CGRC Practice Test 22 — 15 Questions

Question 1

An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a 'Many-to-Many' relationship mapping between Controls and Regulatory Requirements.. A Common Control Framework (CCF) mapping requires establishing relationships between controls and the regulatory requirements they satisfy, so that one control can be reused across multiple requirements and frameworks. A 'Many-to-Many' relationship mapping is the correct mechanism because a single control can satisfy multiple regulatory requirements, and a single requirement can be met by multiple controls. This relationship structure is what enables control reuse, deduplication, and consistent evidence collection across the integrated GRC program.

Answer

Create manual spreadsheets to reconcile the data outside the GRC platform.

Answer

Force all business units to use identical risk taxonomy naming conventions.

Answer

Disable the Regulatory Requirement module to focus only on Risks.

Question 2

A system's continuous monitoring plan requires weekly vulnerability scans. The scans have been consistently showing the same findings for three months, and remediation efforts have been unsuccessful due to vendor delays. What should the GRC analyst do?

Accepted Answer

Perform a security impact analysis to determine if the unresolved vulnerabilities constitute a significant change to the system's risk posture.. The correct answer is to perform a security impact analysis. When remediation is delayed and findings persist, the system's risk profile may change. A security impact analysis determines if the unresolved vulnerabilities represent a significant change, which could affect the ATO. This analysis provides a basis for decisions such as risk acceptance, additional controls, or escalation to the authorizing official.

Answer

Escalate the issue to the authorizing official and document the vendor delays as a compensating control.

Answer

Modify the continuous monitoring plan to remove the weekly scan requirement until the vendor provides a patch.

Answer

Accept the risk because the vulnerabilities have been present for three months without exploitation.

Question 3

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Accepted Answer

To automate the assessment of security configurations against benchmarks.. SCAP (Security Content Automation Protocol) is a NIST-maintained suite of specifications—including CVE, CCE, CPE, CVSS, XCCDF, OVAL, and SWID—that enables automated, standardized assessment of system configurations and vulnerabilities against established benchmarks such as the DISA STIGs or NIST SP 800-53 controls. In a continuous monitoring program (per NIST SP 800-137), SCAP-validated tools scan endpoints, compare findings to a target baseline, and produce machine-readable results that feed ongoing authorization decisions. This makes automated configuration/benchmark assessment its primary function.

Answer

To provide encrypted tunnels for administrative access.

Answer

To monitor network traffic for anomalous behavior.

Answer

To manage the lifecycle of cryptographic keys.

Question 4

You are the GRC analyst for a system that has an approved Authorization to Operate (ATO). A new vulnerability is discovered in a component that is not part of the system's boundary but is used by the system's administrators. According to continuous monitoring principles, what should you do first?

Accepted Answer

Assess whether the vulnerability affects the system's security posture and determine if a security impact analysis is needed.. The correct answer is to assess the vulnerability's impact first. Continuous monitoring involves ongoing assessment of risks, including those from components used by administrators but outside the boundary. A security impact analysis determines whether the vulnerability affects the system's security posture and if the ATO needs adjustment. This proactive step ensures informed decision-making before escalating or taking drastic actions.

Answer

Immediately revoke the ATO until the vulnerability is patched.

Answer

Report the vulnerability to the authorizing official and wait for further instructions.

Answer

Update the system security plan (SSP) to include the component within the boundary.

Question 5

You are a security analyst at a hospital that must comply with HIPAA and NIST SP 800-53. You are selecting controls for a new patient portal. Your manager asks you to reduce unnecessary duplication by identifying controls that are already provided by the hospital's centralized identity management system. Which type of control should you document for the portal's authentication requirements?

Accepted Answer

Common control. The centralized identity management system provides authentication for the patient portal and other systems, so the portal inherits this capability. Documenting it as a common control accurately reflects that one implementation serves multiple systems, reduces duplication, and clarifies responsibility. This aligns with NIST SP 800-53 guidance on common controls, which are managed by a common provider and inherited by consuming systems.

Answer

Compensating control

Answer

Hybrid control

Answer

System-specific control

Question 6

When conducting an audit, what is 'sampling'?

Accepted Answer

Selecting a representative subset for testing. Sampling in an audit is the process of selecting a representative subset of records or transactions for testing, rather than examining the entire population. This allows auditors to draw reasonable conclusions about the whole population while managing time and cost. The sample must be selected using a defined methodology (statistical or judgmental) to be defensible and representative.

Answer

Randomly selecting records without criteria

Answer

Testing only the most recent data

Answer

Testing every single record in a database

Question 7

You are the Information System Security Officer (ISSO) for a federal system undergoing an annual assessment. The assessor reports that a boundary protection control is only partially implemented: the firewall ruleset is outdated, and several unnecessary ports are open. The system owner asks how this should be reflected in the System Security Plan (SSP). What is the most appropriate action?

Accepted Answer

Record the control as 'Partially Implemented' with a description of the gap, a remediation plan, and a target completion date.. A partially implemented control must be documented as such in the SSP, with a clear description of the gap, remediation steps, and a target date. This preserves an accurate picture of the system's security posture, informs the Authorizing Official's risk decision, and enables effective continuous monitoring. Claiming the control is implemented or not applicable would misrepresent the actual state and could invalidate the authorization.

Answer

Mark the control as 'Implemented' and note the outdated ruleset in the continuous monitoring plan only.

Answer

Document the control as 'Not Applicable' because the firewall is managed by the network team, not the system owner.

Answer

Remove the control from the SSP and rely on the organization's enterprise firewall policy instead.

Question 8

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Accepted Answer

Ensuring the assignment value is consistent with organizational policy.. Option B is correct because NIST 800-53 assignment values (the organization-defined parameters in controls) must reflect and be consistent with the organization's own policies, so the chosen value aligns with governance requirements. Option D is correct because after an assignment value is set, you must verify that the control implementation actually addresses that value; otherwise the control is not truly satisfied. Option E is correct because assignment values must be documented in the system security plan (SSP), which records how controls are implemented, including the specific organization-defined parameters. Option A is not correct because assignment values are not updated daily; they are reviewed and updated as needed based on changes in policy, risk, or system environment. Option C is not correct because consulting the NIST publication author is not a required management action; organizations use the published guidance directly.

Answer

Updating all assignment values daily.

Answer

Consulting with the NIST publication author.

Question 9

A security architect is selecting controls for a system that will be deployed in a virtualized environment. The architect notes that many controls in the NIST SP 800-53 baseline assume physical separation. Which tailoring action is most appropriate to address this?

Accepted Answer

Replace physical separation controls with logical separation controls that provide equivalent protection.. The correct action is to replace physical separation controls with logical separation controls that provide equivalent protection. Tailoring permits such substitutions when they meet the security objective. This approach maintains security while accommodating the virtualized environment.

Answer

Remove all controls that reference physical separation as they are not applicable.

Answer

Implement the physical separation controls as written, even if they are not feasible.

Answer

Mark the controls as not applicable and document the justification.

Question 10

You are selecting controls for a federal information system categorized as LOW impact. The system owner wants to use NIST SP 800-53B low baseline but also needs to address a specific threat from a recent vulnerability scan that is not covered by the baseline. What is the most appropriate action?

Accepted Answer

Tailor the low baseline by adding a control or control enhancement that addresses the specific threat.. Tailoring the low baseline by adding a control or enhancement that addresses the specific threat is the most appropriate action. It allows the organization to manage the identified risk without overburdening the system with unnecessary controls. This approach aligns with NIST SP 800-53B and the RMF, where tailoring is used to adjust baselines based on organizational risk assessments and specific threats.

Answer

Request an exception from the authorizing official to ignore the vulnerability, because the baseline does not require a control for it.

Answer

Apply the moderate baseline instead, because it includes more controls that might cover the threat.

Answer

Document the threat as a residual risk and take no action, because the low baseline is sufficient for LOW impact systems.

Question 11

A healthcare payer's GRC team is building a new compliance program for a recently acquired subsidiary that processes protected health information. Executive leadership wants assurance that the program's scope, authority, and reporting lines are formally documented and approved before any control testing begins. Which artifact should the GRC practitioner produce FIRST to satisfy this expectation?

Accepted Answer

A compliance program charter defining mandate, scope, roles, and reporting relationships. The scenario emphasizes documented scope, authority, and reporting lines approved before testing. A compliance program charter is the governance artifact that establishes mandate, scope, roles, and reporting structure, making it the necessary first step. Other listed artifacts are downstream deliverables that depend on the charter for defined boundaries, ownership, and escalation paths.

Answer

A control testing schedule covering all systems in the subsidiary

Answer

A statement of applicability mapping HIPAA requirements to implemented controls

Answer

A risk register listing the subsidiary's top information security risks

Question 12

The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?

Accepted Answer

Configure a 'Dynamic Link' between Audit Testing Results and Risk Rating calculations.. The problem is that Control Effectiveness scores are static and not linked to the latest audit results, causing residual risk to be miscalculated. The architectural fix is to configure a dynamic link (automated data relationship) between Audit Testing Results and Risk Rating calculations so that when audit results change, the control effectiveness score—and therefore residual risk—updates automatically. This ensures the risk calculation reflects current control performance.

Answer

Update the manual risk assessment survey annually.

Answer

Increase the frequency of full organizational risk assessments.

Answer

Require the CISO to manually approve all risk score changes.

Question 13

Which THREE elements are necessary for a compliant continuous monitoring program?

Accepted Answer

Configuration management of the system. A compliant continuous monitoring program requires configuration management of the system (A), because tracking and controlling changes to hardware, software, and firmware baselines is essential to maintaining an accurate security posture and knowing what is being monitored. Regular assessment of security controls (B) is also necessary, since continuous monitoring depends on ongoing evaluation of control effectiveness rather than a one-time authorization review. Status reporting to the AO (D) is required so the Authorizing Official can make risk-based decisions about continued operation based on current security state. Full system replacement every year (C) is not a continuous monitoring requirement and would be impractical and unrelated to monitoring. Daily physical site visits (E) are not mandated; physical security monitoring is typically handled through other controls and frequencies, not daily visits.

Answer

Full system replacement every year

Answer

Daily physical site visits

Question 14

You are a security architect for a federal agency. A new system is categorized as LOW impact. The system owner wants to reduce the number of controls to only those that are strictly required. According to NIST SP 800-53B, which of the following is the most appropriate action?

Accepted Answer

Select the LOW baseline from NIST SP 800-53B and apply tailoring to remove controls that are not applicable.. For a LOW-impact system, the correct starting point is the LOW baseline from NIST SP 800-53B. Tailoring is then applied to remove controls that are not applicable, ensuring the final set is appropriate for the system's risk level while maintaining a structured, defensible approach.

Answer

Use the HIGH baseline and tailor it down to low-impact requirements.

Answer

Select the MODERATE baseline and remove controls until only low-impact controls remain.

Answer

Develop a custom set of controls from scratch without using a NIST baseline.

Question 15

A security administrator at a financial firm is hardening a new Windows Server 2022 domain controller. The administrator must ensure that the server meets the organization's requirement to enforce a minimum password length of 14 characters and account lockout after 5 invalid attempts. Which control type best describes the configuration of these settings?

Accepted Answer

Technical control. The enforcement of password length and account lockout thresholds through Group Policy or Local Security Policy is a technical control because it is executed by the operating system to restrict access automatically. Administrative controls are policy documents, physical controls are tangible barriers, and compensating controls are substitutes; none of these directly enforce the settings in real time.

Answer

Physical control

Answer

Administrative control

Answer

Compensating control