CGRC Practice Test 3 — 10 Questions

Question 1

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

Accepted Answer

NIST SP 800-53B.. NIST SP 800-53B, 'Control Baselines for Information Systems and Organizations,' is the document that defines the Low, Moderate, and High security control baselines. It provides the specific control sets that correspond to each FIPS 199 impact category, serving as the starting point for tailoring in the RMF. SP 800-53B is the authoritative source for baseline selection.

Answer

NIST SP 800-53A.

Answer

FIPS 199.

Answer

NIST SP 800-37.

Question 2

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

Accepted Answer

Update the POA&M with a remediation plan. Under NIST RMF and FedRAMP processes, when an assessment identifies a High risk finding, the system owner is required to document it in the Plan of Action and Milestones (POA&M) along with a remediation plan, responsible party, and milestone dates. The POA&M is the authoritative tracking artifact for unresolved weaknesses, and High findings typically require remediation within 30 days per FedRAMP timelines. Simply accepting or deleting the finding is not permitted without formal risk acceptance by the Authorizing Official.

Answer

Delete the finding from the report

Answer

Transfer the risk to the IT staff

Answer

Accept the risk without documentation

Question 3

To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?

Accepted Answer

Automated data validation rules for input fields.. Option A is correct because automated data validation rules for input fields enforce integrity at the point of entry, rejecting malformed, out-of-range, or inconsistent values before they can corrupt the GRC system of record. Option C is correct because strict access control and user authorization policies (e.g., role-based access control with least privilege) ensure that only approved users can create or modify records, preventing unauthorized or accidental changes. Option E is correct because comprehensive audit logs of all user actions provide an immutable trail that supports accountability, traceability, and detection of tampering or unauthorized modifications. Option B is incorrect because allowing all users to edit any data at any time destroys integrity by removing authorization boundaries and enabling unauthorized changes. Option D is incorrect because disabling backups removes the ability to restore the system of record after corruption, loss, or ransomware, which is essential for maintaining integrity over time.

Answer

Allowing all users to edit any data at any time.

Answer

Disabling the backup of the GRC database.

Question 4

A security assessor is reviewing a system boundary for a high-impact system. The boundary includes a web server, an application server, and a database server, all located in the same data center. The system also uses an external identity provider for authentication. During the review, the assessor notices that the identity provider is not listed in the boundary diagram. What is the most significant risk of this omission?

Accepted Answer

The identity provider's controls will not be assessed, potentially leaving authentication vulnerabilities unaddressed.. Omitting the external identity provider from the boundary means its security controls may not be assessed or formally inherited, creating a critical gap in authentication. The Authorizing Official needs to understand all dependencies to make an informed risk decision. The most significant risk is that authentication vulnerabilities remain unaddressed, potentially compromising the entire system.

Answer

The boundary diagram will be rejected by the Authorizing Official for formatting errors.

Answer

The system will be automatically categorized as low-impact due to the missing component.

Answer

The external identity provider will be required to undergo a separate full authorization, delaying the project.

Question 5

During a security assessment of a cloud-based system, the Security Control Assessor (SCA) determines that a cryptographic module used for data at rest does not meet FIPS 140-2 validation requirements. The system owner argues that the module is provided by the cloud service provider (CSP) and is therefore outside their control. As the ISSO, what should you do first to address this finding?

Accepted Answer

Document the finding in the Plan of Action and Milestones (POA&M) and consult with the CSP to obtain evidence of FIPS 140-2 validation or an alternative compliant module.. The ISSO should document the finding in the POA&M and collaborate with the CSP to obtain evidence of FIPS 140-2 validation or identify a compliant alternative. This approach aligns with the shared responsibility model and ensures the finding is tracked for remediation. The system owner remains accountable for control compliance even when a service is CSP-managed, and the AO will ultimately decide on risk acceptance.

Answer

Accept the risk because the CSP is responsible for the cryptographic module and the system owner has no control over it.

Answer

Immediately remove the system from the authorization boundary because the cryptographic module is non-compliant.

Answer

Escalate the finding directly to the Authorizing Official (AO) without taking any preliminary action.

Question 6

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

Accepted Answer

Adjust the 'Assessment Trigger' logic based on the 'Criticality' score.. The requirement is to trigger Control Self-Assessments automatically based on control criticality. This is achieved by modifying the 'Assessment Trigger' logic to use the 'Criticality' score as a condition. This ensures that high-criticality controls are assessed more frequently or automatically, aligning with risk-based GRC automation. The other options do not address the trigger mechanism or would undermine the self-assessment process.

Answer

Change the global password policy for GRC users.

Answer

Require the GRC admin to manually assign tasks to users.

Answer

Disable the self-assessment feature to force all audits to be external.

Question 7

A system owner is preparing to accept a risk for a low-impact information system. The system has a minor weakness that cannot be remediated in the next 30 days. Which document must the system owner sign to formally accept the risk?

Accepted Answer

Risk acceptance memo or letter. A risk acceptance memo or letter is the formal document used by a system owner to accept a specific risk. It details the risk, its potential impact, and the rationale for acceptance, and requires the system owner's signature. Other documents like the SSP, POA&M, and ATO serve different purposes in the authorization process and do not fulfill the role of explicit risk acceptance.

Answer

Authorization to Operate (ATO)

Answer

System Security Plan (SSP)

Answer

Plan of Action and Milestones (POA&M)

Question 8

An organization is implementing a continuous monitoring program for its information systems in accordance with NIST SP 800-137. Which TWO activities are essential components of this program? (Choose two.)

Accepted Answer

Performing ongoing security control assessments. Continuous monitoring per NIST SP 800-137 requires ongoing security control assessments to verify effectiveness and regular reporting of security status to organizational officials. These activities ensure that the system's security posture is continuously understood and that risk is managed proactively. Other activities like training and categorization are important but are not core continuous monitoring activities.

Answer

Conducting annual security awareness training for all users

Answer

Conducting a full Security Assessment Report (SAR) only at the end of the authorization cycle

Answer

Documenting the system's security categorization

Question 9

You are the Information System Security Officer (ISSO) for a federal system undergoing a periodic security control assessment. During the assessment, the assessor identifies that a high-impact security control is only partially implemented. According to NIST SP 800-37 Rev. 2, what should be your immediate next step?

Accepted Answer

Document the partial implementation as a finding in the Security Assessment Report (SAR) and develop a Plan of Action and Milestones (POA&M) to remediate the control.. According to NIST SP 800-37 Rev. 2, during the Monitor step, assessment findings must be documented in the SAR and addressed through a POA&M. A partially implemented control is a finding that requires remediation planning. The ISSO's role is to ensure proper documentation and follow-up, not to unilaterally suspend operations or misclassify the control. This approach maintains the integrity of the authorization process.

Answer

Update the System Security Plan (SSP) to mark the control as 'Not Applicable' (NA) to avoid a finding.

Answer

Request an exception from the Authorizing Official (AO) to accept the partial implementation without further action.

Answer

Immediately suspend system operations until the control is fully implemented.

Question 10

Which TWO factors contribute to the 'scope' of an information security audit?

Accepted Answer

Network boundaries. The scope of an information security audit is defined by what will be examined, and option C (Network boundaries) is correct because the audit perimeter—such as internal LAN segments, DMZs, VPN entry points, and internet-facing subnets—determines which systems, traffic flows, and controls fall inside or outside the assessment. Option E (System components and assets) is also correct because the inventory of hardware, software, applications, databases, and data assets directly establishes the breadth of the audit and the controls to be tested. Options A (External stock prices) and B (Competitor market analysis) are financial and competitive-intelligence concerns unrelated to defining an audit's technical scope, and option D (Employee home addresses) is personal data that does not determine which systems or boundaries the audit covers.

Answer

External stock prices

Answer

Competitor market analysis

Answer

Employee home addresses