CGRC Practice Test 2 — 25 Questions

Question 1

What is the primary goal of the 'Assessment Reporting' phase?

Accepted Answer

To communicate findings to stakeholders. Reporting provides stakeholders with an accurate picture of the security posture, identified risks, and the evidence supporting the findings.

Answer

To terminate the contract

Answer

To select new security controls

Answer

To patch all identified vulnerabilities

Question 2

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. A NIST Cryptographic Module Validation Program (CMVP) certificate provides formal verification that a product has met the FIPS 140 requirements.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor

Question 3

Which technique is best to detect 'false negatives' during a security control assessment?

Accepted Answer

Reviewing security log correlation. Correlation of logs from multiple sources (e.g., firewall, IPS, host logs) allows an auditor to see if a threat was missed by a single control.

Answer

Interviewing developers

Answer

Checking server physical locks

Answer

Single tool vulnerability scanning

Question 4

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Evidence must be protected from unauthorized changes, be verifiable, and be stored securely to maintain its chain of custody.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper

Question 5

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Accepted Answer

Ensuring the assignment value is consistent with organizational policy.. Effective management of assignments ensures that controls are tailored and that the organization has a clear record of its security obligations.

Answer

Updating all assignment values daily.

Answer

Consulting with the NIST publication author.

Question 6

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Accepted Answer

Implement and document compensating controls.. When a patch cannot be applied, compensating controls must be implemented and documented to mitigate the risk.

Answer

Request an exemption from the CISO without providing documentation.

Answer

Ignore the vulnerability as it cannot be fixed.

Answer

Disconnect the server from the network permanently.

Question 7

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 8

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 9

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. Publisher rules in AppLocker allow for the most granular control based on digital certificates.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 10

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. A compensating control is an alternate measure used to satisfy the requirement of a security control that cannot be implemented as stated.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 11

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

Accepted Answer

Target state, Current state, Gap identification. You must define the target (what good looks like), determine the current state (as-is), and then identify the delta (gap).

Answer

Current state, Target state, Gap identification

Answer

Gap identification, Target state, Current state

Answer

Current state, Gap identification, Target state

Question 12

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. Execution involves interviewing staff, reviewing documentation, and testing technical configuration settings.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 13

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. A formal change control process is required to ensure that changes are tested, documented, and approved.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 14

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Patch management requires testing to prevent outages and a deployment strategy to ensure coverage.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 15

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Accepted Answer

To define specific parameters for control implementation.. Assignment statements provide a mechanism to tailor the control by specifying organization-defined values or frequencies.

Answer

To categorize the control by its priority level.

Answer

To link the control to a regulatory requirement.

Answer

To assign the control to a specific system administrator.

Question 16

What is the primary function of an assessor's 'working papers'?

Accepted Answer

To document evidence and support the findings. Working papers document the evidence gathered, testing performed, and observations made, which serve as the foundation for the final assessment report.

Answer

To list the audit team members

Answer

To submit to the regulator

Answer

To replace the need for an audit

Question 17

Which TWO of the following are recommended practices for managing firewall rules?

Accepted Answer

Documenting the business justification for each rule. Regular review and documentation of rules help maintain a secure and clean firewall configuration.

Answer

Disabling logging for all rules to improve performance

Answer

Applying rules in random order

Answer

Using 'Any' as the destination for all rules

Question 18

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. Conditions attached to an ATO represent known risks that must be tracked and mitigated through the POA&M to transition to full, unconditioned authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 19

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Accepted Answer

Create a certificate of destruction for audit purposes.. Sanitizing the media, updating the inventory, and documenting the destruction process are all critical steps for classified systems.

Answer

Move the system to a secure storage area for indefinite holding.

Answer

Reformat the drive for reuse in a non-sensitive project.

Question 20

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Disabled account management is a critical detective and preventive control to ensure that only authorized, active users have access.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication