CGRC Practice Test 4 — 25 Questions

Question 1

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Before any IT asset holding sensitive information leaves organizational control, the storage media must be sanitized using an approved standard (e.g., NIST SP 800-88 Rev. 1 purge or clear, or physical destruction) to prevent data remanence and unauthorized disclosure. This is the control that directly addresses the confidentiality risk of disposal; all other steps are administrative or operational and do not protect the data itself.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 2

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

Accepted Answer

Apply a 'Category Filter' or 'Saved View' to the dashboard widget.. To display only risks associated with 'Cybersecurity' on a Risk Heat Map, you should apply a 'Category Filter' or 'Saved View' to the dashboard widget. This allows the executive to see a filtered subset of risks without altering the underlying data or system configuration. Filters and saved views are standard features in GRC platforms for customizing dashboards based on user needs.

Answer

Change the risk rating scale from 1-5 to 1-10.

Answer

Delete all non-cybersecurity risks from the system.

Answer

Create a new database user for the executive.

Question 3

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A jump server (bastion host) with multi-factor authentication (MFA) enforces a controlled, auditable entry point to the production network, requiring a second authentication factor before any access is granted. This architecture centralizes access logging, session recording, and credential management, and it prevents direct exposure of production servers to the internet. By combining a hardened intermediary with MFA, the organization achieves defense in depth and satisfies least-privilege and non-repudiation requirements.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 4

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Accepted Answer

Document the weakness in a Plan of Action and Milestones (POA&M). In FedRAMP, when a cloud environment does not meet a required control, the mandatory next step is to document the weakness in a Plan of Action and Milestones (POA&M). The POA&M tracks the non-compliance, including remediation tasks, timelines, and responsible parties. This is required by FedRAMP and NIST SP 800-37. The other options are either not mandatory or inappropriate.

Answer

Immediately terminate the cloud service

Answer

Perform a penetration test

Answer

Request a waiver from the JAB

Answer

Update the System Security Plan (SSP) to reflect compliance

Question 5

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Option B (Chain of custody documentation) is correct because integrity of audit evidence requires an unbroken, auditable record of who collected, handled, transferred, and stored the evidence, ensuring it has not been tampered with or substituted. Option C (Use of cryptographic hashes for log files) is correct because hashing algorithms such as SHA-256 produce a fixed digest that verifies the log data has not been altered, providing a mathematically verifiable integrity check. Option E (Restricting access to the audit evidence folder) is correct because enforcing least-privilege access controls (e.g., NTFS or POSIX permissions, role-based access) prevents unauthorized modification or deletion, preserving the evidence's integrity. Option A (Publishing evidence to the company website) is not appropriate because public disclosure exposes evidence to alteration and does not preserve integrity. Option D (Printing all evidence on paper) is not essential because paper copies can be forged or altered and do not provide cryptographic verification of the original digital data.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper

Question 6

A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premises. The system owner wants to maximize efficiency by reducing duplicate documentation. The organization already has an enterprise-wide access control policy and a centralized identity management system. When developing the system security plan, what is the most appropriate approach for addressing the access control family controls?

Accepted Answer

Document the access control controls as common controls provided by the enterprise identity management system and reference the enterprise policy.. The correct approach is to leverage existing enterprise common controls for access control, as this reduces duplication and ensures consistency with organizational policy. Documenting them as common controls in the system security plan accurately reflects the inheritance and fulfills the requirement to address all applicable controls. This aligns with NIST SP 800-53 guidance on common controls and tailoring.

Answer

Mark all access control controls as not applicable because the enterprise identity management system handles authentication and authorization outside the system boundary.

Answer

Implement all access control controls independently within the payroll system, even if they duplicate enterprise capabilities, to ensure full control.

Answer

Select only the access control controls that are explicitly required by the payroll application vendor's security guide, ignoring the enterprise baseline.

Question 7

Which THREE of the following are elements of a secure incident response control set?

Accepted Answer

Establishing a dedicated Incident Response Team (IRT). Option A is correct because a dedicated Incident Response Team (IRT) is a core element of a secure incident response control set, providing defined roles, authority, and accountability for detecting, containing, eradicating, and recovering from security incidents. Option C is correct because a SIEM (Security Information and Event Management) system centralizes log collection, correlation, and alerting, which is essential for timely detection and analysis of incidents. Option D is correct because an updated Incident Response Plan (IRP) documents procedures, communication paths, escalation criteria, and recovery steps, ensuring a consistent and effective response. Option B is incorrect because sharing sensitive server logs on a public forum violates confidentiality and could expose credentials, PII, or exploitable system details. Option E is incorrect because disabling all security controls during an investigation removes visibility and protections, increasing risk and potentially destroying evidence.

Answer

Sharing sensitive server logs on a public forum

Answer

Disabling all security controls during an investigation

Question 8

Which THREE types of information should be included in a risk acceptance memo?

Accepted Answer

Description of the identified risk. A risk acceptance memo must document what is being accepted, so option C (Description of the identified risk) is correct because it clearly states the specific vulnerability, threat, or weakness being formally accepted. Option D (The impact on the organizational mission) is correct because decision-makers need to understand the potential business consequences, such as mission degradation, financial loss, or operational disruption, to make an informed acceptance decision. Option E (Justification for accepting the risk) is correct because it records the rationale—such as cost-benefit analysis, compensating controls, or low likelihood—that explains why the risk is being accepted rather than mitigated, transferred, or avoided. Options A and B are incorrect because vendor names and server technical specifications are asset or inventory details, not the risk-governance content required in a risk acceptance memo.

Answer

The name of the software vendor

Answer

The technical specifications of the server

Question 9

Which TWO of the following are examples of physical security controls?

Accepted Answer

Security cameras. Security cameras (B) are a physical security control because they are hardware devices deployed to monitor and record activity in a physical facility, deterring and detecting intrusions. Key card access systems (D) are also physical controls, as they use tangible badge readers and door hardware to restrict physical entry to authorized personnel. The remaining options are logical/technical controls: a host-based firewall (A) filters network traffic in software, a strong password policy (C) is an administrative control governing authentication, and encryption of database tables (E) is a technical control protecting data at rest.

Answer

Host-based firewall

Answer

Strong password policy

Answer

Encryption of database tables

Question 10

A financial services firm is implementing a new payment processing system. The security architect must ensure that all changes to the production environment are authorized, tested, and documented before deployment. Which of the following controls best addresses this requirement?

Accepted Answer

Change management process with approval workflows and segregation of duties. The requirement is for a control that ensures changes are authorized, tested, and documented. A change management process with approval workflows and segregation of duties provides this governance by requiring formal requests, reviews, and approvals before deployment. Monitoring, scanning, and RBAC are complementary but do not enforce the change lifecycle, making the change management process the correct choice.

Answer

Continuous security monitoring using a SIEM

Answer

Role-based access control (RBAC) for production systems

Answer

Vulnerability scanning of the production environment

Question 11

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. The CMVP (Cryptographic Module Validation Program) validation certificate is the authoritative, independently verified proof that a cryptographic module meets FIPS 140-3 requirements. It is issued only after NIST-accredited CST laboratory testing and CMVP review, and it lists the exact module, version, and validated security levels. This makes it the strongest and only formally recognized evidence of FIPS 140-3 compliance.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor

Question 12

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Accepted Answer

Add additional controls to the baseline to address specific threat vectors.. In NIST SP 800-53 Rev. 5 tailoring, 'supplementing' means adding controls to the baseline to address specific threats, technologies, or organizational requirements not covered by the initial baseline. The authorization official's request to supplement therefore means adding additional controls (B).

Answer

Replace a control with a vendor-provided security feature.

Answer

Remove controls from the baseline that are technically infeasible.

Answer

Adjust the parameters of existing controls to lower operational impact.

Question 13

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Accepted Answer

Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0. An AWS Security Group is stateful and evaluates inbound traffic against inbound rules; to permit public HTTPS access to the web server, you must create an inbound rule allowing TCP 443 from 0.0.0.0/0 (the entire IPv4 internet). The source 0.0.0.0/0 is the correct CIDR notation for 'any IPv4 address,' and specifying HTTPS/443 matches the standard secure web port. This rule satisfies the requirement to allow incoming HTTPS while other traffic remains blocked by default due to Security Groups' implicit deny.

Answer

Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0

Answer

Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0

Answer

Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32

Question 14

A GRC practitioner is establishing a process for maintaining the compliance program's documented information. The goal is to ensure that policies, standards, and procedures remain current, authorized, and available to the right audiences. Which TWO of the following activities are essential to this process? (Choose two.)

Accepted Answer

Defining a review cycle and assigning document owners who revalidate content. Maintaining documented information requires clear ownership with periodic review and a controlled process for versioning and approval. These two activities ensure documents stay current, authorized, and traceable. Public disclosure, personal storage, and distributed rewriting all undermine control, availability, or consistency, and therefore do not support the stated goal of a reliable documentation process.

Answer

Requiring every employee to rewrite each policy annually in their own words

Answer

Publishing all documents to the public corporate website for transparency

Answer

Storing documents only in the personal drives of the GRC team members who wrote them

Question 15

Which GRC platform component is most critical for ensuring that executive leadership receives accurate, real-time risk posture data?

Accepted Answer

The Executive Dashboard and Reporting module.. The Executive Dashboard and Reporting module is correct because it aggregates risk data from across the GRC platform and presents it in real-time, role-appropriate views for leadership. It provides the visualization, drill-down, and trend analysis executives need to make informed risk decisions. Other components support the data but do not deliver the executive-facing risk posture.

Answer

The system audit log.

Answer

The User Provisioning interface.

Answer

The API integration module.

Question 16

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Accepted Answer

Use an established 'Data Connector' or 'API Integration' module.. The most efficient configuration approach for ingesting CSPM data into a GRC tool is to use an established 'Data Connector' or 'API Integration' module. These modules are purpose-built to handle authentication, data mapping, scheduling, and error handling, enabling near real-time, automated, and reliable data flow with minimal custom development. This aligns with continuous monitoring principles by ensuring timely and accurate risk data without manual intervention.

Answer

Build a custom script to write directly to the GRC database tables.

Answer

Manually export and import CSV files every hour.

Answer

Have the CSPM tool email screenshots of security alerts to the GRC team.

Question 17

A federal agency is implementing controls to comply with the Federal Information Security Modernization Act (FISMA). The agency uses the NIST Risk Management Framework (RMF). During the control implementation phase, the security team must select controls based on the system's security categorization. Which NIST Special Publication provides the catalog of security and privacy controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the foundational catalog of security and privacy controls for federal information systems. Under FISMA and the RMF, agencies select controls from SP 800-53 based on their system's security categorization. SP 800-37 describes the RMF process, SP 800-30 covers risk assessments, and SP 800-171 is for nonfederal CUI systems, so they are not the control catalog.

Answer

NIST SP 800-37

Answer

NIST SP 800-171

Answer

NIST SP 800-30

Question 18

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data residency laws (e.g., GDPR, PIPEDA, Russia's Federal Law No. 242-FZ) require that certain data remain within specific geographic boundaries. Implementing data partitioning or regional access scoping in a GRC platform ensures that data is stored and processed only in approved regions and that access is restricted based on the user's region. This directly addresses the compliance requirement by enforcing logical or physical separation of data.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.

Question 19

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

Accepted Answer

Updating the asset inventory database. Option A (Updating the asset inventory database) is correct because decommissioning must be reflected in the configuration management database (CMDB) or asset register so the server is no longer tracked as an active, supported asset and any dependencies, licenses, or monitoring are removed. Option B (Cryptographic erase of the storage media) is correct because crypto-erasure destroys or invalidates the encryption key protecting the data at rest (e.g., SED/self-encrypting drive or BitLocker/LUKS key), rendering the sensitive data unrecoverable in a fast, verifiable manner. Option D (Disconnecting from the network and removing physical identity) is correct because the host must be isolated from the production network to prevent unauthorized access or data exfiltration, and asset tags, hostnames, and rack labels should be removed to prevent misidentification or reuse of a still-sensitive system. Option C is not sufficient because a single reformat only removes the file system references and leaves recoverable data remnants on the platters or cells; secure media sanitization (NIST SP 800-88 purge/destroy) is required. Option E is wrong because leaving the server powered on in the rack keeps the data accessible and the system live, which is the opposite of decommissioning.

Answer

Reformatting the drive once

Answer

Leaving the server powered on in the rack

Question 20

You are developing a security plan for a system that uses a NIST SP 800-53 control baseline. During control selection, you determine that a particular control is not applicable because the system does not have the relevant technology. How should you document this decision?

Accepted Answer

Mark the control as 'Not Applicable' and provide a rationale explaining why the control does not apply to the system.. The correct documentation is to mark the control as Not Applicable and provide a rationale. This maintains the integrity of the security plan and ensures that assessors understand the tailoring decision. It aligns with NIST SP 800-53 requirements for documenting control applicability and tailoring actions.

Answer

Replace the control with a different control from the same family that is easier to implement.

Answer

Mark the control as 'Inherited' from the service provider, even though the system does not use that technology.

Answer

Remove the control from the security plan entirely to avoid confusion during assessment.