CGRC Practice Exam 3 — 20 Questions

Question 1

An organization is using a cloud service provider (CSP) for a system that processes moderate-impact data. The CSP has a FedRAMP authorization. What is the most efficient way for the organization to leverage the CSP's authorization to support its own system's authorization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inherit the CSP's controls that are within the FedRAMP authorization boundary and document them in the System Security Plan (SSP) as inherited controls.. The most efficient approach is to inherit the CSP's controls that are within its FedRAMP authorization boundary and document them as inherited in the SSP. This leverages the existing authorization, reduces duplication, and allows the organization to focus on its own controls. It also supports reciprocity and speeds up the authorization process for the organization's system.

Answer

Conduct a full independent assessment of the CSP's controls to verify the FedRAMP authorization.

Answer

Assume all controls are fully inherited and do not document any controls in the organization's SSP.

Answer

Require the CSP to undergo a new FedRAMP authorization specifically for the organization's system.

Question 2

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary is defined by the set of components that the authorizing official has authority over — i.e., ownership and control. When data is shared with an external partner, the boundary must be drawn where the organization's control ends and the partner's begins, because the AO can only accept risk for systems they own or control. Cost, physical location, and user count do not determine who is accountable for the risk.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 3

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. The authorization boundary defines exactly which systems, components, and data are included in a security assessment and authorization decision. If that boundary is drawn inaccurately — too narrow or misaligned with the actual system — assets and vulnerabilities that should have been assessed fall outside the scope. Those excluded assets remain unprotected and unmitigated, which is the core risk the question is testing.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 4

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement in the RMF tailoring process (NIST SP 800-37 / SP 800-53) is the step where control statements are adjusted — adding specificity, clarifying language, or scoping the control to the system's particular environment — so the control is precise and implementable. It does not change the control's intent or the system's impact level; it makes the wording actionable for the specific system. This is distinct from scoping (removing controls not applicable) and supplementation (adding controls beyond the baseline).

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 5

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing the BitLocker recovery key in Active Directory (specifically in the computer object's msFVE-RecoveryInformation attribute) is the recommended enterprise practice because AD provides centralized, access-controlled, and auditable storage. This allows authorized administrators to retrieve the key if the drive is locked, while preventing unauthorized access through AD permissions. It also ensures the key survives hardware failures or user turnover.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop

Question 6

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Option B is correct because automated patch testing in a staging environment lets you validate updates against representative systems before production rollout, catching compatibility, regression, and deployment issues while keeping the process repeatable and scalable. Option E is correct because defined emergency patch procedures are essential for out-of-band critical vulnerabilities (for example, zero-days or actively exploited CVEs), specifying expedited risk assessment, approval, deployment, and rollback steps so urgent fixes are applied without bypassing governance. Option A is wrong because hosting patch files on a public FTP site exposes unauthenticated, unencrypted distribution and risks tampered or spoofed binaries; patches should come from vendor-signed, integrity-verified sources over HTTPS. Option C is wrong because requiring manual approval for every single update does not scale, creates bottlenecks, and delays critical fixes; approval should be risk-based and largely automated for routine patches. Option D is wrong because disabling all automatic updates removes timely delivery of security fixes and increases exposure windows, contradicting the goal of an effective patch management program.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 7

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. The System Security Plan (SSP) is the RMF artifact that documents the system boundary — the people, processes, and technologies that make up the system and its authorization boundary. The boundary description within the SSP defines what is inside versus outside the authorization, which directly supports categorization, control selection, and assessment scoping in the RMF process.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 8

A healthcare organization must implement a control to protect electronic protected health information (ePHI) from unauthorized access during transmission over a public network. The security team has decided to use Transport Layer Security (TLS) 1.3. Which statement best describes why TLS 1.3 satisfies the HIPAA Security Rule's transmission security requirement?

Accepted Answer

TLS 1.3 encrypts data in transit and provides integrity checks, ensuring confidentiality and integrity of ePHI.. TLS 1.3 secures data in transit by encrypting the channel and providing integrity protection, which directly meets the HIPAA Security Rule's transmission security standard. It does not provide access control, encryption at rest, or audit logging. The control is appropriate because it prevents eavesdropping and tampering during transmission over public networks.

Answer

TLS 1.3 automatically logs all access to ePHI for audit purposes.

Answer

TLS 1.3 ensures ePHI is encrypted at rest on endpoint devices.

Answer

TLS 1.3 provides role-based access control to ePHI stored on servers.

Question 9

A GRC analyst is supporting the ongoing authorization of a system that has been designated as high-impact. The authorizing official has requested evidence that the continuous monitoring program is providing adequate visibility into the system's security posture. Which of the following activities BEST demonstrates that the program is effectively supporting ongoing authorization?

Accepted Answer

Providing the authorizing official with a dashboard that displays real-time status of key security controls and automated alerts for anomalies.. Providing a real-time dashboard with automated alerts best demonstrates continuous visibility into the security posture. This allows the authorizing official to monitor control effectiveness and respond to anomalies promptly, which is essential for ongoing authorization. It exemplifies the automation and near-real-time data expected in a mature continuous monitoring program under NIST SP 800-137, supporting timely risk decisions.

Answer

Documenting the continuous monitoring strategy in the system security plan and obtaining approval from the authorizing official.

Answer

Conducting an annual security control assessment and providing the results to the authorizing official.

Answer

Submitting a quarterly report that summarizes all security incidents and their resolutions.

Question 10

A newly formed GRC team at a logistics company is drafting the organization's first compliance program. The team lead wants to ensure the program aligns with the principle that compliance is everyone's responsibility, not just the GRC function's. Which element should be included to reinforce this principle?

Accepted Answer

Defined roles and responsibilities for compliance across business units and management. To reinforce that compliance is everyone's responsibility, the program must define roles and responsibilities across business units and management. This distributes accountability and makes compliance part of everyday operations. Help desks, awareness posters, and dedicated departmental officers either concentrate responsibility or fail to establish structural ownership, so they do not achieve the stated principle.

Answer

An annual compliance awareness poster campaign in the corporate offices

Answer

A dedicated compliance officer assigned to every department's daily operations

Answer

A centralized help desk that answers all compliance questions for employees

Question 11

You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)

Accepted Answer

Monitoring security alerts and advisories from vendors and US-CERT. According to NIST SP 800-137, continuous monitoring includes ongoing security control assessments and monitoring of security alerts and advisories. These activities provide situational awareness and ensure controls remain effective. Penetration testing and full reauthorization are not mandatory components, and incident documentation is handled separately from the SSP. The two selected activities are fundamental to maintaining an ongoing authorization.

Answer

Conducting a full reauthorization every six months

Answer

Documenting all security incidents in the System Security Plan (SSP)

Answer

Performing annual penetration testing on all systems

Question 12

A healthcare organization's GRC team is defining key risk indicators (KRIs) for its patient data protection program. The CISO wants KRIs that are predictive of potential breaches, not just historical metrics. Which of the following should the GRC practitioner recommend as a leading KRI?

Accepted Answer

Percentage of critical systems with unpatched vulnerabilities older than 30 days.. The correct answer is the percentage of critical systems with unpatched vulnerabilities older than 30 days. This is a leading KRI because it measures a condition that increases the likelihood of a breach before it happens. It is actionable and predictive, enabling the organization to prioritize remediation and reduce risk proactively, which is exactly what the CISO requested.

Answer

Total number of security awareness training completions in the last quarter.

Answer

Number of past data breach incidents involving patient records.

Answer

Average time to detect a security incident after it occurs.

Question 13

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. Change management approval is the administrative control that ensures a new security tool is reviewed for impact, risk, and rollback before it touches production. It provides documented authorization, prevents unvetted changes from disrupting availability or compliance, and creates an audit trail. Without it, deployment bypasses governance and can violate policy or introduce outages.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 14

During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?

Accepted Answer

Document the finding and develop a POA&M to replace the encryption with a FIPS 140-2 validated module.. When a control is not met, the appropriate action is to document the finding and create a POA&M to bring the system into compliance. In this case, replacing the encryption with a FIPS 140-2 validated module is necessary. The system owner cannot simply accept equivalent encryption without formal approval. Disconnecting the system or misclassifying the control are not standard procedures.

Answer

Mark the control as 'Not Applicable' because the encryption is not required for this system.

Answer

Immediately disconnect the system from the network until the encryption is replaced.

Answer

Accept the encryption as an equivalent control and document the rationale in the SSP.

Question 15

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Accepted Answer

Perform a security impact analysis on the change.. Per NIST SP 800-37 R2, when a significant change occurs during ongoing authorization, the first step is to perform a security impact analysis to determine the extent of the change's effect on the security posture. This analysis informs whether the change is within the already-authorized boundary or requires reauthorization. It is a risk-based approach that ensures the Authorizing Official has the necessary information before deciding on further actions.

Answer

Immediately decommission the system.

Answer

Update the System Security Plan (SSP) and submit for re-certification.

Answer

Wait until the annual assessment cycle to review the change.

Question 16

A federal information system has an approved Authority to Operate (ATO) with an expiration date of 18 months from now. The system owner asks you, the GRC analyst, what triggers a reauthorization before that date. Which of the following events most clearly requires a reauthorization decision by the Authorizing Official?

Accepted Answer

A change in the system's boundary that adds a new interconnection with an external partner system.. A new interconnection with an external partner system expands the authorization boundary and introduces additional risk that was not evaluated in the original ATO. Under NIST SP 800-37, significant changes such as boundary modifications require a security impact analysis and a reauthorization decision by the Authorizing Official. Routine operational activities like log reviews, training, and minor firmware updates do not meet the threshold for reauthorization.

Answer

A minor firmware update to a network switch that does not affect any security controls.

Answer

A quarterly review of audit logs that shows no anomalies or security incidents.

Answer

An annual security awareness training completion report for all system users.

Question 17

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

Accepted Answer

Map Active Directory groups to granular GRC Security Profiles.. Mapping Active Directory groups to granular GRC Security Profiles enforces least privilege by ensuring auditors receive only the permissions their role requires, based on their AD group membership. This leverages existing identity infrastructure (AD) as the source of truth while applying role-based access control within the GRC platform. It is the only option that aligns with least privilege principles.

Answer

Assign Global Administrator rights to the lead auditor.

Answer

Enable Single Sign-On (SSO) for all users globally.

Answer

Configure a shared service account for all audit activities.

Question 18

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Accepted Answer

Automated security regression testing in the CI/CD pipeline.. In a Continuous Authorization model (aligned with NIST SP 800-37 Rev. 2 and the DoD's cATO guidance), automated security regression testing in the CI/CD pipeline is critical because it verifies on every build that previously validated security controls remain effective despite frequent code changes. This provides the continuous, automated evidence needed to maintain the authorization baseline without re-authorizing from scratch with each release.

Answer

Daily vulnerability scanning of the production environment.

Answer

Annual penetration testing of the application.

Answer

Manual sign-off by the CISO before every code commit.

Question 19

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. In Microsoft Endpoint Configuration Manager, Configuration Items (CIs) define the settings and rules you want to evaluate — such as specific registry key values — and are paired with Configuration Baselines to assess compliance across collections of workstations. This is the native compliance settings feature designed exactly for verifying registry, file, and script-based configuration state.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 20

An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)

Accepted Answer

Document the assessment procedures, evidence collected, and findings in a Security Assessment Report (SAR) that can be reviewed and audited.. A reliable and repeatable assessment requires a detailed assessment plan that maps controls to methods and a Security Assessment Report that documents procedures, evidence, and findings. These artifacts ensure consistency, support independent review, and provide a defensible basis for authorization decisions. Relying on a single method or waiting arbitrarily would undermine the assessment's credibility and completeness.

Answer

Use automated tools exclusively for all controls to eliminate human error and ensure consistency.

Answer

Rely solely on interviews with system administrators to verify technical controls because they are the most knowledgeable.

Answer

Conduct the assessment only after the system has been in operation for at least one year to gather sufficient operational data.