CGRC Practice Test 24 — 15 Questions

Question 1

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) (A) is critical because NIST SP 800-53 compliance verification requires documenting the system boundary, the implemented security controls, and how each control satisfies the selected baseline, which is exactly what the SSP provides. The Security Assessment Report (SAR) (C) is also essential because it records the independent assessor's findings on whether the controls in the SSP are implemented correctly and effectively, giving the evidence needed to judge compliance. The Plan of Action and Milestones (POA&M) (E) is required as well, since it tracks identified control deficiencies, remediation tasks, responsible parties, and milestone dates, which NIST SP 800-53 and the RMF use to manage residual risk and demonstrate progress toward compliance. The annual report of stock performance (B) is a financial document unrelated to security control assessment, and the internal marketing strategy (D) concerns business promotion rather than NIST SP 800-53 controls, so neither belongs in a compliance verification process.

Answer

Annual report of stock performance

Answer

Internal marketing strategy

Question 2

When implementing an 802.1X environment, what is the role of the RADIUS server?

Accepted Answer

Authenticating the supplicant. In an 802.1X deployment, the RADIUS server acts as the authentication server (AS) that receives EAP messages relayed by the authenticator (switch or WAP) and validates the supplicant's credentials against a backend identity store such as Active Directory or LDAP. It is the decision point that returns Access-Accept, Access-Reject, or Access-Challenge per RFC 2865/2866, and can also pass authorization attributes like VLAN or ACL assignments. The supplicant is the endpoint requesting access, and the authenticator is the network device enforcing the port state — the RADIUS server's core job is authenticating the supplicant.

Answer

Encapsulating EAP frames

Answer

Providing the EAP method to the client

Answer

Enforcing the physical port state

Question 3

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

Accepted Answer

Include security requirements in the contract language. Including security requirements in the contract language is the correct answer because it legally binds the contractor to comply with your organization's security standards. This ensures that the contractor's system meets the necessary controls and allows for enforcement through contractual obligations. It is a proactive measure that integrates security into the procurement process, aligning with NIST SP 800-53 and other frameworks that emphasize contractual security requirements for external providers.

Answer

Grant them access to your internal ATO database

Answer

Perform an audit of the contractor's office

Answer

Trust the contractor's internal IT department

Question 4

A program manager is working with the Information System Owner (ISO) to determine the scope of a new payroll system. The system will interface with an external banking system for direct deposits. What should the ISO do regarding the external banking system when defining the authorization boundary?

Accepted Answer

Document the external banking system as an external interface and establish a formal agreement for data exchange.. When an external system interfaces with the system being authorized, it is not included in the boundary but must be documented as an external interface. A formal agreement, such as an ISA, defines the security responsibilities and data exchange rules. This approach maintains a clear boundary while ensuring that the interface is securely managed. The other options either incorrectly include the external system or fail to document it.

Answer

Include the external banking system within the authorization boundary because it processes payroll data.

Answer

Require the external banking system to undergo a full security assessment by the payroll system's assessment team.

Answer

Exclude the external banking system entirely from all RMF documentation since it is not part of the boundary.

Question 5

You are an ISSO preparing for an upcoming CGRC assessment of a major information system. The auditor has requested a kickoff meeting to discuss the scope, objectives, and logistics of the assessment. What is the PRIMARY purpose of this kickoff meeting?

Accepted Answer

To establish a common understanding of the assessment scope, objectives, and roles. A kickoff meeting aligns the auditor and the organization on the assessment's scope, objectives, timeline, and roles. It ensures that both parties understand what will be assessed, how evidence will be gathered, and who will be involved. This planning step is critical for a smooth assessment and is distinct from fieldwork, reporting, or contracting activities.

Answer

To perform detailed testing of security controls and document findings

Answer

To negotiate the auditor's fee and sign the engagement letter

Answer

To present the final audit report and obtain management's response

Question 6

After a system receives an Authority to Operate (ATO), the organization must maintain compliance through continuous monitoring. Which of the following activities is a core component of a continuous monitoring program?

Accepted Answer

Tracking and reporting the status of security controls on an ongoing basis.. The core of continuous monitoring is the ongoing tracking and reporting of security control status. This ensures that controls remain effective and that any changes in risk are detected and addressed promptly. Full monthly assessments, annual penetration testing, and updating the SSP only for major changes do not fulfill the continuous, ongoing nature of a continuous monitoring program as defined in NIST SP 800-137.

Answer

Performing penetration testing on an annual basis.

Answer

Updating the system security plan only when a major change occurs.

Answer

Conducting a full security control assessment every month.

Question 7

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

Accepted Answer

Accepting the residual risk associated with the POA&M. The Authorizing Official (AO) is the senior official who formally accepts the residual risk of operating a system, and the POA&M documents known weaknesses and planned mitigations. The AO's primary responsibility is to review the POA&M and decide whether the residual risk is acceptable, granting or denying authorization to operate. This risk-acceptance role is the core of the RMF authorization decision.

Answer

Drafting the mitigation tasks

Answer

Conducting the security controls assessment

Answer

Implementing the technical patches

Question 8

A system owner is preparing to transition a system into the operations and maintenance phase. The Authorizing Official has granted an Authorization to Operate (ATO). What is the primary compliance activity that must continue during this phase?

Accepted Answer

Performing continuous monitoring of security controls and reporting changes that affect the security posture.. During the operations and maintenance phase, continuous monitoring is the key compliance activity. It ensures that security controls remain effective, changes are tracked, and the Authorizing Official is informed of any significant changes that could affect the authorization. This ongoing process is essential for maintaining the ATO and managing risk throughout the system's lifecycle.

Answer

Archiving all system logs and discontinuing active monitoring to reduce operational costs.

Answer

Re-authorizing the system every quarter to maintain the ATO.

Answer

Conducting a full security assessment every month to validate all controls.

Question 9

A retail company is preparing for an external audit of its GRC program. The auditor requests evidence that risk treatment plans are approved by appropriate stakeholders and tracked to completion. Which of the following GRC platform features BEST demonstrates this capability?

Accepted Answer

A workflow engine with electronic signatures, task assignments, and audit logs for risk treatment plans.. A workflow engine with electronic signatures, task assignments, and audit logs provides the end-to-end evidence needed to demonstrate that risk treatment plans were approved by appropriate stakeholders and tracked to completion. This feature enforces accountability and creates an immutable record that auditors can verify, unlike static registers, dashboards, or document repositories.

Answer

A document repository where risk treatment plans are stored as PDFs.

Answer

A reporting dashboard that displays the percentage of risks with completed treatment plans.

Answer

A risk register that lists all identified risks and their current status.

Question 10

An organization is defining the authorization boundary for a system that will use a shared database service managed by a different business unit. The database will store sensitive data for multiple systems. What should the security manager do to properly address this shared service in the authorization process?

Accepted Answer

Treat the shared database as a common control provider and inherit its controls via a customer responsibility matrix.. Shared services are optimally handled as common control providers, allowing systems to inherit controls rather than reassess them. A customer responsibility matrix documents which controls are inherited and which remain the system's responsibility. This approach reduces duplication and ensures the Authorizing Official has visibility into the shared controls.

Answer

Exclude the shared database entirely and document it as an external interface without any control inheritance.

Answer

Define the boundary to include only the database schema and exclude the underlying infrastructure.

Answer

Include the shared database within the system boundary and assess all its controls.

Question 11

Which THREE of the following are benefits of using the NIST 800-53 control framework?

Accepted Answer

It supports a consistent approach to security across the organization.. Option A is correct because NIST SP 800-53 provides a standardized catalog of security and privacy controls that organizations can apply uniformly across all systems and business units, ensuring a consistent approach to security across the organization. Option C is correct because the framework is built around the risk management process (per NIST RMF and SP 800-37), allowing organizations to select and tailor controls based on assessed risk, which directly facilitates risk-based decision-making. Option E is correct because the common control identifiers and terminology in SP 800-53 give security teams, auditors, and stakeholders a shared vocabulary, providing a common language for security controls. Option B is incorrect because implementing and interpreting the framework still requires significant technical and security expertise. Option D is incorrect because NIST 800-53 is a control framework, not an automation tool; it does not automate manual security processes.

Answer

It eliminates the need for any technical expertise.

Answer

It automates all manual security processes.

Question 12

You are an internal auditor tasked with assessing the effectiveness of your organization's security controls. You have full access to internal documentation and personnel. Which type of audit are you performing?

Accepted Answer

First-party audit. Audits are classified by the relationship between the auditor and the organization. A first-party audit is an internal audit performed by the organization's own personnel. It is used for self-assessment and continuous improvement. Second-party audits are by interested external parties, and third-party audits are by independent external parties. Since the scenario describes an internal auditor with full access, it is a first-party audit.

Answer

Third-party audit

Answer

Compliance audit

Answer

Second-party audit

Question 13

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Accepted Answer

System Security Plan (SSP).. The System Security Plan (SSP) (B) must be updated because it documents the system's security controls, boundaries, and implementation details; a configuration change can alter how controls are implemented or described, so the SSP must reflect the current state to remain accurate for authorization and continuous monitoring. The Configuration Baseline document (D) must also be updated because it records the approved, documented settings and components of the system; when a configuration changes, the baseline must be revised to capture the new approved state so future comparisons and change detection remain valid. The vendor's hardware sales catalog (A) is a commercial marketing document unrelated to the system's security posture or configuration records. The Employee Handbook (C) covers general HR policies and is not a system-specific security or configuration artifact. The Corporate financial statements (E) are accounting documents and have no bearing on system configuration management or continuous monitoring.

Answer

The vendor's hardware sales catalog.

Answer

Employee Handbook.

Answer

Corporate financial statements.

Question 14

A security assessor is evaluating an organization's access control policy. The assessor needs to verify that the policy includes all required elements for compliance with a specific framework. Which of the following would be the MOST reliable source of evidence to confirm the policy's content?

Accepted Answer

The organization's official access control policy document, version-controlled and approved by management. To verify the content of an access control policy, the assessor must examine the official, approved policy document. This document is the definitive source of the organization's rules and requirements. Other sources, such as emails, screenshots, or interviews, are either informal or reflect implementation rather than policy. Therefore, the version-controlled policy document is the most reliable evidence.

Answer

Interview notes from a help desk technician describing how access is granted

Answer

An email from the IT manager summarizing the access control rules

Answer

A screenshot of the access control settings in the identity management system

Question 15

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

Accepted Answer

NIST SP 800-60.. NIST SP 800-60, 'Guide for Mapping Types of Information and Information Systems to Security Categories,' is the definitive guidance that operationalizes FIPS 199. FIPS 199 defines the categorization model (low/moderate/high for confidentiality, integrity, availability), while SP 800-60 provides the actual mapping tables and methodology for assigning those impact levels to specific information types. Together they form the categorization foundation of the RMF.

Answer

NIST SP 800-37.

Answer

NIST SP 800-53.

Answer

FIPS 140-3.