CGRC Practice Test 2 — 25 Questions

Question 1

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adjust the 'Assessment Trigger' logic based on the 'Criticality' score.. The requirement is to trigger Control Self-Assessments automatically based on control criticality. This is achieved by modifying the 'Assessment Trigger' logic to use the 'Criticality' score as a condition. This ensures that high-criticality controls are assessed more frequently or automatically, aligning with risk-based GRC automation. The other options do not address the trigger mechanism or would undermine the self-assessment process.

Answer

Change the global password policy for GRC users.

Answer

Require the GRC admin to manually assign tasks to users.

Answer

Disable the self-assessment feature to force all audits to be external.

Question 2

A system owner is preparing to accept a risk for a low-impact information system. The system has a minor weakness that cannot be remediated in the next 30 days. Which document must the system owner sign to formally accept the risk?

Accepted Answer

Risk acceptance memo or letter. A risk acceptance memo or letter is the formal document used by a system owner to accept a specific risk. It details the risk, its potential impact, and the rationale for acceptance, and requires the system owner's signature. Other documents like the SSP, POA&M, and ATO serve different purposes in the authorization process and do not fulfill the role of explicit risk acceptance.

Answer

Authorization to Operate (ATO)

Answer

System Security Plan (SSP)

Answer

Plan of Action and Milestones (POA&M)

Question 3

An organization is implementing a continuous monitoring program for its information systems in accordance with NIST SP 800-137. Which TWO activities are essential components of this program? (Choose two.)

Accepted Answer

Performing ongoing security control assessments. Continuous monitoring per NIST SP 800-137 requires ongoing security control assessments to verify effectiveness and regular reporting of security status to organizational officials. These activities ensure that the system's security posture is continuously understood and that risk is managed proactively. Other activities like training and categorization are important but are not core continuous monitoring activities.

Answer

Conducting annual security awareness training for all users

Answer

Conducting a full Security Assessment Report (SAR) only at the end of the authorization cycle

Answer

Documenting the system's security categorization

Question 4

You are the Information System Security Officer (ISSO) for a federal system undergoing a periodic security control assessment. During the assessment, the assessor identifies that a high-impact security control is only partially implemented. According to NIST SP 800-37 Rev. 2, what should be your immediate next step?

Accepted Answer

Document the partial implementation as a finding in the Security Assessment Report (SAR) and develop a Plan of Action and Milestones (POA&M) to remediate the control.. According to NIST SP 800-37 Rev. 2, during the Monitor step, assessment findings must be documented in the SAR and addressed through a POA&M. A partially implemented control is a finding that requires remediation planning. The ISSO's role is to ensure proper documentation and follow-up, not to unilaterally suspend operations or misclassify the control. This approach maintains the integrity of the authorization process.

Answer

Update the System Security Plan (SSP) to mark the control as 'Not Applicable' (NA) to avoid a finding.

Answer

Request an exception from the Authorizing Official (AO) to accept the partial implementation without further action.

Answer

Immediately suspend system operations until the control is fully implemented.

Question 5

Which TWO factors contribute to the 'scope' of an information security audit?

Accepted Answer

Network boundaries. The scope of an information security audit is defined by what will be examined, and option C (Network boundaries) is correct because the audit perimeter—such as internal LAN segments, DMZs, VPN entry points, and internet-facing subnets—determines which systems, traffic flows, and controls fall inside or outside the assessment. Option E (System components and assets) is also correct because the inventory of hardware, software, applications, databases, and data assets directly establishes the breadth of the audit and the controls to be tested. Options A (External stock prices) and B (Competitor market analysis) are financial and competitive-intelligence concerns unrelated to defining an audit's technical scope, and option D (Employee home addresses) is personal data that does not determine which systems or boundaries the audit covers.

Answer

External stock prices

Answer

Competitor market analysis

Answer

Employee home addresses

Question 6

A newly appointed GRC manager at a healthcare payer is drafting the organization's first charter for the governance function. The CIO asks what single element must be documented in the charter to give the GRC program the authority to enforce policy across business units that do not report to the GRC office.

Accepted Answer

A formal mandate from executive leadership that grants the GRC function authority to set and enforce policy. Governance authority flows from executive sponsorship. When the GRC function must enforce policy across units outside its reporting line, the charter must record a mandate from top leadership authorizing that enforcement. Asset inventories, tooling, and testing schedules are downstream activities that depend on authority but cannot create it.

Answer

A detailed inventory of every IT asset that stores or processes protected health information

Answer

A schedule of annual penetration tests for all internet-facing applications

Answer

A subscription to a commercial GRC tool with automated workflow and reporting modules

Question 7

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

Accepted Answer

The vulnerability scan was not performed after the patch was applied.. Tenable.io reports vulnerability status based on the most recent scan data it has received. If a patch was applied but no scan was run afterward, the platform has no evidence of remediation and will continue to show the vulnerability as open. The configuration management database reflects the intended state (patch deployed), while the scanner reflects the observed state (last scan result) — the gap is simply the absence of a post-patch verification scan.

Answer

The Nessus scanner plugin needs an update to recognize the patch.

Answer

The scan policy is set to 'Discovery' instead of 'Audit'.

Answer

The scan agent was decommissioned prematurely.

Question 8

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

Accepted Answer

To identify controls that are implemented once and applied to multiple systems.. Common controls are security controls that are implemented once — typically at the organization, facility, or shared-service level — and inherited by multiple information systems. Identifying them during scope definition lets the organization document inheritance in each system's SSP, avoid duplicative testing, and focus system-specific assessment on controls not covered by the common provider. This is a core RMF/SP 800-37 concept for efficient authorization.

Answer

To ensure they are manually tested for every individual system.

Answer

To increase the system's FIPS 199 impact level.

Answer

To exclude them from the System Security Plan (SSP).

Question 9

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A network topology diagram that shows external service endpoints, connection paths, and system boundaries is the most effective artifact for demonstrating that all system interconnections have been inventoried, because it visually and explicitly maps every connection into and out of the system. The SAP references this diagram to support the interconnection inventory required by NIST 800-53 controls like CA-3 and SA-9. Vulnerability scans, risk registers, and patch lists do not enumerate interconnections.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 10

An organization is using a FedRAMP-authorized cloud service provider (CSP) for a new system. The ISSO must determine how to leverage the CSP's authorization to reduce the assessment burden for the new system. Which approach is most appropriate according to FedRAMP guidance?

Accepted Answer

Inherit the CSP's controls that are within the FedRAMP boundary and assess only the controls that are not inherited or are specific to the new system.. The most appropriate approach is to inherit controls from the CSP's FedRAMP authorization and assess only the controls that are not inherited or are specific to the new system. This leverages the CSP's existing authorization to reduce duplication and cost, while ensuring that all controls are assessed. FedRAMP promotes this reuse through the concept of control inheritance and the use of the CSP's authorization package.

Answer

Conduct a full independent assessment of all controls, ignoring the CSP's FedRAMP authorization to ensure completeness.

Answer

Rely entirely on the CSP's FedRAMP authorization and forego any additional assessment of the new system.

Answer

Request the CSP to modify its FedRAMP authorization to include the new system's specific controls before proceeding.

Question 11

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Accepted Answer

/etc/ssh/sshd_config. The SSH daemon's runtime behavior is controlled by /etc/ssh/sshd_config, which contains directives such as PermitRootLogin. To verify that root login over SSH is disallowed, you must inspect this file for the PermitRootLogin setting (typically set to 'no' or 'prohibit-password'). This is the authoritative configuration file for the SSH server.

Answer

/etc/hosts.allow

Answer

/etc/shadow

Answer

/etc/passwd

Question 12

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Accepted Answer

Document the removal and the justification in the SSP.. When a control is marked 'Not Applicable' during tailoring, the correct approach is to document the removal and provide a justification in the System Security Plan (SSP). This ensures transparency and auditability, allowing authorizing officials to understand why the control was excluded. The SSP serves as the primary documentation for control implementation and tailoring decisions.

Answer

Mark the control as 'Implemented' and leave the field blank.

Answer

Request a waiver from the CISO.

Answer

Just delete the control from the system security plan (SSP).

Question 13

A GRC manager is establishing a process to manage exceptions to security policies. The goal is to ensure that exceptions are granted only when justified, have a defined expiration, and are reviewed regularly. Which TWO of the following are essential components of this exception management process? (Choose two.)

Accepted Answer

Automatic expiration of exceptions after a predefined period, with notification to the requester for renewal.. A risk-based approval workflow ensures that exceptions are authorized by the right stakeholders, while automatic expiration with renewal notifications enforces periodic review. Together, these components prevent exceptions from becoming permanent and ensure they are justified at the time of renewal. Other options either create bottlenecks, lack controls, or fail to enforce review.

Answer

Storing all exception requests in a shared spreadsheet that is accessible to the entire IT department.

Answer

Allowing exceptions to remain active indefinitely as long as the requester provides a verbal justification.

Answer

A requirement that all exception requests be approved by the Chief Information Security Officer (CISO) regardless of risk level.

Question 14

What is the purpose of a 'pre-assessment' meeting?

Accepted Answer

To set expectations and coordinate logistics. A pre-assessment meeting is held before a formal assessment to align all parties on scope, schedule, roles, logistics, evidence requirements, and expectations. It ensures the assessor and the organization-under-assessment agree on what will be examined, when, by whom, and in what format evidence will be provided, reducing surprises and delays during the actual assessment.

Answer

To conduct penetration testing

Answer

To finalize the POA&M

Answer

To perform hardware inventory

Question 15

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

Accepted Answer

The cloud provider's System Security Plan (SSP) or Authorization Package. The cloud provider's System Security Plan (SSP) or authorization package is the primary evidence of implemented security controls, because it documents control descriptions, implementation statements, and supporting artifacts mapped to a framework such as NIST SP 800-53 or FedRAMP. It is the authoritative artifact a customer or auditor reviews to determine whether the provider's controls meet compliance requirements.

Answer

The service level agreement (SLA)

Answer

The organization's internal risk register

Answer

The network topology map

Question 16

An organization is using a cloud service provider (CSP) for a system that processes moderate-impact data. The CSP has a FedRAMP authorization. What is the most efficient way for the organization to leverage the CSP's authorization to support its own system's authorization?

Accepted Answer

Inherit the CSP's controls that are within the FedRAMP authorization boundary and document them in the System Security Plan (SSP) as inherited controls.. The most efficient approach is to inherit the CSP's controls that are within its FedRAMP authorization boundary and document them as inherited in the SSP. This leverages the existing authorization, reduces duplication, and allows the organization to focus on its own controls. It also supports reciprocity and speeds up the authorization process for the organization's system.

Answer

Conduct a full independent assessment of the CSP's controls to verify the FedRAMP authorization.

Answer

Assume all controls are fully inherited and do not document any controls in the organization's SSP.

Answer

Require the CSP to undergo a new FedRAMP authorization specifically for the organization's system.

Question 17

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary is defined by the set of components that the authorizing official has authority over — i.e., ownership and control. When data is shared with an external partner, the boundary must be drawn where the organization's control ends and the partner's begins, because the AO can only accept risk for systems they own or control. Cost, physical location, and user count do not determine who is accountable for the risk.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 18

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. The authorization boundary defines exactly which systems, components, and data are included in a security assessment and authorization decision. If that boundary is drawn inaccurately — too narrow or misaligned with the actual system — assets and vulnerabilities that should have been assessed fall outside the scope. Those excluded assets remain unprotected and unmitigated, which is the core risk the question is testing.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 19

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement in the RMF tailoring process (NIST SP 800-37 / SP 800-53) is the step where control statements are adjusted — adding specificity, clarifying language, or scoping the control to the system's particular environment — so the control is precise and implementable. It does not change the control's intent or the system's impact level; it makes the wording actionable for the specific system. This is distinct from scoping (removing controls not applicable) and supplementation (adding controls beyond the baseline).

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 20

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing the BitLocker recovery key in Active Directory (specifically in the computer object's msFVE-RecoveryInformation attribute) is the recommended enterprise practice because AD provides centralized, access-controlled, and auditable storage. This allows authorized administrators to retrieve the key if the drive is locked, while preventing unauthorized access through AD permissions. It also ensures the key survives hardware failures or user turnover.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop