CGRC Practice Exam 2 — 20 Questions

Question 1

Which THREE of the following are elements of a secure incident response control set?

Accepted Answer

Establishing a dedicated Incident Response Team (IRT). Preparation, identification, and containment are foundational phases of the incident response lifecycle.

Answer

Sharing sensitive server logs on a public forum

Answer

Disabling all security controls during an investigation

Question 2

When conducting an audit, what is 'sampling'?

Accepted Answer

Selecting a representative subset for testing. Sampling is the process of selecting a subset of data (e.g., user accounts) to represent the entire population to make an inference about the effectiveness of a control.

Answer

Randomly selecting records without criteria

Answer

Testing only the most recent data

Answer

Testing every single record in a database

Question 3

Which TWO of the following are primary components of an effective security control assessment report?

Accepted Answer

Detailed Findings and Supporting Evidence. An assessment report must detail the findings/weaknesses and the evidence that supports those findings.

Answer

Employee performance reviews

Answer

List of all vendor contracts

Answer

Company financial statements

Question 4

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

Accepted Answer

Confidentiality=Low, Integrity=Low, Availability=High.. Categorization must account for the impact on the organization, regardless of data classification (e.g., public vs. sensitive).

Answer

Exclude the system from FIPS 199 requirements.

Answer

Categorize only based on Confidentiality.

Answer

Confidentiality=Low, Integrity=Low, Availability=Low.

Question 5

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

Accepted Answer

Certificate Revocation List (CRL) Distribution Point. A Certificate Revocation List (CRL) is essential for clients to verify if a certificate is still valid.

Answer

OCSP Responder

Answer

Key Archival

Answer

Trust Anchor

Question 6

What is the primary goal of the 'Assessment Reporting' phase?

Accepted Answer

To communicate findings to stakeholders. Reporting provides stakeholders with an accurate picture of the security posture, identified risks, and the evidence supporting the findings.

Answer

To terminate the contract

Answer

To select new security controls

Answer

To patch all identified vulnerabilities

Question 7

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. A NIST Cryptographic Module Validation Program (CMVP) certificate provides formal verification that a product has met the FIPS 140 requirements.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor

Question 8

Which technique is best to detect 'false negatives' during a security control assessment?

Accepted Answer

Reviewing security log correlation. Correlation of logs from multiple sources (e.g., firewall, IPS, host logs) allows an auditor to see if a threat was missed by a single control.

Answer

Interviewing developers

Answer

Checking server physical locks

Answer

Single tool vulnerability scanning

Question 9

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Evidence must be protected from unauthorized changes, be verifiable, and be stored securely to maintain its chain of custody.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper

Question 10

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Accepted Answer

Ensuring the assignment value is consistent with organizational policy.. Effective management of assignments ensures that controls are tailored and that the organization has a clear record of its security obligations.

Answer

Updating all assignment values daily.

Answer

Consulting with the NIST publication author.

Question 11

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Accepted Answer

Implement and document compensating controls.. When a patch cannot be applied, compensating controls must be implemented and documented to mitigate the risk.

Answer

Request an exemption from the CISO without providing documentation.

Answer

Ignore the vulnerability as it cannot be fixed.

Answer

Disconnect the server from the network permanently.

Question 12

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 13

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 14

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. Publisher rules in AppLocker allow for the most granular control based on digital certificates.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 15

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. A compensating control is an alternate measure used to satisfy the requirement of a security control that cannot be implemented as stated.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 16

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

Accepted Answer

Target state, Current state, Gap identification. You must define the target (what good looks like), determine the current state (as-is), and then identify the delta (gap).

Answer

Current state, Target state, Gap identification

Answer

Gap identification, Target state, Current state

Answer

Current state, Gap identification, Target state

Question 17

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. Execution involves interviewing staff, reviewing documentation, and testing technical configuration settings.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 18

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. A formal change control process is required to ensure that changes are tested, documented, and approved.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 19

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Patch management requires testing to prevent outages and a deployment strategy to ensure coverage.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 20

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Accepted Answer

To define specific parameters for control implementation.. Assignment statements provide a mechanism to tailor the control by specifying organization-defined values or frequencies.

Answer

To categorize the control by its priority level.

Answer

To link the control to a regulatory requirement.

Answer

To assign the control to a specific system administrator.