CGRC Practice Test 4 — 10 Questions

Question 1

A newly appointed GRC manager at a healthcare payer is drafting the organization's first charter for the governance function. The CIO asks what single element must be documented in the charter to give the GRC program the authority to enforce policy across business units that do not report to the GRC office.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A formal mandate from executive leadership that grants the GRC function authority to set and enforce policy. Governance authority flows from executive sponsorship. When the GRC function must enforce policy across units outside its reporting line, the charter must record a mandate from top leadership authorizing that enforcement. Asset inventories, tooling, and testing schedules are downstream activities that depend on authority but cannot create it.

Answer

A detailed inventory of every IT asset that stores or processes protected health information

Answer

A schedule of annual penetration tests for all internet-facing applications

Answer

A subscription to a commercial GRC tool with automated workflow and reporting modules

Question 2

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

Accepted Answer

The vulnerability scan was not performed after the patch was applied.. Tenable.io reports vulnerability status based on the most recent scan data it has received. If a patch was applied but no scan was run afterward, the platform has no evidence of remediation and will continue to show the vulnerability as open. The configuration management database reflects the intended state (patch deployed), while the scanner reflects the observed state (last scan result) — the gap is simply the absence of a post-patch verification scan.

Answer

The Nessus scanner plugin needs an update to recognize the patch.

Answer

The scan policy is set to 'Discovery' instead of 'Audit'.

Answer

The scan agent was decommissioned prematurely.

Question 3

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

Accepted Answer

To identify controls that are implemented once and applied to multiple systems.. Common controls are security controls that are implemented once — typically at the organization, facility, or shared-service level — and inherited by multiple information systems. Identifying them during scope definition lets the organization document inheritance in each system's SSP, avoid duplicative testing, and focus system-specific assessment on controls not covered by the common provider. This is a core RMF/SP 800-37 concept for efficient authorization.

Answer

To ensure they are manually tested for every individual system.

Answer

To increase the system's FIPS 199 impact level.

Answer

To exclude them from the System Security Plan (SSP).

Question 4

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A network topology diagram that shows external service endpoints, connection paths, and system boundaries is the most effective artifact for demonstrating that all system interconnections have been inventoried, because it visually and explicitly maps every connection into and out of the system. The SAP references this diagram to support the interconnection inventory required by NIST 800-53 controls like CA-3 and SA-9. Vulnerability scans, risk registers, and patch lists do not enumerate interconnections.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 5

An organization is using a FedRAMP-authorized cloud service provider (CSP) for a new system. The ISSO must determine how to leverage the CSP's authorization to reduce the assessment burden for the new system. Which approach is most appropriate according to FedRAMP guidance?

Accepted Answer

Inherit the CSP's controls that are within the FedRAMP boundary and assess only the controls that are not inherited or are specific to the new system.. The most appropriate approach is to inherit controls from the CSP's FedRAMP authorization and assess only the controls that are not inherited or are specific to the new system. This leverages the CSP's existing authorization to reduce duplication and cost, while ensuring that all controls are assessed. FedRAMP promotes this reuse through the concept of control inheritance and the use of the CSP's authorization package.

Answer

Conduct a full independent assessment of all controls, ignoring the CSP's FedRAMP authorization to ensure completeness.

Answer

Rely entirely on the CSP's FedRAMP authorization and forego any additional assessment of the new system.

Answer

Request the CSP to modify its FedRAMP authorization to include the new system's specific controls before proceeding.

Question 6

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Accepted Answer

/etc/ssh/sshd_config. The SSH daemon's runtime behavior is controlled by /etc/ssh/sshd_config, which contains directives such as PermitRootLogin. To verify that root login over SSH is disallowed, you must inspect this file for the PermitRootLogin setting (typically set to 'no' or 'prohibit-password'). This is the authoritative configuration file for the SSH server.

Answer

/etc/hosts.allow

Answer

/etc/shadow

Answer

/etc/passwd

Question 7

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Accepted Answer

Document the removal and the justification in the SSP.. When a control is marked 'Not Applicable' during tailoring, the correct approach is to document the removal and provide a justification in the System Security Plan (SSP). This ensures transparency and auditability, allowing authorizing officials to understand why the control was excluded. The SSP serves as the primary documentation for control implementation and tailoring decisions.

Answer

Mark the control as 'Implemented' and leave the field blank.

Answer

Request a waiver from the CISO.

Answer

Just delete the control from the system security plan (SSP).

Question 8

A GRC manager is establishing a process to manage exceptions to security policies. The goal is to ensure that exceptions are granted only when justified, have a defined expiration, and are reviewed regularly. Which TWO of the following are essential components of this exception management process? (Choose two.)

Accepted Answer

Automatic expiration of exceptions after a predefined period, with notification to the requester for renewal.. A risk-based approval workflow ensures that exceptions are authorized by the right stakeholders, while automatic expiration with renewal notifications enforces periodic review. Together, these components prevent exceptions from becoming permanent and ensure they are justified at the time of renewal. Other options either create bottlenecks, lack controls, or fail to enforce review.

Answer

Storing all exception requests in a shared spreadsheet that is accessible to the entire IT department.

Answer

Allowing exceptions to remain active indefinitely as long as the requester provides a verbal justification.

Answer

A requirement that all exception requests be approved by the Chief Information Security Officer (CISO) regardless of risk level.

Question 9

What is the purpose of a 'pre-assessment' meeting?

Accepted Answer

To set expectations and coordinate logistics. A pre-assessment meeting is held before a formal assessment to align all parties on scope, schedule, roles, logistics, evidence requirements, and expectations. It ensures the assessor and the organization-under-assessment agree on what will be examined, when, by whom, and in what format evidence will be provided, reducing surprises and delays during the actual assessment.

Answer

To conduct penetration testing

Answer

To finalize the POA&M

Answer

To perform hardware inventory

Question 10

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

Accepted Answer

The cloud provider's System Security Plan (SSP) or Authorization Package. The cloud provider's System Security Plan (SSP) or authorization package is the primary evidence of implemented security controls, because it documents control descriptions, implementation statements, and supporting artifacts mapped to a framework such as NIST SP 800-53 or FedRAMP. It is the authoritative artifact a customer or auditor reviews to determine whether the provider's controls meet compliance requirements.

Answer

The service level agreement (SLA)

Answer

The organization's internal risk register

Answer

The network topology map