CGRC Practice Test 25 — 15 Questions

Question 1

You are reviewing the continuous monitoring strategy for a system that processes Controlled Unclassified Information (CUI). The system owner proposes reducing the frequency of vulnerability scans from weekly to quarterly to save costs. As the GRC analyst, what is your primary consideration when evaluating this proposal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The potential increase in risk exposure and whether it aligns with the organization's risk tolerance and compliance requirements.. The primary consideration when changing vulnerability scan frequency is the impact on risk exposure and whether that risk is acceptable given the organization's risk tolerance and compliance obligations. For CUI, frameworks like NIST SP 800-171 require regular scanning. Cost, tool availability, and historical vulnerability counts are secondary and cannot justify an increase in risk that violates requirements or exceeds tolerance.

Answer

The number of vulnerabilities identified in previous scans.

Answer

The cost savings achieved by reducing scan frequency.

Answer

The availability of automated tools to perform quarterly scans instead of weekly scans.

Question 2

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

Accepted Answer

Control ID prefix.. In NIST SP 800-53, controls are identified by a unique control ID that consists of a two-letter family prefix followed by a number (e.g., AC-1 for Access Control). The prefix indicates the control family. Therefore, the control ID prefix (Option C) identifies the specific family to which a control belongs.

Answer

Control priority tag.

Answer

The assignment statement.

Answer

The control parameter list.

Question 3

A healthcare organization is updating its risk management methodology. The GRC team wants to ensure that risk assessments consistently consider the potential impact on patient safety, regulatory compliance, and financial performance. The CISO requests a quantitative approach to prioritize risks for mitigation funding. Which risk analysis method BEST meets these requirements?

Accepted Answer

Quantitative risk assessment using Monte Carlo simulation and annualized loss expectancy (ALE).. Quantitative risk assessment, particularly with Monte Carlo simulation and ALE, provides the numerical rigor needed to prioritize risks based on financial impact and probability. This method translates risk into monetary terms, enabling objective comparison and cost-benefit analysis for mitigation funding. It also allows for modeling uncertainty, which is essential in healthcare where impacts on patient safety and compliance can be difficult to quantify but must be considered.

Answer

Qualitative risk assessment using a likelihood-impact matrix with predefined risk levels.

Answer

Control self-assessment (CSA) workshops to identify control gaps and prioritize remediation.

Answer

Semi-quantitative risk assessment using numerical scales for likelihood and impact.

Question 4

When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)

Accepted Answer

The information types processed, stored, or transmitted by the system.. Option A is correct because defining the system boundary requires identifying the information types that are processed, stored, or transmitted by the system, since the boundary must encompass all data flows and information assets subject to the applicable security controls and categorization (e.g., FIPS 199 / SP 800-60 impact levels). Option D is correct because the system boundary must account for all interconnections with other internal and external systems, as these connections define where the system ends and where external dependencies, shared services, and cross-boundary data exchanges begin (e.g., documented in the SSP's system boundary description and interconnection agreements). Option B is not a defining factor of the boundary itself; personnel access is an authorization and access-control consideration that applies within the boundary rather than determining where it lies. Option C is incorrect because budget for hardware replacement is a lifecycle and funding concern, not a boundary-defining attribute. Option E is incorrect because the physical location of a cloud data center is a deployment and infrastructure detail; the boundary is defined by logical and data-flow scope, not by geography.

Answer

The organizational personnel who have access to the system.

Answer

The fiscal budget allocated for hardware replacement.

Answer

The physical location of the cloud data center.

Question 5

A security analyst is selecting controls for a new information system based on NIST SP 800-53 Rev. 5. The system has been categorized as LOW impact. The analyst proposes using the LOW baseline but wants to add a control from the MODERATE baseline to address a specific risk identified in the risk assessment. What is the most appropriate action?

Accepted Answer

Add the control and document the rationale in the system security plan as a tailored enhancement.. Supplementing a LOW baseline with a control from a higher baseline is a legitimate tailoring action when justified by risk. The control should be added, and the rationale documented in the system security plan. This approach ensures the control set is tailored to the system's specific risk profile while maintaining alignment with NIST SP 800-53 guidance.

Answer

Re-categorize the system as MODERATE impact so that the control can be included without additional documentation.

Answer

Add the control but mark it as not applicable in the system security plan to avoid additional assessment burden.

Answer

Do not add the control because the system is LOW impact and must only use the LOW baseline.

Question 6

Which THREE of the following are components of a secure server hardening process?

Accepted Answer

Applying security patches. Option B is correct because applying security patches closes known vulnerabilities in the OS and applications, which is a foundational hardening step that reduces the attack surface before other controls are layered on. Option C is correct because configuring the OS with a minimal footprint (removing unnecessary packages, roles, and features) limits the number of potential exploit targets and simplifies patch management. Option E is correct because disabling unused services and ports eliminates unnecessary listening sockets and daemons, directly shrinking the attack surface and preventing exploitation of services that are not required for the server's role. Option A is incorrect because installing all available third-party software increases the attack surface and introduces unvetted code, which is the opposite of hardening. Option D is incorrect because running the web server as root violates the principle of least privilege; web services should run under a dedicated low-privilege account to contain any compromise.

Answer

Installing all available third-party software

Answer

Running the web server as the root user

Question 7

A multinational corporation is implementing a new cloud-based ERP system. The GRC analyst must ensure that the control environment aligns with the organization's risk appetite. The CISO asks for a control that provides reasonable assurance that transactions are authorized and recorded accurately. Which type of control is most appropriate?

Accepted Answer

Preventive control. The CISO seeks reasonable assurance that transactions are authorized and recorded accurately. This is best achieved through preventive controls like authorization checks and input validation, which stop errors and fraud at the point of entry. Detective, corrective, and compensating controls operate after the fact or as alternatives, so they do not meet the requirement.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 8

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

Accepted Answer

Perform a cryptographic erase by deleting the associated encryption keys.. Cryptographic erase (crypto-shredding) destroys the encryption keys that protect the data, rendering the ciphertext permanently unrecoverable even if residual bits remain on shared cloud storage. In multi-tenant cloud environments, you cannot physically destroy the underlying media, so key destruction is the only reliable way to guarantee data is unrecoverable. This satisfies data privacy regulations that require demonstrable, irreversible disposal of personal data at decommissioning.

Answer

Delete the VM snapshot from the management console.

Answer

Revoke the access rights of the VM administrator.

Answer

Shut down the VM and wait for the provider to recycle the hardware.

Question 9

You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?

Accepted Answer

Set up a Workflow Transition Condition triggered by the 'Severity' field.. To enforce that any finding classified as 'High' severity must be approved by the CISO before transitioning to 'Remediated,' you need a workflow transition condition that evaluates the Severity field and requires CISO approval. This is a conditional workflow rule that gates the state transition based on the finding's severity value, ensuring the approval requirement is applied only to High-severity findings.

Answer

Configure a global Business Rule to auto-close all findings.

Answer

Change the default notification email template for findings.

Answer

Modify the User Permission set for the CISO account.

Question 10

A GRC practitioner is designing a continuous monitoring program for the organization's security controls. The goal is to detect control failures in near real-time. Which of the following should be the primary focus when selecting metrics for continuous monitoring?

Accepted Answer

Metrics that directly measure the effectiveness of the control and can be automated.. The correct answer is metrics that directly measure control effectiveness and can be automated. Continuous monitoring aims to detect control failures in near real-time, so the metrics must be relevant to the control's performance and capable of being collected automatically. This ensures timely detection and response, which is the core objective of continuous monitoring.

Answer

Metrics that are reviewed annually by the audit committee.

Answer

Metrics that are easy to collect and require minimal automation.

Answer

Metrics that are aligned with industry benchmarks to ensure comparability.

Question 11

You are the Information System Security Officer (ISSO) for a federal financial system undergoing an annual assessment. The Security Control Assessor (SCA) has completed the assessment and documented several controls as 'Other than Satisfied' in the Security Assessment Report (SAR). According to NIST SP 800-37 Revision 2, what is the primary next step the Authorizing Official (AO) must take before making an authorization decision?

Accepted Answer

Review the Plan of Action and Milestones (POA&M) to ensure all findings are addressed with remediation timelines.. Before making an authorization decision, the Authorizing Official must review the Plan of Action and Milestones (POA&M) to understand how identified weaknesses will be addressed and to assess residual risk. The POA&M is a key component of the authorization package, along with the SAR and SSP. This review enables the AO to make an informed, risk-based decision, which may include granting an authorization with conditions.

Answer

Forward the SAR to the system owner and require them to implement all recommended fixes before the AO reviews the package.

Answer

Immediately deny the Authorization to Operate (ATO) because any 'Other than Satisfied' control is unacceptable.

Answer

Instruct the SCA to re-assess all controls marked 'Other than Satisfied' to verify the findings.

Question 12

Which TWO of the following statements regarding the 'Tailoring' process are accurate?

Accepted Answer

Tailoring actions must be documented to justify the risk management decisions.. Option B is correct because the RMF requires that all tailoring actions be documented in the system security plan (SSP) and supporting artifacts so that the risk management decisions and their rationale are transparent and auditable. Option D is correct because tailoring is precisely the process of adjusting the initial control baseline (from NIST SP 800-53B) to account for system-specific factors such as mission needs, environment of operation, organizational constraints, and risk tolerance, resulting in the system's tailored baseline. Option A is incorrect because tailoring occurs during the Select step (Step 2) of the RMF, not the Assess step (Step 4). Option C is incorrect because tailoring applies to all systems regardless of impact level (Low, Moderate, or High). Option E is incorrect because tailoring is a required part of the RMF Select step, not an optional activity.

Answer

Tailoring is performed during the Assess step.

Answer

Tailoring is only permitted for High impact systems.

Answer

Tailoring is optional and not required by RMF.

Question 13

A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the following should be the PRIMARY focus of the update?

Accepted Answer

Reassessing the security controls to ensure they remain effective with the new boundary.. The primary focus of updating the SSP after a boundary change is to reassess security controls to ensure they remain effective. A boundary change can affect how controls are implemented and may require new controls. The SSP must reflect these changes accurately to maintain compliance and support ongoing authorization. Other actions like notifying the AO or updating subordinate plans are important but secondary.

Answer

Updating the contingency plan to reflect the new system components.

Answer

Notifying the authorizing official of the change and requesting a new ATO.

Answer

Documenting the new hardware and software components added to the system.

Question 14

A security assessor is evaluating an organization's continuous monitoring program as part of a NIST SP 800-137 assessment. The assessor must verify that the program includes the essential elements required for effective ongoing situational awareness. Which TWO elements are essential components of a continuous monitoring program? (Choose two.)

Accepted Answer

A process for conducting ongoing security control assessments and reporting the results to authorizing officials.. NIST SP 800-137 identifies configuration management and ongoing security control assessments with reporting as essential elements of continuous monitoring. Configuration management ensures changes are tracked and evaluated for security impact, while ongoing assessments provide current data on control effectiveness. Annual penetration tests, incident response plans, and periodic business impact analyses are valuable but do not constitute the continuous, ongoing monitoring required for situational awareness.

Answer

An annual penetration test performed by an external third party.

Answer

A documented incident response plan that is tested at least once every three years.

Answer

A formal business impact analysis conducted every five years.

Question 15

A mid-size healthcare insurer is standing up a GRC program and must decide where the authority to approve enterprise risk acceptance thresholds should reside. The CISO argues it belongs in the security operations team, while the CIO argues it belongs with IT leadership. The GRC lead needs to recommend a governance structure that keeps risk decisions independent from those who own and operate the controls. Which arrangement best satisfies that requirement?

Accepted Answer

Assign risk acceptance authority to a cross-functional risk committee that reports to the Board of Directors, with the CISO and CIO as non-voting contributors.. Effective GRC governance separates those who accept risk from those who operate the controls that mitigate it. A board-reporting risk committee provides that independence while still using the CISO and CIO as advisory contributors. Delegating acceptance to the operating teams, or to a single control-owning executive, embeds a self-review conflict that weakens the integrity of the entire risk program.

Answer

Give risk acceptance authority to the CIO, since IT leadership owns most of the technical controls and the associated budget.

Answer

Split risk acceptance authority evenly between the CISO and CIO, requiring both signatures on every exception regardless of risk level.

Answer

Delegate risk acceptance authority to the security operations team because it performs the daily control monitoring and understands residual risk best.