CGRC Practice Test 5 — 10 Questions

Question 1

An organization is using a cloud service provider (CSP) for a system that processes moderate-impact data. The CSP has a FedRAMP authorization. What is the most efficient way for the organization to leverage the CSP's authorization to support its own system's authorization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inherit the CSP's controls that are within the FedRAMP authorization boundary and document them in the System Security Plan (SSP) as inherited controls.. The most efficient approach is to inherit the CSP's controls that are within its FedRAMP authorization boundary and document them as inherited in the SSP. This leverages the existing authorization, reduces duplication, and allows the organization to focus on its own controls. It also supports reciprocity and speeds up the authorization process for the organization's system.

Answer

Conduct a full independent assessment of the CSP's controls to verify the FedRAMP authorization.

Answer

Assume all controls are fully inherited and do not document any controls in the organization's SSP.

Answer

Require the CSP to undergo a new FedRAMP authorization specifically for the organization's system.

Question 2

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary is defined by the set of components that the authorizing official has authority over — i.e., ownership and control. When data is shared with an external partner, the boundary must be drawn where the organization's control ends and the partner's begins, because the AO can only accept risk for systems they own or control. Cost, physical location, and user count do not determine who is accountable for the risk.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 3

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. The authorization boundary defines exactly which systems, components, and data are included in a security assessment and authorization decision. If that boundary is drawn inaccurately — too narrow or misaligned with the actual system — assets and vulnerabilities that should have been assessed fall outside the scope. Those excluded assets remain unprotected and unmitigated, which is the core risk the question is testing.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 4

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement in the RMF tailoring process (NIST SP 800-37 / SP 800-53) is the step where control statements are adjusted — adding specificity, clarifying language, or scoping the control to the system's particular environment — so the control is precise and implementable. It does not change the control's intent or the system's impact level; it makes the wording actionable for the specific system. This is distinct from scoping (removing controls not applicable) and supplementation (adding controls beyond the baseline).

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 5

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing the BitLocker recovery key in Active Directory (specifically in the computer object's msFVE-RecoveryInformation attribute) is the recommended enterprise practice because AD provides centralized, access-controlled, and auditable storage. This allows authorized administrators to retrieve the key if the drive is locked, while preventing unauthorized access through AD permissions. It also ensures the key survives hardware failures or user turnover.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop

Question 6

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Option B is correct because automated patch testing in a staging environment lets you validate updates against representative systems before production rollout, catching compatibility, regression, and deployment issues while keeping the process repeatable and scalable. Option E is correct because defined emergency patch procedures are essential for out-of-band critical vulnerabilities (for example, zero-days or actively exploited CVEs), specifying expedited risk assessment, approval, deployment, and rollback steps so urgent fixes are applied without bypassing governance. Option A is wrong because hosting patch files on a public FTP site exposes unauthenticated, unencrypted distribution and risks tampered or spoofed binaries; patches should come from vendor-signed, integrity-verified sources over HTTPS. Option C is wrong because requiring manual approval for every single update does not scale, creates bottlenecks, and delays critical fixes; approval should be risk-based and largely automated for routine patches. Option D is wrong because disabling all automatic updates removes timely delivery of security fixes and increases exposure windows, contradicting the goal of an effective patch management program.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 7

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. The System Security Plan (SSP) is the RMF artifact that documents the system boundary — the people, processes, and technologies that make up the system and its authorization boundary. The boundary description within the SSP defines what is inside versus outside the authorization, which directly supports categorization, control selection, and assessment scoping in the RMF process.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 8

A healthcare organization must implement a control to protect electronic protected health information (ePHI) from unauthorized access during transmission over a public network. The security team has decided to use Transport Layer Security (TLS) 1.3. Which statement best describes why TLS 1.3 satisfies the HIPAA Security Rule's transmission security requirement?

Accepted Answer

TLS 1.3 encrypts data in transit and provides integrity checks, ensuring confidentiality and integrity of ePHI.. TLS 1.3 secures data in transit by encrypting the channel and providing integrity protection, which directly meets the HIPAA Security Rule's transmission security standard. It does not provide access control, encryption at rest, or audit logging. The control is appropriate because it prevents eavesdropping and tampering during transmission over public networks.

Answer

TLS 1.3 automatically logs all access to ePHI for audit purposes.

Answer

TLS 1.3 ensures ePHI is encrypted at rest on endpoint devices.

Answer

TLS 1.3 provides role-based access control to ePHI stored on servers.

Question 9

A GRC analyst is supporting the ongoing authorization of a system that has been designated as high-impact. The authorizing official has requested evidence that the continuous monitoring program is providing adequate visibility into the system's security posture. Which of the following activities BEST demonstrates that the program is effectively supporting ongoing authorization?

Accepted Answer

Providing the authorizing official with a dashboard that displays real-time status of key security controls and automated alerts for anomalies.. Providing a real-time dashboard with automated alerts best demonstrates continuous visibility into the security posture. This allows the authorizing official to monitor control effectiveness and respond to anomalies promptly, which is essential for ongoing authorization. It exemplifies the automation and near-real-time data expected in a mature continuous monitoring program under NIST SP 800-137, supporting timely risk decisions.

Answer

Documenting the continuous monitoring strategy in the system security plan and obtaining approval from the authorizing official.

Answer

Conducting an annual security control assessment and providing the results to the authorizing official.

Answer

Submitting a quarterly report that summarizes all security incidents and their resolutions.

Question 10

A newly formed GRC team at a logistics company is drafting the organization's first compliance program. The team lead wants to ensure the program aligns with the principle that compliance is everyone's responsibility, not just the GRC function's. Which element should be included to reinforce this principle?

Accepted Answer

Defined roles and responsibilities for compliance across business units and management. To reinforce that compliance is everyone's responsibility, the program must define roles and responsibilities across business units and management. This distributes accountability and makes compliance part of everyday operations. Help desks, awareness posters, and dedicated departmental officers either concentrate responsibility or fail to establish structural ownership, so they do not achieve the stated principle.

Answer

An annual compliance awareness poster campaign in the corporate offices

Answer

A dedicated compliance officer assigned to every department's daily operations

Answer

A centralized help desk that answers all compliance questions for employees