CGRC Practice Exam 4 — 20 Questions

Question 1

You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider. The control is documented in the system security plan as 'Inherited'. What is the most critical item to verify during assessment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

That the control is implemented correctly and consistently by the common control provider.. When a control is inherited, the system owner depends on the common control provider for its implementation. Therefore, the most critical verification is that the control is implemented correctly and consistently. This ensures the inheritance is valid and the system's security posture is not compromised by relying on an ineffective control.

Answer

That the common control provider has a current authorization to operate.

Answer

That the system owner has signed a memorandum of understanding with the provider.

Answer

That the control is listed in the common control provider's security plan.

Question 2

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the primary, account- and bucket-level control specifically designed to override any policy or ACL that would grant public access, acting as a centralized guardrail. It can be applied at the account level to prevent any bucket from becoming public, which is the strongest preventive mechanism. This directly addresses the requirement to prevent public exposure of PII stored in S3.

Answer

Encryption at Rest

Answer

Bucket ACLs

Answer

IAM User Permissions

Question 3

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Accepted Answer

Explicit assignment of policy ownership and accountability.. Option B is correct because effective governance requires that each policy have a clearly identified owner who is accountable for its maintenance, enforcement, and review, ensuring there is no ambiguity about who is responsible. Option D is correct because a GRC policy must contain clear, unambiguous policy statements tied to organizational objectives, so that the controls and requirements directly support the business goals and can be measured and audited. Options A, C, and E are incorrect because a CISO's home address, employees' social media handles, and a website color scheme are irrelevant operational or personal details that do not contribute to policy ownership, accountability, or alignment with organizational objectives.

Answer

The home address of the CISO.

Answer

A list of all employees' social media handles.

Answer

The exact color scheme of the company website.

Question 4

An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end, an application server, and a database. The database is hosted in a separate virtual private cloud (VPC) managed by the same organization. The ISO wants to minimize the boundary while ensuring all necessary components are included. What should the ISO do?

Accepted Answer

Include the web front-end, application server, and database in the boundary, and document the network segmentation and controls between the VPCs.. The authorization boundary must include all components that process, store, or transmit system data, regardless of their location. The database, even in a separate VPC, is part of the system. Documenting the network segmentation and controls ensures that the interconnections are assessed. Excluding the database or the network infrastructure would create gaps, while including the entire organization would be overbroad. The ISO should define a boundary that accurately reflects the system's logical and physical components.

Answer

Define the boundary as the entire organization's network because all components are managed by the same organization.

Answer

Include only the web front-end and application server, treating the database as an external service because it is in a separate VPC.

Answer

Include the web front-end, application server, and database, but exclude the network infrastructure that connects the VPCs.

Question 5

A security analyst is documenting the authorization boundary for a new system. The system will be deployed on a government cloud environment and will interface with an external identity provider for authentication. The identity provider is owned and operated by another agency. How should the analyst represent the external identity provider in the authorization boundary documentation?

Accepted Answer

Document the identity provider as an external interface and describe the trust relationship and any inherited controls.. The external identity provider should be documented as an external interface, with details about the trust relationship and any inherited controls. This aligns with NIST SP 800-37, which requires external dependencies to be described in the authorization boundary documentation. This ensures that the system's risk assessment considers the provider's security posture and any reliance on its controls.

Answer

Represent the identity provider as a common control that is fully inherited without further documentation.

Answer

Exclude the identity provider entirely from the boundary documentation because it is external.

Answer

Include the identity provider as an internal component of the system boundary because it is critical to authentication.

Question 6

You are conducting an assessment of a cloud service provider's (CSP) compliance with the FedRAMP Moderate baseline. The CSP has provided a system security plan (SSP) and a set of assessment procedures. You notice that the SSP indicates that a particular control is inherited from the underlying IaaS provider. What is the most appropriate action to verify the effectiveness of this inherited control?

Accepted Answer

Request and review the IaaS provider's FedRAMP authorization package and assess the control there.. The correct action is to request and review the IaaS provider's FedRAMP authorization package. Inherited controls are assessed by the provider that implements them, and their assessment results are documented in their authorization package. The CSP's assessor should verify that the inherited control is covered by a current authorization and that it meets the required baseline. This approach avoids duplication and ensures a reliable assessment.

Answer

Mark the control as 'not applicable' in the assessment because it is inherited.

Answer

Conduct interviews with the CSP's staff to confirm that they rely on the IaaS provider's control.

Answer

Directly test the inherited control as if it were implemented by the CSP.

Question 7

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Accepted Answer

Verifying user account permissions and group assignments. Least privilege means each user, process, and service has only the minimum permissions necessary to perform its function. The most direct audit activity is therefore to examine user account permissions, group memberships, sudoers entries, and file/directory ACLs to verify that no account has excessive rights. This directly tests the control's design and operation against the principle.

Answer

Running a Nessus vulnerability scan

Answer

Checking for physical server room access

Answer

Reviewing system logs for failed login attempts

Question 8

Which document is used to standardize the implementation of security controls across an organization?

Accepted Answer

Security Baseline. A security baseline is a documented set of minimum security configurations and controls that must be applied consistently across an organization's systems. It standardizes the implementation of security controls by providing a reference configuration (e.g., CIS Benchmarks, DISA STIGs) that ensures all systems meet a consistent security posture. Baselines are used to harden systems and are a key part of configuration management.

Answer

Incident Response Plan

Answer

Risk Register

Answer

Acceptable Use Policy

Question 9

A financial services firm operates a system processing customer credit data under an active Authority to Operate (ATO). A quarterly review shows that a recent operating system upgrade altered the configuration of the audit logging service, causing it to stop forwarding events to the central log server. The GRC analyst must determine the correct action to maintain the system's security posture and ATO validity. What should the analyst do FIRST?

Accepted Answer

Initiate a security impact analysis to evaluate the change and determine if the ATO conditions are affected.. A security impact analysis is the correct first step because it systematically evaluates how the configuration change affects the system's security controls and whether the existing ATO remains valid. It ensures that any remediation or reauthorization is based on a documented risk assessment, as required by NIST SP 800-37 and continuous monitoring guidance. This approach balances operational needs with compliance obligations.

Answer

Update the system security plan to reflect the new configuration and continue operations without further assessment.

Answer

Immediately revoke the ATO until the logging service is fully restored and verified.

Answer

Schedule a full security control assessment (SCA) for the next annual review cycle.

Question 10

A global retailer's GRC team is preparing for an external audit of its compliance program. The auditor requests evidence that the program's governing body has reviewed and approved the risk appetite and tolerance levels within the last twelve months. Which activity satisfies this request?

Accepted Answer

The risk committee's meeting minutes record approval of the risk appetite statement. The auditor needs evidence that the governing body reviewed and approved risk appetite and tolerance levels within twelve months. Meeting minutes recording that approval are the direct, dated governance artifact. Other documents show management activity or assurance but do not demonstrate governing body approval, which is the specific evidence requirement in the scenario.

Answer

The enterprise risk register showing current risk scores against appetite thresholds

Answer

The internal audit report on risk management process effectiveness

Answer

The chief information security officer's annual attestation of the security program

Question 11

Which TWO of the following are considered 'technical' security controls?

Accepted Answer

Encryption of data in transit. Encryption of data in transit (C) is a technical security control because it is implemented through cryptographic mechanisms and protocols such as TLS to protect data as it moves across networks, directly enforcing protection at the system level. Access Control Lists (ACLs) (D) are also technical controls since they are configured on devices like routers, firewalls, and operating systems to permit or deny traffic and resource access based on defined rules. In contrast, an annual risk assessment (A) is a management/administrative control involving analysis and decision-making rather than a technical mechanism, and security policies (B) are administrative controls that define rules and expectations in documentation. Fencing around the data center (E) is a physical control that deters or blocks physical intrusion, not a technical one.

Answer

Annual risk assessment

Answer

Security policies

Answer

Fencing around the data center

Question 12

During continuous monitoring, you discover that a security control that was previously assessed as effective is now failing because the responsible team stopped performing the control due to staff turnover. The control is critical for protecting sensitive data. What is the most appropriate immediate action for the GRC analyst to take?

Accepted Answer

Immediately notify the system owner and ISSO, and initiate a security impact analysis to determine the risk and required remediation.. A failing critical control requires immediate escalation to the system owner and ISSO, followed by a security impact analysis to assess the risk and determine remediation. This ensures timely action and informed decision-making. Waiting, revoking the ATO unilaterally, or removing the control from the SSP are inappropriate because they either delay risk mitigation or bypass proper governance processes.

Answer

Update the system security plan to remove the control and document that it is no longer required.

Answer

Document the failure in the POA&M and wait for the next scheduled assessment to verify if the control is still failing.

Answer

Revoke the system's Authority to Operate (ATO) until the control is restored and reassessed.

Question 13

You are leading a security assessment for a federal agency using NIST SP 800-53A. During the 'Develop Assessment Procedures' step, your team must tailor the assessment procedures to the system's specific environment. Which action should you take FIRST to ensure the procedures are appropriately scoped?

Accepted Answer

Review the system security plan (SSP) to identify the implemented controls and their specific parameters.. The correct answer is to review the system security plan first. The SSP provides the blueprint of implemented controls, including any tailoring or inherited controls. This ensures that assessment procedures are scoped correctly and that resources are focused on relevant controls. Without this step, the assessment may be misaligned with the actual system, leading to inaccurate results and wasted effort.

Answer

Immediately begin testing technical controls to gather objective evidence.

Answer

Select a sample of controls from the NIST SP 800-53 catalog to reduce assessment effort.

Answer

Conduct interviews with system administrators to understand the operational environment.

Question 14

What is the primary goal of the 'Assessment Reporting' phase?

Accepted Answer

To communicate findings to stakeholders. The Assessment Reporting phase in the RMF (Risk Management Framework) and similar assessment lifecycles exists specifically to document and communicate assessment results—findings, risks, and recommendations—to key stakeholders such as authorizing officials, system owners, and oversight bodies. Its core purpose is not remediation or control selection, but ensuring decision-makers have the information needed to make risk-based decisions (e.g., authorization to operate). Thus, 'communicate findings to stakeholders' accurately captures the primary goal.

Answer

To terminate the contract

Answer

To select new security controls

Answer

To patch all identified vulnerabilities

Question 15

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Accepted Answer

Availability.. FIPS 199 defines three security objectives for information types and information systems: confidentiality, integrity, and availability, so the two correct answers here are A (Availability) and E (Confidentiality). Availability (A) is correct because FIPS 199 requires assessing the potential impact of a loss of timely and reliable access to the system and its data, with the resulting categorization of low, moderate, or high. Confidentiality (E) is correct because FIPS 199 requires evaluating the impact of unauthorized disclosure of information, again producing a low, moderate, or high rating. The unmarked options do not belong because authentication, accountability, and non-repudiation are not among the three FIPS 199 impact objectives; they are related security services or controls addressed in other standards such as FIPS 200 and NIST SP 800-53, not the FIPS 199 impact triad.

Answer

Authentication.

Answer

Accountability.

Answer

Non-repudiation.

Question 16

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Before any IT asset holding sensitive information leaves organizational control, the storage media must be sanitized using an approved standard (e.g., NIST SP 800-88 Rev. 1 purge or clear, or physical destruction) to prevent data remanence and unauthorized disclosure. This is the control that directly addresses the confidentiality risk of disposal; all other steps are administrative or operational and do not protect the data itself.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 17

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

Accepted Answer

Apply a 'Category Filter' or 'Saved View' to the dashboard widget.. To display only risks associated with 'Cybersecurity' on a Risk Heat Map, you should apply a 'Category Filter' or 'Saved View' to the dashboard widget. This allows the executive to see a filtered subset of risks without altering the underlying data or system configuration. Filters and saved views are standard features in GRC platforms for customizing dashboards based on user needs.

Answer

Change the risk rating scale from 1-5 to 1-10.

Answer

Delete all non-cybersecurity risks from the system.

Answer

Create a new database user for the executive.

Question 18

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A jump server (bastion host) with multi-factor authentication (MFA) enforces a controlled, auditable entry point to the production network, requiring a second authentication factor before any access is granted. This architecture centralizes access logging, session recording, and credential management, and it prevents direct exposure of production servers to the internet. By combining a hardened intermediary with MFA, the organization achieves defense in depth and satisfies least-privilege and non-repudiation requirements.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 19

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Accepted Answer

Document the weakness in a Plan of Action and Milestones (POA&M). In FedRAMP, when a cloud environment does not meet a required control, the mandatory next step is to document the weakness in a Plan of Action and Milestones (POA&M). The POA&M tracks the non-compliance, including remediation tasks, timelines, and responsible parties. This is required by FedRAMP and NIST SP 800-37. The other options are either not mandatory or inappropriate.

Answer

Immediately terminate the cloud service

Answer

Perform a penetration test

Answer

Request a waiver from the JAB

Answer

Update the System Security Plan (SSP) to reflect compliance

Question 20

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Option B (Chain of custody documentation) is correct because integrity of audit evidence requires an unbroken, auditable record of who collected, handled, transferred, and stored the evidence, ensuring it has not been tampered with or substituted. Option C (Use of cryptographic hashes for log files) is correct because hashing algorithms such as SHA-256 produce a fixed digest that verifies the log data has not been altered, providing a mathematically verifiable integrity check. Option E (Restricting access to the audit evidence folder) is correct because enforcing least-privilege access controls (e.g., NTFS or POSIX permissions, role-based access) prevents unauthorized modification or deletion, preserving the evidence's integrity. Option A (Publishing evidence to the company website) is not appropriate because public disclosure exposes evidence to alteration and does not preserve integrity. Option D (Printing all evidence on paper) is not essential because paper copies can be forged or altered and do not provide cryptographic verification of the original digital data.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper