CGRC Practice Test 2 — 30 Questions

Question 1

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement and document compensating controls.. When a patch cannot be applied, compensating controls must be implemented and documented to mitigate the risk.

Answer

Request an exemption from the CISO without providing documentation.

Answer

Ignore the vulnerability as it cannot be fixed.

Answer

Disconnect the server from the network permanently.

Question 2

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 3

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 4

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. Publisher rules in AppLocker allow for the most granular control based on digital certificates.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 5

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. A compensating control is an alternate measure used to satisfy the requirement of a security control that cannot be implemented as stated.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 6

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

Accepted Answer

Target state, Current state, Gap identification. You must define the target (what good looks like), determine the current state (as-is), and then identify the delta (gap).

Answer

Current state, Target state, Gap identification

Answer

Gap identification, Target state, Current state

Answer

Current state, Gap identification, Target state

Question 7

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. Execution involves interviewing staff, reviewing documentation, and testing technical configuration settings.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 8

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. A formal change control process is required to ensure that changes are tested, documented, and approved.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 9

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Patch management requires testing to prevent outages and a deployment strategy to ensure coverage.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 10

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Accepted Answer

To define specific parameters for control implementation.. Assignment statements provide a mechanism to tailor the control by specifying organization-defined values or frequencies.

Answer

To categorize the control by its priority level.

Answer

To link the control to a regulatory requirement.

Answer

To assign the control to a specific system administrator.

Question 11

What is the primary function of an assessor's 'working papers'?

Accepted Answer

To document evidence and support the findings. Working papers document the evidence gathered, testing performed, and observations made, which serve as the foundation for the final assessment report.

Answer

To list the audit team members

Answer

To submit to the regulator

Answer

To replace the need for an audit

Question 12

Which TWO of the following are recommended practices for managing firewall rules?

Accepted Answer

Documenting the business justification for each rule. Regular review and documentation of rules help maintain a secure and clean firewall configuration.

Answer

Disabling logging for all rules to improve performance

Answer

Applying rules in random order

Answer

Using 'Any' as the destination for all rules

Question 13

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. Conditions attached to an ATO represent known risks that must be tracked and mitigated through the POA&M to transition to full, unconditioned authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 14

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Accepted Answer

Create a certificate of destruction for audit purposes.. Sanitizing the media, updating the inventory, and documenting the destruction process are all critical steps for classified systems.

Answer

Move the system to a secure storage area for indefinite holding.

Answer

Reformat the drive for reuse in a non-sensitive project.

Question 15

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Disabled account management is a critical detective and preventive control to ensure that only authorized, active users have access.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication

Question 16

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Accepted Answer

Target completion date. A POA&M must define the vulnerability/weakness and the specific milestone/date for remediation.

Answer

Personnel salary data

Answer

Historical audit logs

Answer

Software licensing keys

Question 17

Which TWO methods are commonly used to gather assessment evidence?

Accepted Answer

Interview. Assessment methods commonly include observing processes and interviewing personnel to understand implementation.

Answer

Budget approval

Answer

Marketing collateral review

Answer

System retirement

Question 18

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

Accepted Answer

Exclude known safe processes and signers. Tuning policies to exclude known safe administrative scripts and software reduces noise while maintaining core monitoring.

Answer

Only monitor server logs

Answer

Set to 'Block All' mode

Answer

Disable real-time scanning

Question 19

You are auditing a backup solution. Which metric is most critical for the Availability audit?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) dictates how quickly a system must be available after an outage, which is the primary metric for availability testing.

Answer

Encryption key rotation

Answer

Tape rotation schedule

Answer

Backup storage capacity

Question 20

You are configuring a SIEM (e.g., Splunk) to monitor failed login attempts. What is the most efficient way to reduce noise while maintaining audit integrity?

Accepted Answer

Apply filters on the Universal Forwarder. Filtering at the forwarder level prevents unnecessary ingestion of logs, saving storage and improving performance.

Answer

Disable logging on the domain controller

Answer

Delete logs after ingestion

Answer

Increase log rotation frequency