CGRC Practice Test 26 — 15 Questions

Question 1

A global manufacturing firm is maturing its GRC program. The GRC director wants a governance mechanism that both (1) translates the organization's risk appetite into measurable boundaries for business units and (2) provides a repeatable way to escalate issues when those boundaries are breached. Which two GRC components best deliver these outcomes? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A defined risk escalation workflow with thresholds, owners, and response timeframes documented in the GRC platform.. Risk appetite becomes actionable only when paired with quantified tolerance statements approved at the executive level and an escalation workflow that defines thresholds, owners, and timeframes. Together they convert a philosophical appetite statement into measurable boundaries and a repeatable response when those boundaries are exceeded. Registers, self-assessments, and business impact analyses inform the program but do not perform these two governance functions.

Answer

A control self-assessment questionnaire distributed annually to all control owners across every business unit.

Answer

A business impact analysis that maps critical processes to recovery time objectives for resilience planning.

Answer

A risk register that records identified risks, owners, and inherent likelihood and impact scores.

Question 2

A federal agency is deploying a new cloud-based case management system. The system consists of a web front end, an application server, and a database, all hosted in a single virtual private cloud (VPC). The system owner must define the authorization boundary for the system. Which of the following best describes the authorization boundary in this context?

Accepted Answer

The authorization boundary includes all components of the system within the VPC, including the web front end, application server, and database, as well as the supporting infrastructure managed by the cloud provider.. The authorization boundary must include all components that comprise the system, including those in a cloud environment. For a cloud-based system, the boundary typically encompasses the virtual private cloud resources and the underlying infrastructure provided by the cloud service provider, often addressed through a shared responsibility model. This ensures that all parts processing, storing, or transmitting data are within the scope of the authorization.

Answer

The authorization boundary includes the agency's entire network infrastructure, including all other systems and applications that share the same network.

Answer

The authorization boundary includes only the database, because it stores the sensitive case data, while the web and application servers are considered external interfaces.

Answer

The authorization boundary includes only the physical servers within the agency's data center that host the virtual machines.

Question 3

You are a security architect for a federal agency. You are selecting controls for a new high-impact system that processes sensitive personnel data. During the initial selection process, you determine that a specific NIST SP 800-53 control is not applicable because the system does not use wireless networking. According to NIST guidance, what is the most appropriate action?

Accepted Answer

Document the control as not applicable in the system security plan and provide a rationale for its exclusion.. When a control is not applicable, the correct action is to document the decision and rationale in the system security plan. This maintains an accurate record for the authorization process and ensures that the tailoring decision is transparent. Removing without documentation, implementing unnecessarily, or replacing with a different control are not consistent with NIST SP 800-53 tailoring guidance.

Answer

Replace the control with a compensating control from a different family to maintain the baseline count.

Answer

Remove the control from the baseline without any documentation because it is not relevant to the system.

Answer

Implement the control anyway to avoid any potential compliance issues.

Question 4

During a security control assessment of a U.S. federal information system, the assessment team must verify that the system's boundary protection controls meet the requirements of NIST SP 800-53 Rev. 5. The team has already collected the system security plan and the most recent security assessment report. Which action should the team take NEXT to obtain independent evidence of the implemented controls?

Accepted Answer

Examine firewall rule sets, router configurations, and network architecture diagrams to validate the boundary protection implementation.. Independent evidence of implemented controls comes from examining actual system artifacts such as firewall rules, router configurations, and network diagrams. These provide direct technical validation that boundary protection is in place and operating as intended. Documentation like the system security plan or training records is self-reported or unrelated, and interviews alone are insufficient without corroboration.

Answer

Review the organization's security awareness training records to confirm that staff understand boundary protection policies.

Answer

Review the system security plan to confirm that boundary protection controls are documented.

Answer

Interview the system administrator about how boundary protection is configured and rely on their verbal description.

Question 5

A financial services firm is implementing controls for a new mobile banking application that processes customers' personally identifiable information. The GRC analyst must select a control that provides strong confidentiality for data at rest on the mobile device and allows remote verification that the device has not been rooted or jailbroken. Which control BEST meets these requirements?

Accepted Answer

Full-disk encryption with a key stored in the device's secure enclave and remote attestation of device integrity.. The scenario requires both strong confidentiality for data at rest and remote verification of device integrity. Full-disk encryption with hardware-backed key storage ensures that stored PII remains confidential even if the device is compromised. Remote attestation provides the server with cryptographic proof of the device's integrity state, detecting rooting or jailbreaking. Together, these controls directly address the stated requirements.

Answer

Transport Layer Security (TLS) pinning for all network communications and code obfuscation of the application binary.

Answer

Containerization of the application with runtime application self-protection (RASP) and periodic vulnerability scans.

Answer

Mandatory access control (MAC) enforced by the mobile OS and remote wipe capability.

Question 6

A multinational corporation is implementing controls to protect sensitive intellectual property stored in a hybrid cloud environment. The GRC team must ensure that data remains confidential and integrity-protected both at rest and in use within a trusted execution environment (TEE). Which TWO controls are MOST appropriate to achieve these objectives? (Choose two.)

Accepted Answer

Confidential computing with hardware-based memory encryption and remote attestation of the TEE.. Confidential computing and secure enclaves with sealed storage and measurement both provide hardware-based protection for data in use, including memory encryption and integrity measurement. Remote attestation leverages these features to verify the TEE. The other options address data at rest or in transit, or are not practical for general processing, so they do not fulfill the in-use confidentiality and integrity objectives.

Answer

Tokenization of all sensitive data fields and format-preserving encryption for database columns.

Answer

Homomorphic encryption for all data processing operations and key management using a hardware security module (HSM).

Answer

Mandatory access control (MAC) with SELinux policies and full-disk encryption on all cloud instances.

Question 7

A federal agency is initiating the authorization process for a new information system. The system owner is working with the information system security officer (ISSO) to define the system boundary. Which of the following best describes the purpose of defining the system boundary?

Accepted Answer

To establish the scope of the system for the purpose of applying security controls and assessing risk.. The system boundary defines the scope of the system for security control implementation and risk assessment. It delineates what components, processes, and people are part of the system, ensuring that the authorization covers all necessary elements. This scoping is critical for applying the appropriate security controls, assessing risk accurately, and making informed authorization decisions.

Answer

To identify the physical location of all hardware components to ensure they are within the agency's facilities.

Answer

To determine the budget required for securing the system by counting the number of components.

Answer

To list all users who will have access to the system for the purpose of background checks.

Question 8

You are a security manager for a federal agency. You are selecting controls for a new information system using NIST SP 800-53 Rev. 5. You need to determine which controls are required based on the system's impact level. Which NIST publication provides the control baselines for low, moderate, and high-impact systems?

Accepted Answer

NIST SP 800-53B. NIST SP 800-53B provides the control baselines for low, moderate, and high-impact systems. It is a companion to NIST SP 800-53, which contains the control catalog. The other publications listed serve different purposes: SP 800-37 describes the RMF, SP 800-53 is the control catalog, and SP 800-30 covers risk assessment. Therefore, SP 800-53B is the correct source for baseline controls.

Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-37

Question 9

A retail company has just hired its first GRC analyst. The analyst is asked to explain why the organization needs a formal governance framework rather than relying on the informal practices each department currently uses. Which statement best describes the primary purpose of GRC governance in this context?

Accepted Answer

It provides a structured way to align risk and compliance activities with business objectives and to assign clear accountability.. The core purpose of GRC governance is to align risk and compliance efforts with business objectives while establishing clear accountability across the enterprise. It replaces fragmented informal practices with a consistent, structured approach that leadership can oversee. It does not guarantee zero incidents, abolish tailored policies, or concentrate all decisions in one team, since those outcomes would undermine rather than strengthen governance.

Answer

It centralizes all decision-making authority in the GRC team so departments no longer make risk decisions.

Answer

It replaces the need for department-specific policies with a single universal control set applied identically everywhere.

Answer

It guarantees that the organization will not experience a security incident or regulatory penalty.

Question 10

A GRC analyst is supporting a system that has been authorized to operate. The continuous monitoring program includes automated configuration scans, annual control assessments, and a plan of action and milestones (POA&M). During a quarterly review, the analyst finds that several POA&M items have exceeded their original completion dates. The system owner wants to know which actions are required to maintain compliance. (Choose two.)

Accepted Answer

Report the overdue items to the authorizing official and reassess the risk to determine if the authorization remains valid.. Overdue POA&M items must be promptly documented with revised milestones and reported to the AO, along with a reassessment of risk. These actions keep the authorization package current and enable the AO to make informed risk decisions. Ignoring, deleting, or deferring the items undermines continuous monitoring and compliance.

Answer

Immediately suspend the system's operations until all overdue POA&M items are resolved.

Answer

Wait until the next annual assessment to address the overdue items, as quarterly reviews are not part of the formal authorization process.

Answer

Remove the overdue items from the POA&M to avoid negative audit findings and maintain a clean compliance record.

Question 11

An organization is preparing for an independent security assessment of its cloud-hosted customer relationship management (CRM) system. The assessment will evaluate compliance with the organization's security policies and applicable regulations. Which document should the assessor request FIRST to understand the system's boundary, components, and data flows?

Accepted Answer

The system security plan (SSP).. The system security plan is the primary document that defines the system boundary, components, data flows, and control implementation. It gives the assessor the necessary context to scope the assessment and select appropriate procedures. Vulnerability scan reports, business continuity plans, and incident response plans are important but do not provide the comprehensive system overview required to begin an assessment.

Answer

The incident response plan (IRP).

Answer

The business continuity plan (BCP).

Answer

The most recent vulnerability scan report.

Question 12

You are the Information System Security Officer (ISSO) for a federal system that has just completed a security control assessment. The assessor identified several findings, and you are now preparing the Plan of Action and Milestones (POA&M). The system owner asks you to explain the primary purpose of the POA&M in the context of continuous monitoring. What should you say?

Accepted Answer

The POA&M provides a formal record of identified weaknesses, planned remediation actions, and milestones to track progress and inform risk-based decisions.. The POA&M's core purpose is to document known weaknesses, the planned remediation actions, and milestones. It provides a structured way to track progress and gives the Authorizing Official ongoing visibility into residual risk. It is not used for categorization, authorization, or as the assessment report. In continuous monitoring, the POA&M is updated as new findings arise and old ones are resolved.

Answer

The POA&M is used to document the security categorization of the system and the rationale for the selected security controls.

Answer

The POA&M is the document that grants the Authority to Operate (ATO) and defines the terms and conditions of authorization.

Answer

The POA&M is used to record the results of security control assessments and serves as the final report of the assessment team.

Question 13

You are the Information System Security Officer (ISSO) for a system undergoing a security control assessment. The assessor has completed testing and provided results. As part of the compliance determination process, you must review the assessment findings and determine the overall compliance status. Which TWO factors are most critical when determining whether a security control is compliant? (Choose two.)

Accepted Answer

The control is implemented as specified in the security plan and produces the expected outcome.. Compliance determination hinges on whether the control is implemented as specified and produces the intended outcome, and whether that implementation is accurately documented in the SSP. Independent assessment recency, baseline tailoring, and budget considerations do not directly determine compliance. The assessor's findings must be evaluated against these two critical factors to conclude if a control is compliant.

Answer

The control has been assessed by an independent assessor within the past three years.

Answer

The control's cost of implementation is within the allocated budget for the system.

Answer

The control is listed in the organization's security control baseline without any tailoring.

Question 14

A federal system has received an authorization to operate (ATO) with a continuous monitoring strategy that requires monthly vulnerability scans and annual security assessments. Six months into the authorization, the system owner replaces the primary database server with a newer model running a different operating system version. The security control baseline remains the same. As the GRC analyst supporting the ongoing authorization, what is the MOST appropriate action to maintain compliance?

Accepted Answer

Treat the change as a significant change, reassess the affected controls, and update the security plan and authorization package before the next annual assessment.. A significant change, such as replacing a server with a different OS, must be assessed promptly to maintain the authorization. Updating the security plan and reassessing affected controls ensures the AO's risk decision remains valid. Deferring action or overreacting with a full reauthorization both miss the balanced, risk-based approach required by the RMF.

Answer

Do nothing because the security control baseline remains the same and the ATO is still valid until the next annual assessment.

Answer

Immediately revoke the ATO and require a full reauthorization from scratch because any hardware change invalidates the existing authorization.

Answer

Wait for the next scheduled annual assessment to report the change, since continuous monitoring already covers all modifications through monthly scans.

Question 15

A software development company is implementing controls for its CI/CD pipeline. The GRC analyst must ensure that only approved and unaltered code is deployed to production. Which control BEST achieves this objective?

Accepted Answer

Code signing of build artifacts with verification before deployment.. Code signing provides cryptographic proof that the build artifact was produced by a trusted source and has not been modified. When the deployment pipeline verifies the signature, it ensures that only approved and unaltered code is deployed. Other controls like code reviews, SAST, and RBAC are important but do not provide the same end-to-end integrity assurance for the deployed artifact.

Answer

Mandatory code reviews by at least two senior developers before merge.

Answer

Automated static application security testing (SAST) on every commit.

Answer

Role-based access control (RBAC) restricting who can approve pull requests.