CGRC Practice Test 21 — 15 Questions

Question 1

A GRC analyst at a software company is building the organization's risk register for the first time. The CISO asks which two attributes are essential for every entry so that leadership can prioritize treatment and assign accountability. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A named risk owner accountable for treatment decisions and status updates. A risk register supports prioritization and accountability when every entry carries an owner and a comparable likelihood-and-impact score. Ownership ensures someone acts and can be escalated to; scoring lets leadership rank exposures and direct finite resources. Metadata such as identification date, tooling vendor, and audit cross-references enrich the record but do not drive treatment decisions.

Answer

The name of the vendor that supplied the GRC platform hosting the register

Answer

A reference to the internal audit report number where the risk was last discussed

Answer

The original date the risk was first identified and entered into the system

Question 2

Which type of control is an alarm system installed in a server room?

Accepted Answer

Detective. An alarm system is a detective control because it detects and alerts to unauthorized access or anomalies after they occur. It does not prevent the event from happening but provides notification so that response actions can be taken. Thus, it is classified as detective.

Answer

Preventative

Answer

Corrective

Answer

Deterrent

Question 3

The organization's GRC workflow has a 'Request for Exception' process. The goal is to ensure that temporary risk exceptions are automatically reviewed before they expire. Which mechanism is most appropriate?

Accepted Answer

Configuring a 'Workflow Notification' triggered by a field-based 'Expiration Date'.. A field-based workflow notification tied to the 'Expiration Date' field is the correct mechanism because it leverages the GRC platform's native automation to alert the appropriate stakeholders (e.g., risk owner, reviewer) before the exception lapses. This ensures timely, repeatable, and auditable review without relying on human memory. The trigger is data-driven, so it scales across all exceptions and produces a record of the notification event.

Answer

Requiring the Risk Owner to sign a hard copy document.

Answer

Disallowing all risk exceptions in the system configuration.

Answer

Setting a manual reminder on the CISO's calendar.

Question 4

Which TWO of the following represent best practices for password management?

Accepted Answer

Using a password manager for unique, complex passwords. Option B is correct because a password manager generates and stores unique, complex credentials per account, which prevents password reuse and credential-stuffing attacks while keeping secrets encrypted behind a single strong master passphrase. Option E is correct because enforcing a minimum length requirement (e.g., 12–16+ characters per NIST SP 800-63B guidance) increases entropy and resistance to brute-force and dictionary attacks far more effectively than complexity rules alone. The unmarked options do not belong: forcing changes every 30 days (A) is discouraged by modern guidance such as NIST SP 800-63B because it leads to predictable incremental passwords and weaker choices; allowing password sharing among team members (C) destroys individual accountability and non-repudiation; and logging passwords in a shared spreadsheet (D) exposes plaintext credentials to anyone with file access and violates secure secret-storage practices.

Answer

Forcing users to change passwords every 30 days

Answer

Allowing password sharing among team members

Answer

Logging passwords in a shared spreadsheet

Question 5

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

Accepted Answer

Define the boundary based on the specific services and data flows owned by the sub-system.. When defining the boundary for a sub-system within a System of Systems architecture, the best practice is to define it based on the specific services and data flows owned by that sub-system. This approach ensures a clear, manageable scope that aligns with the sub-system's responsibilities and avoids including unrelated components that would cause scope creep. It also facilitates independent authorization and risk management for each sub-system.

Answer

Include only the database tier.

Answer

Include the entire enterprise infrastructure to be safe.

Answer

Include all internal network segments regardless of use.

Question 6

A healthcare organization must protect electronic protected health information (ePHI) in a new cloud-based patient portal. The security team decides to implement a control that renders data unreadable to unauthorized parties even if the storage media is compromised. Which of the following best describes this type of control?

Accepted Answer

Data encryption at rest using AES-256. The scenario requires a control that makes data unreadable if storage media is compromised. Encryption at rest using AES-256 directly fulfills this by converting ePHI into ciphertext, ensuring confidentiality even if physical or logical access to the media occurs. Other controls like RBAC, segmentation, or training address different risk areas and do not provide cryptographic protection of data at rest.

Answer

Network segmentation isolating the patient portal from the corporate network

Answer

Security awareness training for all employees handling ePHI

Answer

Role-based access control (RBAC) limiting access to authorized clinicians

Question 7

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. During the Assessment Execution phase, the assessor gathers evidence to evaluate security controls, so reviewing system documentation (C) is correct because examining policies, procedures, and architecture documents establishes what controls are documented and how the system is intended to operate. Testing system configuration (D) is correct because hands-on examination and testing of settings, services, and parameters verifies whether controls are actually implemented as intended. Interviewing key personnel (E) is correct because discussions with system owners, administrators, and users provide essential evidence about operational practices and control effectiveness that documentation and testing alone may not reveal. Developing the final risk strategy (A) belongs to earlier planning and scoping activities, and purchasing new hardware (B) is an implementation or remediation activity, not part of executing the assessment itself.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 8

A security manager is reviewing the controls for a new web application that processes credit card payments. The manager must ensure that the application complies with PCI DSS requirement 6.5.1, which addresses injection flaws. Which control should be implemented to mitigate SQL injection attacks?

Accepted Answer

Input validation and parameterized queries. Input validation and parameterized queries are the most effective controls against SQL injection because they prevent malicious input from being interpreted as code. A WAF, DAM, and encryption do not address the vulnerability at the source; they are supplementary or unrelated controls. PCI DSS explicitly requires secure coding practices to mitigate injection flaws.

Answer

Database activity monitoring (DAM)

Answer

Web application firewall (WAF) in blocking mode

Answer

Encryption of the database at rest

Question 9

An organization is beginning the RMF process for a new human resources system. The Information System Owner (ISO) needs to identify the system boundary. Which of the following best describes the purpose of defining the authorization boundary?

Accepted Answer

To establish the scope of the system for which the organization will implement and assess security controls.. The authorization boundary establishes the scope of the system for which the organization is responsible. It defines which components, processes, and personnel are included so that security controls can be implemented and assessed appropriately. This scope is fundamental to the RMF process, ensuring that the assessment covers all relevant parts of the system.

Answer

To identify the physical location of all servers and network devices that process organizational data.

Answer

To list all external organizations that will connect to the system and require interconnection agreements.

Answer

To determine which data is sensitive and requires encryption both at rest and in transit.

Question 10

A healthcare organization is implementing controls to comply with HIPAA Security Rule. The security team is configuring audit logging for a new electronic health record (EHR) system. Which two of the following are essential elements to include in the audit log configuration to meet HIPAA's audit control requirements? (Choose two.)

Accepted Answer

Record the date, time, and user ID for each access event.. HIPAA's audit control standard requires implementing mechanisms to record and examine activity in systems containing ePHI. Essential elements include logging all access to ePHI and capturing sufficient detail such as date, time, and user ID. These enable detection of unauthorized access and support forensic investigations. Other options, like storing logs on the same server or limiting logging, fail to meet the security and retention requirements.

Answer

Enable logging only for failed login attempts to reduce storage costs.

Answer

Configure logs to be overwritten every 24 hours to save disk space.

Answer

Store audit logs on the same server as the EHR application for quick access.

Question 11

Which THREE types of findings might appear in an audit report?

Accepted Answer

Operational observations. An audit report focuses on the state of controls, compliance, and risk, so Operational observations (B) are correct because auditors routinely document how processes and controls actually function in practice, including gaps between policy and execution. Documentation deficiencies (C) are correct because missing, incomplete, or outdated records (e.g., policies, logs, change tickets, evidence of approvals) are classic audit findings that undermine traceability and compliance. Critical vulnerabilities (D) are correct because unpatched or high-severity security weaknesses (e.g., CVEs rated Critical, missing patches, misconfigurations) are material findings that auditors report due to their risk impact. Employee performance pay (A) and office furniture inventory (E) are not audit-report finding types in this context; compensation decisions and furniture asset counts are administrative or HR/facilities matters, not control, compliance, or security findings.

Answer

Employee performance pay

Answer

Office furniture inventory

Question 12

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Accepted Answer

Whether the change negatively impacts existing security controls.. A security impact analysis (SIA) under NIST SP 800-37/800-30 examines how a proposed change affects the system's security posture, so option A is correct: you must determine whether the change degrades, bypasses, or otherwise negatively impacts existing security controls (e.g., firewalls, ACLs, encryption, auditing). Option D is correct because the SIA must identify whether the change introduces new weaknesses requiring additional testing or assessment, such as vulnerability scanning, penetration testing, or reauthorization activities, before the change is approved. Option E is correct because the analysis must determine whether the change alters the system's overall risk rating (likelihood and impact of threats exploiting vulnerabilities), which drives whether the change can proceed or needs mitigation. Option B is not a security consideration — cost savings belong to a business or financial impact analysis, not the security impact analysis. Option C is irrelevant; user interface color scheme has no bearing on confidentiality, integrity, or availability controls.

Answer

The expected cost savings from the change.

Answer

The color scheme of the new user interface.

Question 13

You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?

Accepted Answer

INPUT. In iptables, the INPUT chain processes packets destined for the local host itself, making it the correct place to filter traffic addressed to the machine. The OUTPUT chain handles locally generated outbound traffic, and FORWARD handles packets routed through the host. Therefore, filtering traffic destined for the local host requires the INPUT chain.

Answer

OUTPUT

Answer

FORWARD

Answer

PREROUTING

Question 14

A multinational corporation is deploying a new encryption solution for data at rest across its global data centers. The security team must ensure that encryption keys are managed securely and can be recovered in case of disaster. Which of the following is the most appropriate key management practice?

Accepted Answer

Use a centralized key management system (KMS) with automated key rotation and secure backup. The most appropriate practice is a centralized KMS with automated rotation and secure backup. This ensures keys are protected, regularly changed, and recoverable in a disaster. Storing keys with data, using a single static key, or decentralizing management all introduce significant security and operational risks, making them unsuitable for the scenario.

Answer

Use a single static encryption key across all data centers to simplify management

Answer

Store encryption keys on the same server as the encrypted data for simplicity

Answer

Allow each department to manage its own encryption keys independently

Question 15

The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?

Accepted Answer

Set an 'Expiration Date' and 'Workflow Reminder' on the policy record.. Setting an Expiration Date plus a Workflow Reminder on the policy record is the native GRC mechanism that automatically notifies the policy owner before the review deadline and flags the record as overdue if not completed. This enforces the annual review cadence through the platform's workflow engine rather than relying on human memory or manual tracking.

Answer

Block access to the policy after 365 days.

Answer

Create a recurring meeting for the policy owner.

Answer

Require the administrator to manually reset the policy status.