controls as the primary baseline and add PCI DSS-specific controls as overlays to meet the stricter requirements.. The most effective approach is to use NIST SP 800-53 as the primary baseline and add PCI DSS-specific controls as an overlay. This leverages the comprehensive NIST framework and addresses PCI DSS's stricter requirements without duplication. It ensures compliance with both standards and maintains a structured, defensible control set.

Answer

Create a custom control set that combines the lowest common denominator of both standards to reduce implementation effort.

Answer

Implement only the PCI DSS controls, as they are more prescriptive and will automatically satisfy NIST requirements.

Answer

Map each PCI DSS requirement to the corresponding NIST control and implement the NIST control as written, ignoring the stricter PCI DSS details.

Question 5

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

Accepted Answer

Individual systems do not need to address password complexity.. A 'common control' is a control that is implemented once and inherited by multiple systems. If the organization has documented a common control for password complexity, individual systems do not need to address password complexity separately because they inherit the control from the common control provider. This avoids duplication and ensures consistency.

Answer

Individual systems must override the common control.

Answer

Common controls cannot be used for password complexity.

Answer

Individual systems must report their own password status.

Question 6

A financial institution is implementing a new system to detect and respond to insider threats. The security team wants to monitor user behavior and flag anomalous activities, such as accessing large amounts of data outside normal working hours. Which type of control is being implemented?

Accepted Answer

User behavior analytics (UBA). User behavior analytics is designed to detect insider threats by analyzing user activity and identifying deviations from normal patterns. SIEM provides log aggregation but lacks inherent behavioral analysis, DLP focuses on data exfiltration, and RBAC is a preventive access control. UBA is the most appropriate control for monitoring and flagging anomalous user behavior.

Answer

Data loss prevention (DLP)

Answer

Role-based access control (RBAC)

Answer

Security information and event management (SIEM)

Question 7

A government agency is implementing a new case management system. The security policy requires that all users be granted only the minimum access necessary to perform their job functions. Which principle is being applied?

Accepted Answer

Least privilege. The policy requires granting only the minimum access necessary for job functions, which is the definition of least privilege. Separation of duties, defense in depth, and need to know are related but distinct concepts. Least privilege directly addresses the scope of permissions, making it the correct answer.

Answer

Need to know

Answer

Separation of duties

Answer

Defense in depth

Question 8

You are a security architect selecting controls for a new federal payroll system categorized as MODERATE impact. The system will be hosted in a government-operated data center. Your organization has already implemented a robust physical security program at the facility, including 24/7 guards, biometric access, and CCTV monitoring. You must select the most appropriate control for physical access authorization. Which action best aligns with NIST SP 800-53 control selection and tailoring guidance?

Accepted Answer

Document the facility's physical access controls as a common control inherited by the payroll system and focus on verifying their adequacy.. The correct approach is to leverage the existing facility physical security as a common control. This aligns with NIST SP 800-53 tailoring guidance, which encourages the use of common controls to reduce redundancy and ensure consistent protection. Documenting the control as inherited and verifying its adequacy satisfies the requirement without unnecessary duplication.

Answer

Implement a new, system-specific physical access control system for the payroll system's server room, duplicating the facility's existing controls.

Answer

Mark the physical access authorization control as 'Not Applicable' because the facility already has physical security, and no further action is needed.

Answer

Select a different control from the PE family that is easier to implement, such as monitoring physical access, and omit the access authorization control.

Question 9

You are a risk practitioner for a healthcare organization. You are selecting controls for a system that processes electronic protected health information (ePHI). You need to ensure compliance with the HIPAA Security Rule while using NIST SP 800-53 as a framework. What is the most effective approach?

Accepted Answer

Create a custom overlay that maps HIPAA Security Rule requirements to NIST SP 800-53 controls and apply it to the baseline.. The most effective approach is to create an overlay that maps HIPAA Security Rule requirements to NIST SP 800-53 controls and apply it to an appropriate baseline. This ensures that all HIPAA-specific mandates are addressed while leveraging the comprehensive NIST framework for a risk-based, structured control set.

Answer

Use the NIST SP 800-53 MODERATE baseline as-is, because it is more stringent than HIPAA.

Answer

Select only the controls that are explicitly mentioned in the HIPAA Security Rule and ignore the rest of the NIST baseline.

Answer

Use the NIST SP 800-53 LOW baseline and add controls as needed based on a risk assessment.

Question 10

An energy utility is defining its risk appetite. The board states that it will accept moderate risk in pursuit of operational efficiency but will tolerate almost no risk to safety or regulatory compliance. Which action should the GRC practitioner take to translate this statement into an operational instrument?

Accepted Answer

Define risk tolerance thresholds per risk category and link them to escalation triggers in the risk register. An appetite statement becomes operational only when translated into measurable tolerances by risk category and connected to escalation triggers. The board's differentiated stance, near-zero tolerance for safety and compliance versus moderate tolerance for efficiency, requires different thresholds per category rather than one uniform limit or unfettered delegation.

Answer

Delegate full risk acceptance authority to individual department managers without documented limits

Answer

Publish the board statement verbatim in the annual report and take no further action

Answer

Assign every identified risk an identical maximum acceptable score regardless of category

Question 11

As an ISC2 CGRC candidate, you are asked to distinguish between different types of audits. Which type of audit is characterized by an independent external party evaluating an organization's security controls to provide assurance to stakeholders?

Accepted Answer

Third-party audit. A third-party audit is performed by an independent external auditor, providing objective assurance to stakeholders such as customers, regulators, and investors. This type of audit is essential for building trust and demonstrating compliance with standards like ISO/IEC 27001 or SOC 2. The independence of the auditor is the key differentiator from first- and second-party audits.

Answer

Compliance audit

Answer

First-party audit

Answer

Second-party audit

Question 12

A security manager is defining the authorization boundary for a system that processes Controlled Unclassified Information (CUI). The system consists of a web server, an application server, and a database server, all hosted on-premises. The system also uses a shared network switch and a shared firewall that are used by other systems in the same data center. Which two components should be included in the authorization boundary? (Choose two.)

Accepted Answer

The web server, because it directly processes CUI and is dedicated to the system.. The authorization boundary should include dedicated components that process, store, or transmit CUI, such as the web server and application server. Shared components like the network switch and firewall are common controls and are inherited, not included in the boundary. This approach aligns with NIST SP 800-37's guidance on defining boundaries around system-specific components.

Answer

The data center physical security controls, because they protect the servers.

Answer

The shared firewall, because it enforces security policies for the system.

Answer

The shared network switch, because it carries CUI traffic for the system.

Question 13

A security analyst is preparing to categorize a new human resources system that will store PII for 5,000 employees. The system will be hosted in a government cloud environment. According to FIPS 199, what is the FIRST step the analyst should take to determine the security category?

Accepted Answer

Identify the information types processed, stored, or transmitted by the system and determine the potential impact of a security breach.. FIPS 199 mandates that security categorization begins with identifying the information types the system handles and assessing the potential impact of a breach on confidentiality, integrity, and availability. This impact analysis drives the overall security category, which then informs control selection and other RMF activities. The other options describe later RMF phases or actions that depend on the categorization outcome.

Answer

Conduct a vulnerability assessment to identify weaknesses in the cloud hosting environment.

Answer

Select the appropriate security controls from NIST SP 800-53 based on the system's processing environment.

Answer

Document the system boundary and obtain approval from the Authorizing Official before assigning impact levels.

Question 14

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

Accepted Answer

Confidentiality=Low, Integrity=Low, Availability=High.. FIPS 199 requires separate categorization of the three security objectives: confidentiality, integrity, and availability. Because the data is publicly available, confidentiality impact is Low; because the question gives no indication of integrity requirements, integrity defaults to Low. However, the system provides critical government services and catastrophic loss of availability means the availability impact must be High, producing Confidentiality=Low, Integrity=Low, Availability=High.

Answer

Exclude the system from FIPS 199 requirements.

Answer

Categorize only based on Confidentiality.

Answer

Confidentiality=Low, Integrity=Low, Availability=Low.

Question 15

Which THREE of the following are necessary to establish a 'Continuous Control Monitoring' (CCM) program?

Accepted Answer

Automated notification workflows for failed controls.. Continuous Control Monitoring (CCM) requires automated, near-real-time evaluation of controls, so option A (automated notification workflows for failed controls) is correct because alerts must fire when a control breaches its threshold so remediation can be triggered promptly. Option C (defined thresholds for 'Pass' or 'Fail' conditions) is correct because CCM cannot evaluate a control without explicit, measurable criteria that determine compliance versus non-compliance. Option D (automated data extraction from IT assets) is correct because CCM depends on continuous, machine-driven collection of telemetry and configuration data from systems rather than periodic human sampling. Option B is not required because daily physical site visits are a manual, point-in-time activity that contradicts the continuous, automated nature of CCM, and option E is not required because a quarterly manual spreadsheet is periodic and manual, which is the opposite of continuous monitoring.

Answer

A physical audit team performing site visits daily.

Answer

A manual spreadsheet that is updated every quarter.