CGRC Practice Test 4 — 10 Questions

Question 1

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement and document compensating controls.. When a patch cannot be applied, compensating controls must be implemented and documented to mitigate the risk.

Answer

Request an exemption from the CISO without providing documentation.

Answer

Ignore the vulnerability as it cannot be fixed.

Answer

Disconnect the server from the network permanently.

Question 2

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 3

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 4

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. Publisher rules in AppLocker allow for the most granular control based on digital certificates.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 5

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. A compensating control is an alternate measure used to satisfy the requirement of a security control that cannot be implemented as stated.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 6

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

Accepted Answer

Target state, Current state, Gap identification. You must define the target (what good looks like), determine the current state (as-is), and then identify the delta (gap).

Answer

Current state, Target state, Gap identification

Answer

Gap identification, Target state, Current state

Answer

Current state, Gap identification, Target state

Question 7

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. Execution involves interviewing staff, reviewing documentation, and testing technical configuration settings.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 8

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. A formal change control process is required to ensure that changes are tested, documented, and approved.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 9

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Patch management requires testing to prevent outages and a deployment strategy to ensure coverage.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 10

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Accepted Answer

To define specific parameters for control implementation.. Assignment statements provide a mechanism to tailor the control by specifying organization-defined values or frequencies.

Answer

To categorize the control by its priority level.

Answer

To link the control to a regulatory requirement.

Answer

To assign the control to a specific system administrator.