CGRC Practice Test 23 — 15 Questions

Question 1

In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?

Accepted Answer

Developing treatment plans for risks exceeding appetite.. Option D is correct because a core Risk Management activity is developing treatment plans (mitigate, transfer, avoid, or accept) for risks that exceed the organization's defined risk appetite or tolerance. Option E is correct because risk identification — determining which threats and vulnerabilities could affect business objectives — is the foundational step of the risk management process (identification, analysis, evaluation, treatment, monitoring). Options A and B are unrelated to GRC; office layout design and marketing brochure writing are operational/marketing tasks, not risk management activities. Option C, resetting all employee passwords every 30 days, is a technical access-control/identity-management control (an operational security task), not a Risk Management domain activity.

Answer

Designing new corporate office layouts.

Answer

Writing marketing brochures for the company.

Answer

Resetting all employee passwords every 30 days.

Question 2

When performing vulnerability management, what is the purpose of a 'credentialed scan'?

Accepted Answer

To identify missing patches and misconfigurations. A credentialed scan supplies the vulnerability scanner with valid OS or application credentials (e.g., SSH keys, SMB accounts, SNMP community strings) so it can log into the target and inspect installed patches, registry settings, configuration files, and local package versions. This deep visibility lets it identify missing patches and misconfigurations that an unauthenticated scan would miss, and it dramatically reduces false positives by confirming actual software versions rather than inferring from banners.

Answer

To perform penetration testing

Answer

To automate the patching process

Answer

To bypass the firewall

Question 3

You are reviewing the audit documentation of a junior assessor who tested a contingency planning control. The assessor noted that the control was 'effective' based on a tabletop exercise conducted six months ago. The system has undergone a major architecture change since then. According to CGRC assessment principles, what is the MOST significant deficiency in the assessor's conclusion?

Accepted Answer

The assessor relied on evidence that predates a significant change to the system. Evidence must be relevant to the current system state. A major architecture change can introduce new risks and invalidate prior test results. The assessor's reliance on a six-month-old tabletop exercise, without considering the change, means the evidence is not sufficient or appropriate. Updated testing or exercises are needed to support an effectiveness conclusion.

Answer

The assessor did not use automated tools to collect evidence

Answer

The assessor did not interview the system owner before concluding effectiveness

Answer

The assessor did not document the tabletop exercise in the system security plan

Question 4

A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organization wants to reduce the number of controls that are not applicable due to the cloud provider's inherited controls. Which action should the analyst take FIRST according to NIST SP 800-53?

Accepted Answer

Identify common controls provided by the cloud provider and document them as inherited.. The correct answer is to identify common controls provided by the cloud provider and document them as inherited. This is a key part of tailoring and prevents redundant control implementation. It ensures that the organization focuses on controls not already satisfied by the provider, optimizing resources and maintaining compliance.

Answer

Apply all controls from the high baseline to ensure maximum security.

Answer

Implement all controls from the low baseline and then add controls as needed.

Answer

Conduct a vulnerability assessment to determine which controls are missing.

Question 5

Which TWO methods are commonly used to gather assessment evidence?

Accepted Answer

Interview. Option C (Interview) is correct because interviewing stakeholders such as system owners, administrators, and users is a standard evidence-gathering technique that elicits qualitative information about processes, controls, and practices that may not be documented anywhere else. Option D (Observation) is correct because directly observing personnel performing tasks and watching systems in operation provides first-hand, verifiable evidence of whether controls and procedures are actually implemented as intended. Together, interviews and observation are recognized assessment methods (alongside examination of documents and technical testing) used to collect audit and certification evidence. Option A (Budget approval) is not an evidence-gathering method but a management/financial authorization activity. Option B (Marketing collateral review) is not a standard assessment technique, since promotional materials are not reliable audit evidence. Option E (System retirement) is a lifecycle/disposal activity, not a means of collecting assessment evidence.

Answer

Budget approval

Answer

Marketing collateral review

Answer

System retirement

Question 6

A large federal agency is modernizing its benefits processing system. The new architecture will integrate a legacy mainframe system, a commercial off-the-shelf (COTS) case management product hosted on-premises, and a new cloud-based document repository. The legacy mainframe and the COTS product are owned by the agency, while the cloud repository is provided by a FedRAMP-authorized cloud service provider. The agency's Information System Owner (ISO) must define the authorization boundary for the overall benefits processing capability. Which approach is most appropriate?

Accepted Answer

Define a boundary for the mainframe and COTS product as one system, and treat the cloud repository as a separate system, documenting the interconnection and relying on the cloud provider's FedRAMP authorization.. The authorization boundary should group components under the same management control. The mainframe and COTS product are both agency-owned and can be assessed as one system. The cloud repository is managed by a FedRAMP-authorized provider and should be treated as a separate system, with the agency documenting the interconnection and inheriting controls from the provider's authorization package.

Answer

Define three separate authorization boundaries, one for each component, and require each to undergo a full RMF process independently, including the cloud repository.

Answer

Define a single authorization boundary that encompasses the mainframe, the COTS product, and the cloud repository, because they collectively deliver the benefits processing capability.

Answer

Define the boundary to include only the new cloud repository, because the legacy mainframe and COTS product are already accredited under earlier authority to operate (ATO) decisions.

Question 7

An Information System Owner (ISO) is defining the authorization boundary for a system that will be deployed in a government cloud environment. The cloud provider offers infrastructure as a service (IaaS). Which of the following should the ISO consider as part of the system boundary?

Accepted Answer

The virtual machines, applications, and data that the organization deploys and manages in the cloud.. In an IaaS cloud deployment, the organization is responsible for the security of the virtual machines, applications, and data it deploys. These components should be included in the authorization boundary because they are under the organization's direct control. The underlying infrastructure, such as physical data centers, hypervisors, and network components, is managed by the cloud provider and should be treated as common controls, with their controls inherited and documented in the system security plan.

Answer

The cloud provider's customer support personnel who manage the IaaS platform.

Answer

The cloud provider's hypervisor and network infrastructure.

Answer

The cloud provider's physical data center security controls.

Question 8

A federal agency is preparing for a continuous monitoring assessment of a high-impact system. The Information System Security Officer (ISSO) must ensure that the security assessment plan (SAP) includes appropriate methods for assessing a new encryption control. Which combination of assessment methods should the ISSO verify are included to provide the most reliable evidence?

Accepted Answer

Examine and test. For technical controls such as encryption, the most reliable evidence comes from examination of configurations and testing of the control's operation. Examination verifies that settings, certificates, and key management are correctly implemented, while testing confirms the control functions as intended. Interviews and questionnaires alone are insufficient because they rely on self-reported information and do not provide objective proof of effectiveness.

Answer

Questionnaire and examine

Answer

Interview and test

Answer

Interview and questionnaire

Question 9

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

Accepted Answer

Implementing consistent security controls across all boundary nodes regardless of location.. When a system boundary spans multiple geographic locations, the practitioner must ensure that consistent security controls are implemented across all boundary nodes, regardless of location. This maintains a uniform security posture and ensures that the authorization boundary is protected end-to-end. FIPS 199 and NIST SP 800-37 emphasize that the boundary defines what is included in the authorization, and all components within it must meet the same control baseline.

Answer

Categorizing each site as a separate information system.

Answer

Excluding remote offices from the authorization boundary.

Answer

Allowing each site to define its own unique security policy.

Question 10

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Accepted Answer

After the 'Assess' step and before the 'Authorize' step. In NIST SP 800-37 R2, the RMF steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The Security Assessment Report (SAR) is produced during the Assess step and is presented to the Authorizing Official as a key input to the Authorize step, where the AO makes the ATO decision. Thus the SAR is delivered after Assess and before Authorize.

Answer

During the 'Categorize' step

Answer

After the 'Monitor' step

Answer

During the 'Prepare' step

Question 11

Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?

Accepted Answer

The impact on the security control baseline. When an ISSO evaluates whether a system change triggers re-authorization, the two key factors are the impact on the security control baseline (B) and the scope of the changes made to the system (C). Option B is correct because if a change alters, weakens, or removes controls from the approved baseline, the system's risk posture shifts and the Authorizing Official must reassess whether the existing authorization remains valid. Option C is correct because the extent of the change—whether it is a minor patch or a major architectural modification—determines whether it falls under the existing authorization boundary or requires a new assessment and authorization decision. The remaining options are irrelevant: server casing color (A) and hardware age (E) are cosmetic or lifecycle concerns that do not affect security authorization, and the number of administrative staff (D) is a staffing matter, not a determinant of re-authorization.

Answer

The color of the server casing

Answer

The number of administrative staff

Answer

The age of the hardware

Question 12

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. To ensure that only signed binaries from your organization are executed, you should create a Publisher Rule based on the certificate issuer and product name. Publisher Rules in AppLocker use digital signatures to identify trusted publishers, allowing execution of any binary signed by a specific certificate. This approach is scalable and ensures that only binaries signed by your organization's certificate are allowed, while automatically accommodating updates signed with the same certificate.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 13

As the GRC analyst, you are reviewing the continuous monitoring program for a financial system that processes transactions. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a risk assessment to determine if monthly scanning provides adequate coverage for the system's risk profile.. The correct action is to conduct a risk assessment because continuous monitoring frequency must be based on the system's risk profile, not arbitrary cost savings. For a financial system, reducing scan frequency could increase risk if vulnerabilities remain undetected. A risk assessment ensures that any change is justified and documented, maintaining compliance with NIST and organizational policies.

Answer

Escalate the decision to the system owner because the GRC analyst does not have authority to change monitoring frequency.

Answer

Deny the change outright because continuous monitoring requires weekly scanning for all systems.

Answer

Approve the change because monthly scanning meets the minimum requirement for continuous monitoring.

Question 14

A security engineer is using the NIST Risk Management Framework (RMF) to maintain compliance for a high-impact system. During continuous monitoring, the engineer discovers that a critical security control has been modified without a security impact analysis. Which of the following actions should the engineer take FIRST?

Accepted Answer

Conduct a security impact analysis to determine the effect of the change on the system's security posture.. The security impact analysis is a systematic process to determine how a change affects the security posture of a system. It is required by NIST SP 800-37 and must be performed before any other actions, as it informs whether the change can be accepted, what controls need updating, and whether reauthorization is necessary. It ensures that risk is properly managed and documented.

Answer

Immediately revert the control to its original configuration and document the change in the system security plan.

Answer

Notify the authorizing official and request a new authorization to operate (ATO) before taking any other action.

Answer

Update the continuous monitoring strategy to include more frequent assessments of the modified control.

Question 15

You are developing a continuous monitoring strategy for a federal information system as part of the Risk Management Framework (RMF) process. According to NIST SP 800-137, which TWO of the following are essential components of an effective continuous monitoring program? (Choose two.)

Accepted Answer

Configuration management and change control processes.. Configuration management and change control processes, along with security control assessments at an organization-defined frequency, are essential components of a continuous monitoring program per NIST SP 800-137. These elements ensure that the system's security posture is maintained and that changes are evaluated for impact. Other activities like training and penetration testing support security but are not core continuous monitoring components.

Answer

Penetration testing of all external interfaces on a quarterly basis.

Answer

A formal risk acceptance memo signed by the system owner.

Answer

Annual security awareness training for all users.