CGRC Practice Test 5 — 25 Questions

Question 1

Which TWO of the following statements regarding the 'Tailoring' process are accurate?

Accepted Answer

Tailoring actions must be documented to justify the risk management decisions.. Tailoring allows for the modification of the baseline, but those modifications must be documented and justified.

Answer

Tailoring is performed during the Assess step.

Answer

Tailoring is only permitted for High impact systems.

Answer

Tailoring is optional and not required by RMF.

Question 2

Which THREE of the following are components that must be included when documenting a compensating control?

Accepted Answer

A detailed explanation of how the compensating control mitigates the risk.. Compensating controls require rigorous documentation to ensure the auditor can verify that the risk is mitigated effectively.

Answer

The identity of the person who approved the control.

Answer

A list of every user affected by the control.

Question 3

Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?

Accepted Answer

Document the finding in the SAR. The ISSO must document the finding in the SAR and work with the system owner to document the mitigation in a POA&M.

Answer

Delete the control from the SSP

Answer

Change the system password

Answer

Immediately disconnect the system

Question 4

Which role is typically responsible for defining the 'Risk Appetite' within a GRC governance framework?

Accepted Answer

The Executive Steering Committee.. Governance is a top-down function, and the Board or Executive Steering Committee defines risk appetite.

Answer

The IT Operations Manager.

Answer

The GRC System Administrator.

Answer

The Internal Audit Manager.

Question 5

The organization has adopted a 'Defense-in-Depth' strategy. You are tasked with mapping controls to the NIST CSF framework within the GRC tool. What is the most effective way to manage the relationship between framework sub-categories and existing internal controls?

Accepted Answer

Use 'Control Mapping' functionality to link internal controls to NIST sub-categories.. The 'Many-to-Many' mapping methodology is the industry standard for reconciling internal controls with external frameworks like NIST CSF.

Answer

Rename all internal controls to match the NIST sub-category names.

Answer

Create separate GRC instances for every framework adopted.

Answer

Hard-code the NIST framework into the GRC platform source code.

Question 6

When setting up a new GRC program, which TWO of the following are essential for ensuring successful adoption across the business?

Accepted Answer

Obtaining formal executive sponsorship for the initiative.. Executive sponsorship and clear ownership are foundational for any governance program.

Answer

Hiring only external consultants to manage the GRC tool.

Answer

Disabling all audit logs to improve system performance.

Answer

Purchasing the most expensive GRC module available.

Question 7

You are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?

Accepted Answer

The cloud service provider's physical security controls for the hosting data center.. The authorization boundary must include all components for which the authorizing official accepts risk, including third-party cloud services that manage the security controls.

Answer

The end-user's local home router configuration.

Answer

The public internet backbone routing protocols.

Answer

The organization's global human resources policy.

Question 8

When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)

Accepted Answer

The information types processed, stored, or transmitted by the system.. Defining the boundary requires understanding the system's operational scope, its connection points, and its data ownership.

Answer

The organizational personnel who have access to the system.

Answer

The fiscal budget allocated for hardware replacement.

Answer

The physical location of the cloud data center.

Question 9

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

Accepted Answer

Map Active Directory groups to granular GRC Security Profiles.. Mapping specific Active Directory groups to GRC-defined 'Role-Based Access Control' (RBAC) profiles ensures that auditor access is limited to read-only views of evidence repositories.

Answer

Assign Global Administrator rights to the lead auditor.

Answer

Enable Single Sign-On (SSO) for all users globally.

Answer

Configure a shared service account for all audit activities.

Question 10

A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?

Accepted Answer

The 'User Permission' or 'Access Control' report.. Access Control or 'User Permission' reports are specifically designed to audit GRC platform access levels.

Answer

The System Performance Report.

Answer

The Risk Trend Analysis Report.

Answer

The Audit Finding Closure Report.

Question 11

What is the primary benefit of mapping regulatory requirements to internal controls in a GRC platform?

Accepted Answer

It reduces the burden of redundant testing for multiple frameworks.. Mapping eliminates redundant testing by showing how one control satisfies multiple regulatory mandates.

Answer

It reduces the number of employees required to manage the platform.

Answer

It makes the GRC platform look more professional.

Answer

It hides the compliance gaps from external auditors.

Question 12

The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?

Accepted Answer

Set an 'Expiration Date' and 'Workflow Reminder' on the policy record.. Setting a 'Review Date' field and using 'Workflow Reminders' automates the annual policy lifecycle.

Answer

Block access to the policy after 365 days.

Answer

Create a recurring meeting for the policy owner.

Answer

Require the administrator to manually reset the policy status.

Question 13

Which THREE of the following roles are typically involved in a GRC Steering Committee?

Accepted Answer

General Counsel.. Senior leadership roles like CISO, CRO, and General Counsel provide the necessary oversight for GRC.

Answer

The lead graphic designer.

Answer

The office maintenance supervisor.

Question 14

Which THREE of the following are necessary to establish a 'Continuous Control Monitoring' (CCM) program?

Accepted Answer

Automated notification workflows for failed controls.. CCM requires automated data feeds, defined thresholds, and notification mechanisms to be effective.

Answer

A physical audit team performing site visits daily.

Answer

A manual spreadsheet that is updated every quarter.

Question 15

Which TWO statements regarding FIPS 199 'High Water Mark' are accurate? (Select TWO)

Accepted Answer

The overall system categorization is the highest of the three individual security objectives.. The high water mark ensures that the entire system is protected at the level of its most sensitive component.

Answer

The high water mark only applies to federal systems with 'High' impact data.

Answer

Categorization must be performed by averaging the impact scores.

Answer

The high water mark is only determined by availability.

Question 16

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

Accepted Answer

Moderate. FIPS 199 defines the high-water mark based on the highest value among the three security objectives.

Answer

Not Categorized

Answer

Low

Answer

High

Question 17

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

Accepted Answer

Implementing consistent security controls across all boundary nodes regardless of location.. Centralizing the security management and standardizing controls across locations ensures uniform protection.

Answer

Categorizing each site as a separate information system.

Answer

Excluding remote offices from the authorization boundary.

Answer

Allowing each site to define its own unique security policy.

Question 18

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Accepted Answer

Monitor. The 'Monitor' step is the final phase of the RMF, focused on ongoing compliance.

Answer

Authorize

Answer

Select

Answer

Categorize

Question 19

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

Accepted Answer

Define the boundary based on the specific services and data flows owned by the sub-system.. Clearly defining trust zones and interface points prevents the boundary from expanding unnecessarily.

Answer

Include only the database tier.

Answer

Include the entire enterprise infrastructure to be safe.

Answer

Include all internal network segments regardless of use.

Question 20

In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?

Accepted Answer

Developing treatment plans for risks exceeding appetite.. Risk identification and treatment are the primary functions of risk management within GRC.

Answer

Designing new corporate office layouts.

Answer

Writing marketing brochures for the company.

Answer

Resetting all employee passwords every 30 days.