CGRC Practice Test 5 — 25 Questions

Question 1

You are an auditor evaluating the results of a security assessment. The assessment team identified a high-risk finding related to inadequate logging and monitoring. The system owner disagrees with the finding and argues that compensating controls mitigate the risk. As the auditor, what should you do NEXT to resolve this disagreement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request additional evidence from the system owner to validate the compensating controls. When a system owner disputes a finding, the auditor should gather additional evidence to evaluate the claim. Requesting evidence of compensating controls allows the auditor to make an informed, objective decision. This step supports a collaborative resolution and ensures the assessment remains evidence-based. Escalation or removal of the finding without validation is premature.

Answer

Document the disagreement in the report and let the system owner provide a written rebuttal

Answer

Immediately escalate the disagreement to the authorizing official for a final decision

Answer

Accept the system owner's assertion and remove the finding from the report

Question 2

A GRC team is defining the scope of its governance program. The organization wants to ensure that all relevant stakeholders are aware of their roles and responsibilities regarding risk and compliance. Which artifact is most appropriate to document and communicate this information?

Accepted Answer

A RACI matrix that maps GRC activities to roles across the organization.. A RACI matrix is specifically designed to clarify roles and responsibilities for activities and decisions. By mapping GRC activities to roles, it ensures stakeholders know what is expected of them, reducing confusion and enhancing accountability. Other artifacts serve different purposes, such as risk documentation, scheduling, or continuity planning, and do not address role clarity.

Answer

A risk register that lists all identified risks and their owners.

Answer

A compliance calendar that schedules regulatory reporting deadlines.

Answer

A business impact analysis (BIA) that identifies critical business processes.

Question 3

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

Accepted Answer

Rules of Engagement. The Rules of Engagement (RoE) is the formal document that defines the scope, boundaries, timing, and authorized activities of a security assessment, and it is signed by both the assessor and the target organization before testing begins. It establishes what systems may be tested, what techniques are permitted, and the points of contact, making it the primary agreement governing the audit.

Answer

Interconnection Security Agreement

Answer

Security Assessment Plan

Answer

Risk Assessment Report

Answer

System Security Plan

Question 4

A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine which controls can be inherited from the cloud provider. Which TWO of the following are appropriate actions to take during this process? (Choose two.)

Accepted Answer

Review the cloud provider's SOC 2 report to identify controls that are implemented and can be inherited.. The correct actions are to review the cloud provider's SOC 2 report to identify inheritable controls and to document inherited controls in the system security plan. These steps ensure that the organization accurately identifies and records which controls are provided by the cloud provider, avoiding duplication and ensuring accountability.

Answer

Conduct a penetration test of the cloud provider's infrastructure to verify inherited controls.

Answer

Assume all controls are inherited because the cloud provider is responsible for security.

Answer

Implement all controls from the baseline regardless of the provider's offerings.

Question 5

If a control is determined to be 'system-specific', what does that mean?

Accepted Answer

It is implemented by the system owner for that system only.. A system-specific control is one that is implemented by the system owner and applies only to that particular system, as opposed to common controls shared across the organization or hybrid controls that combine both. This designation is part of the NIST RMF control inheritance model, where controls are categorized as common, system-specific, or hybrid. The system owner bears responsibility for implementing and documenting system-specific controls in the system security plan.

Answer

It is a hybrid control.

Answer

It must be implemented by the vendor.

Answer

It is inherited from the enterprise.

Question 6

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

Accepted Answer

The POA&M lists items with no completion dates. An ineffective POA&M process is indicated by listing items with no completion dates, because POA&Ms require milestones and estimated completion dates to track remediation progress. Without dates, there is no accountability or timeline for resolving weaknesses, which violates FedRAMP and NIST SP 800-37 requirements. The other options describe positive attributes of an effective POA&M process.

Answer

The POA&M contains vulnerabilities found by automated scans

Answer

The POA&M is stored in a secure repository

Answer

The POA&M is reviewed by the CISO

Question 7

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Accepted Answer

Implement and document compensating controls.. When a required patch cannot be applied due to compatibility issues with a critical legacy application, the correct compliance management action is to implement and document compensating controls. Compensating controls are alternative safeguards that provide equivalent or comparable protection to the original requirement, allowing the organization to manage the residual risk while maintaining compliance. This approach is endorsed by frameworks like NIST SP 800-53 and is a standard part of risk management.

Answer

Request an exemption from the CISO without providing documentation.

Answer

Ignore the vulnerability as it cannot be fixed.

Answer

Disconnect the server from the network permanently.

Question 8

When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?

Accepted Answer

To provide a 'Single Source of Truth' for audit and compliance data.. A System of Record (SoR) in a GRC program establishes a single authoritative source for compliance, audit, and risk data, eliminating conflicting versions across departments. This 'Single Source of Truth' ensures consistency, traceability, and reliable reporting for audits and decision-making. It is foundational to effective GRC because it prevents data silos and reconciliation errors.

Answer

To allow every department to have its own data repository.

Answer

To minimize the cost of software licenses.

Answer

To make the GRC platform run faster.

Question 9

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

Accepted Answer

Assess Security Controls. NIST SP 800-53A defines the security control assessment process as: Prepare for Assessment, Assess Security Controls, Analyze Security Assessment Results, and Document/Report. Immediately after 'Prepare for Assessment' (which includes developing the assessment plan, selecting controls, and gathering artifacts), the assessor executes the 'Assess Security Controls' phase — collecting evidence through examine, interview, and test methods.

Answer

Analyze Security Assessment Results

Answer

Develop the Plan of Action and Milestones (POA&M)

Answer

Authorize the Information System

Question 10

An Information System Security Officer (ISSO) is reviewing the Security Assessment Report (SAR) for a system that is undergoing initial authorization. The SAR indicates that a high-impact system has a control that is only partially implemented. What should the ISSO recommend to the Authorizing Official (AO)?

Accepted Answer

Assess whether compensating controls or other mitigations reduce the risk to an acceptable level, and present options to the AO.. For a high-impact system with a partially implemented control, the ISSO should analyze whether compensating controls or other mitigations reduce the risk to an acceptable level. The ISSO then presents options to the Authorizing Official, who makes the final authorization decision. This approach ensures the AO has a complete understanding of the risk and can make an informed choice, rather than recommending immediate denial or interim authorization without analysis.

Answer

Direct the system owner to accept the risk and proceed with operation, documenting the decision in the SSP.

Answer

Recommend denial of authorization until the control is fully implemented and reassessed.

Answer

Issue an interim Authorization to Operate (IATO) with a POA&M to remediate the control within 180 days.

Question 11

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

Accepted Answer

Failure to perform annual control testing as part of continuous monitoring.. Under FISMA and NIST SP 800-53 / SP 800-137 continuous monitoring guidance, security controls must be assessed at a frequency sufficient to support ongoing authorization — commonly at least annually for most controls. Assessment results that are three years old indicate the organization failed to perform the required recurring control testing that underpins continuous monitoring and ongoing authorization.

Answer

The organization failed to report the breach to the US-CERT.

Answer

The system failed to undergo a full re-accreditation.

Answer

The System Security Plan (SSP) was not updated in the FISMA database.

Question 12

An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?

Accepted Answer

The dependency of the system on the database for operational integrity.. The deciding factor for including a legacy database in an authorization boundary is whether the system depends on it for operational integrity — that is, whether the database's confidentiality, integrity, or availability directly affects the system's security posture and mission. If the application cannot function correctly or securely without the database, the database is within the boundary (or must be treated as an interconnected system with a documented interface). Physical location, hardware age, and data volume are not boundary criteria.

Answer

Whether the database is hosted in the same physical rack.

Answer

The age of the hardware.

Answer

The amount of data stored.

Question 13

A security architect is defining the authorization boundary for a new cloud-hosted financial system. The system uses a managed database service and a serverless compute service from the cloud provider. The provider's infrastructure (hypervisor, physical network, data center) is outside the boundary. According to NIST SP 800-37, which statement best describes how the shared responsibility model affects the authorization boundary?

Accepted Answer

The authorization boundary includes only the organization's account, its data, and the configured services, while the provider's underlying infrastructure is inherited and assessed separately.. In cloud environments, the authorization boundary should encompass the components the organization configures and operates, such as its account, data, and service configurations. The provider's infrastructure is assessed separately and inherited. This aligns with NIST SP 800-37's guidance on defining boundaries and leveraging shared responsibility to avoid unnecessary duplication of assessments.

Answer

The authorization boundary must be expanded to include all cloud provider data centers that host the system, regardless of ownership.

Answer

The authorization boundary must include the provider's hypervisor and physical network because they process the organization's data.

Answer

The authorization boundary is irrelevant in cloud environments because the provider assumes all security responsibilities.

Question 14

You are a security consultant helping a financial institution select controls for a new mobile banking application. The institution must comply with PCI DSS and NIST SP 800-53. During control selection, you identify that a NIST SP 800-53 control has a parameter that must be defined, such as the frequency of reviews. What should you do to ensure the control is properly implemented?

Accepted Answer

Assign a value to the parameter based on organizational risk tolerance and document it in the security plan.. Control parameters, also called assignment statements, require organizations to define specific values such as review frequency or timeout periods. Assigning a value based on risk tolerance and documenting it in the security plan ensures the control is tailored and assessable. This is a required part of the RMF and NIST SP 800-53 tailoring process, and it helps demonstrate compliance with both NIST and PCI DSS requirements.

Answer

Remove the control entirely because it contains a parameter, as parameters indicate the control is not applicable.

Answer

Leave the parameter blank so that the control can be interpreted flexibly during assessment.

Answer

Use the default value provided in NIST SP 800-53 without modification, because defaults are always acceptable.

Question 15

Which standard provides the framework for conducting information security audits?

Accepted Answer

ISO/IEC 27007. ISO/IEC 27007 provides guidelines for auditing information security management systems (ISMS), specifically supporting ISO/IEC 27001 audits by detailing audit program management, auditor competence, and audit conduct. It is the standard that frameworks the conduct of information security audits, making it the correct answer.

Answer

NIST SP 800-37

Answer

PCI DSS

Answer

ISO/IEC 27001

Question 16

You are tailoring the NIST SP 800-53 Rev. 5 Moderate baseline for a system that will be deployed in a tactical edge environment with limited network connectivity. The system processes sensitive but unclassified information. Which TWO of the following actions are appropriate when scoping and tailoring controls for this environment? (Choose two.)

Accepted Answer

Identify controls that rely on continuous network connectivity and consider compensating controls that operate offline.. The appropriate actions are to identify controls that require network connectivity and implement compensating controls, and to apply an overlay for wireless and ruggedized hardware. These steps tailor the baseline to the tactical edge environment while maintaining necessary security. Removing incident response or contingency controls, or arbitrarily raising the impact level, are not valid tailoring actions.

Answer

Increase the baseline to High impact to compensate for the lack of connectivity.

Answer

Remove all controls related to incident response because the environment is disconnected from the enterprise network.

Answer

Mark the contingency planning controls as Not Applicable because the system is not connected to primary data centers.

Question 17

A financial services firm is expanding its GRC program and needs to establish a formal governance structure. The Chief Information Security Officer (CISO) has been asked to define the roles and responsibilities for overseeing risk decisions across business units. Which of the following is the MOST appropriate first step to ensure accountability and alignment with organizational objectives?

Accepted Answer

Create a Risk Management Charter that defines the governance structure, roles, and decision-making authority.. Establishing a formal governance structure begins with a Risk Management Charter, which defines the program's authority, scope, roles, and decision-making processes. This document ensures that all subsequent activities—such as risk assessments, tool implementation, and register creation—are aligned with organizational objectives and have clear accountability. Without this foundation, GRC efforts risk being fragmented and ineffective.

Answer

Develop a risk register that captures all identified risks and assigns risk owners.

Answer

Conduct a risk assessment workshop with business unit leaders to identify top risks.

Answer

Implement a GRC tool to automate risk assessments and reporting across all business units.

Question 18

A financial services firm is implementing a GRC program to satisfy multiple regulatory frameworks (e.g., GDPR, SOX, PCI DSS). The compliance team currently maps controls separately for each regulation, resulting in duplicated effort and inconsistent evidence. The CISO wants to streamline by identifying common controls that satisfy multiple requirements. Which approach should the GRC practitioner recommend?

Accepted Answer

Implement a control mapping matrix that links each regulatory requirement to a unified set of internal controls, enabling reuse of evidence across frameworks.. The correct answer is to implement a control mapping matrix that links regulatory requirements to a unified set of internal controls. This enables the organization to collect evidence once and reuse it across multiple frameworks, reducing duplication and improving consistency. It is a foundational GRC practice for managing multiple regulations efficiently and is scalable as new requirements emerge.

Answer

Create separate GRC workspaces for each regulation to ensure regulatory-specific evidence is isolated and auditors cannot confuse requirements.

Answer

Outsource all compliance mapping to an external auditor who will provide a unified control set annually.

Answer

Adopt the strictest requirement from each regulation as the baseline control and apply it universally, ignoring overlaps.

Question 19

You are tailoring a NIST SP 800-53 baseline for a new system. The system owner asks you to identify the reasons why a control might be marked as 'Not Applicable' during tailoring. Which two of the following are valid reasons for marking a control as 'Not Applicable'? (Choose two.)

Accepted Answer

The control is not relevant to the system's technology or environment.. A control can be marked Not Applicable during tailoring when it is not relevant to the system's technology or environment, or when the system does not process the type of information the control protects. These are valid, risk-based justifications that must be documented. Cost, inheritance, and personal preference are not valid reasons; inheritance means the control is still applicable, and cost or preference must be addressed through risk acceptance or compensating controls.

Answer

The control is not applicable because the system owner prefers not to implement it.

Answer

The control is too expensive to implement.

Answer

The control is already implemented by a common control provider and is inherited.

Question 20

A financial services firm must comply with GLBA Safeguards Rule. The security team is implementing encryption for data at rest on a new PostgreSQL database. Which of the following is the most appropriate control to protect the data if the underlying storage media is physically stolen?

Accepted Answer

Implement full disk encryption (FDE) on the database server's volumes.. Full disk encryption is the most effective control against physical theft of storage media because it encrypts all data on the disk, including the operating system, database files, and temporary files. Database-level or file-level encryption may leave parts of the system unprotected, allowing an attacker to extract sensitive information from unencrypted areas. For GLBA compliance, FDE provides a strong safeguard for data at rest.

Answer

Apply file-level encryption to the PostgreSQL data directory.

Answer

Use column-level encryption for all sensitive fields.

Answer

Enable Transparent Data Encryption (TDE) at the database level.