CGRC Practice Test 3 — 30 Questions

Question 1

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement is the process of adjusting the implementation of a control to be more specific to the technology or mission.

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 2

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Accepted Answer

Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0. Security groups are stateful; allowing inbound traffic automatically allows the return traffic, and the default is to deny all other traffic.

Answer

Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0

Answer

Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0

Answer

Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32

Question 3

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A Bastion Host with MFA ensures that access to production is controlled, logged, and authenticated securely.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 4

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Accepted Answer

Use an established 'Data Connector' or 'API Integration' module.. Using pre-built API connectors or 'Data Integrators' provided by the GRC platform is the standard way to ingest external security data.

Answer

Build a custom script to write directly to the GRC database tables.

Answer

Manually export and import CSV files every hour.

Answer

Have the CSPM tool email screenshots of security alerts to the GRC team.

Question 5

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. A 'Scheduled Assessment' or 'Workflow Trigger' based on 'Vendor Criticality' ensures compliance with due diligence timelines.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 6

What document provides the most granular guidance on tailoring security controls for federal systems?

Accepted Answer

NIST SP 800-53.. NIST SP 800-53, specifically the tailoring guidance section, provides the framework for modifying baselines.

Answer

FIPS 200.

Answer

NIST SP 800-37.

Answer

CNSSI 1253.

Question 7

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Accepted Answer

It provides a standardized set of controls for a specific technology stack.. Overlays are pre-defined sets of controls that address specific environments, technologies, or missions, ensuring consistent security posture.

Answer

It replaces the need for FIPS 199 categorization.

Answer

It eliminates the need for manual tailoring.

Answer

It automatically tests the controls for compliance.

Question 8

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. An inaccurate boundary leads to 'security gaps' where assets go unmonitored or unprotected.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 9

When configuring an email security gateway (e.g., Proofpoint), which record should be added to DNS to prevent domain spoofing?

Accepted Answer

SPF. SPF, DKIM, and DMARC are the trifecta of email authentication; SPF is the most foundational DNS record for authorized senders.

Answer

CNAME

Answer

A

Answer

MX

Question 10

Which THREE of the following are components of a secure server hardening process?

Accepted Answer

Applying security patches. Disabling unnecessary services, updating software, and using minimal feature sets are key to reducing the attack surface.

Answer

Installing all available third-party software

Answer

Running the web server as the root user

Question 11

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Accepted Answer

Network architecture diagrams.. The AO needs visual, written, and logical proof of what they are authorizing.

Answer

The janitorial service contract for the building.

Answer

The organization's holiday schedule.

Question 12

Which TWO of the following are examples of physical security controls?

Accepted Answer

Security cameras. Physical controls protect the physical facility and hardware.

Answer

Host-based firewall

Answer

Strong password policy

Answer

Encryption of database tables

Question 13

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Accepted Answer

System boundary and authorization boundary. Identifying the scope and boundaries of the system is the prerequisite for developing a SAP to ensure all components under the authorization boundary are evaluated.

Answer

Security control baselines

Answer

Contingency plan testing

Answer

Risk acceptance threshold

Question 14

Which THREE categories of controls are identified in NIST SP 800-53?

Accepted Answer

Operational. NIST categorizes controls into Technical, Management, and Operational families.

Answer

Financial

Answer

Environmental

Question 15

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

Accepted Answer

Implement Separation of Duties. Separation of duties ensures no single administrator has total control over all aspects, minimizing risk.

Answer

Disable all auditing

Answer

Store passwords in plain text

Answer

Use a single shared account

Question 16

Which document is used to standardize the implementation of security controls across an organization?

Accepted Answer

Security Baseline. A Security Baseline (or Standard) provides the specific, actionable configuration requirements for assets.

Answer

Incident Response Plan

Answer

Risk Register

Answer

Acceptable Use Policy

Question 17

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Accepted Answer

To provide a standardized starting point based on impact level.. NIST SP 800-53B focuses on establishing a starting point of security controls based on the FIPS 199 impact categorization to ensure a minimum security posture.

Answer

To remove all controls that do not apply to the local network.

Answer

To define the continuous monitoring strategy for the system.

Answer

To identify all system-specific compensations.

Question 18

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. The AO reviews and approves the selected control set to ensure it meets the risk appetite of the organization.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 19

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing recovery keys in Active Directory Domain Services (AD DS) ensures central management and recovery capability for IT staff.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop

Question 20

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data partitioning or 'Multi-Tenancy/Geographic Segregation' allows GRC platforms to isolate data based on geographic origin.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.