CGRC Practice Test 4 — 25 Questions

Question 1

Which document is used to standardize the implementation of security controls across an organization?

Accepted Answer

Security Baseline. A Security Baseline (or Standard) provides the specific, actionable configuration requirements for assets.

Answer

Incident Response Plan

Answer

Risk Register

Answer

Acceptable Use Policy

Question 2

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Accepted Answer

To provide a standardized starting point based on impact level.. NIST SP 800-53B focuses on establishing a starting point of security controls based on the FIPS 199 impact categorization to ensure a minimum security posture.

Answer

To remove all controls that do not apply to the local network.

Answer

To define the continuous monitoring strategy for the system.

Answer

To identify all system-specific compensations.

Question 3

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. The AO reviews and approves the selected control set to ensure it meets the risk appetite of the organization.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 4

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing recovery keys in Active Directory Domain Services (AD DS) ensures central management and recovery capability for IT staff.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop

Question 5

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data partitioning or 'Multi-Tenancy/Geographic Segregation' allows GRC platforms to isolate data based on geographic origin.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.

Question 6

Which THREE of the following represent common challenges in maintaining an integrated GRC program?

Accepted Answer

Ensuring leadership support is sustained over time.. Data silos, lack of executive support, and evolving regulations are classic challenges in GRC.

Answer

Ensuring the GRC platform looks visually identical to the company brand.

Answer

Limiting the GRC platform to only one department.

Question 7

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

Accepted Answer

Apply a 'Category Filter' or 'Saved View' to the dashboard widget.. Filtering or 'Reporting View Scoping' allows users to isolate data on dashboards based on attributes like 'Category'.

Answer

Change the risk rating scale from 1-5 to 1-10.

Answer

Delete all non-cybersecurity risks from the system.

Answer

Create a new database user for the executive.

Question 8

Which GRC component is used to document the organizational structure, such as business units and departments, to which risks are assigned?

Accepted Answer

The 'Entity' or 'Organization' Manager module.. The 'Organization Hierarchy' or 'Entity Manager' module defines the business structure within the GRC platform.

Answer

The 'Report' generator.

Answer

The 'Policy' library.

Answer

The 'Incident' tracking module.

Question 9

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

Accepted Answer

Individual systems do not need to address password complexity.. Common controls are controls provided by the infrastructure or enterprise that individual information systems inherit, reducing the burden on system owners.

Answer

Individual systems must override the common control.

Answer

Common controls cannot be used for password complexity.

Answer

Individual systems must report their own password status.

Question 10

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

Accepted Answer

The control is not applicable to the system's technology.. Tailoring is performed to align the baseline with the specific mission and technical needs of the information system.

Answer

The control has a high cost of implementation.

Answer

The control is too difficult to monitor.

Answer

The system owner disagrees with the FIPS 199 classification.

Question 11

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

Accepted Answer

NIST SP 800-53B.. NIST SP 800-53B provides the control baselines for the various impact levels.

Answer

NIST SP 800-53A.

Answer

FIPS 199.

Answer

NIST SP 800-37.

Question 12

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Accepted Answer

Document the removal and the justification in the SSP.. When controls are removed from the baseline during tailoring, the justification must be recorded to support auditability.

Answer

Mark the control as 'Implemented' and leave the field blank.

Answer

Request a waiver from the CISO.

Answer

Just delete the control from the system security plan (SSP).

Question 13

Which TWO of the following characterize the 'Select' step in the RMF?

Accepted Answer

Identifying and selecting the security controls to be implemented.. The select step focuses on choosing the appropriate controls and documenting them in the system security plan.

Answer

Verifying that the controls are operating as expected.

Answer

Determining the impact categorization of the system.

Answer

Authorizing the system for operation.

Question 14

Which TWO of the following are examples of administrative security controls?

Accepted Answer

Data classification policy. Administrative controls are 'soft' controls involving policy and management, whereas technical controls are 'hard' controls.

Answer

Firewall configuration

Answer

Biometric locks

Answer

Intrusion detection systems

Question 15

Which THREE of the following are benefits of using the NIST 800-53 control framework?

Accepted Answer

It supports a consistent approach to security across the organization.. The framework provides a common language and structured approach to security that helps organizations manage risk effectively.

Answer

It eliminates the need for any technical expertise.

Answer

It automates all manual security processes.

Question 16

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

Accepted Answer

Control ID prefix.. Control identifiers in NIST 800-53 follow a format such as AC-2, where 'AC' refers to the Access Control family.

Answer

Control priority tag.

Answer

The assignment statement.

Answer

The control parameter list.

Question 17

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Accepted Answer

The overlay supplements the baseline.. Overlays are used to augment the base control set; they don't replace the baseline but tailor it for a specific context.

Answer

The overlay is used only if the system is High impact.

Answer

The baseline is discarded if an overlay is used.

Answer

The overlay replaces the entire baseline.

Question 18

Which THREE factors should an organization consider when applying control overlays?

Accepted Answer

The mission or business requirements of the system.. Overlays must be carefully integrated to ensure they maintain compliance while addressing specific environmental factors.

Answer

The personal preference of the system administrator.

Answer

The date the system was originally purchased.

Question 19

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. A boundary diagram or description is required for the System Security Plan to define what is subject to assessment.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 20

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

Accepted Answer

Apply a 'Status Filter' to the dashboard widget on 'Verified'.. Workflow-driven reporting or 'Dashboard Filters' based on record state ensure that reports only reflect validated data.

Answer

Create a separate dashboard for every assessment status.

Answer

Restrict user access to the 'Verified' status.

Answer

Set the report to auto-refresh every minute.