CGRC Practice Test 5 — 10 Questions

Question 1

What is the primary function of an assessor's 'working papers'?

Accepted Answer

To document evidence and support the findings. Working papers document the evidence gathered, testing performed, and observations made, which serve as the foundation for the final assessment report.

Answer

To list the audit team members

Answer

To submit to the regulator

Answer

To replace the need for an audit

Question 2

Which TWO of the following are recommended practices for managing firewall rules?

Accepted Answer

Documenting the business justification for each rule. Regular review and documentation of rules help maintain a secure and clean firewall configuration.

Answer

Disabling logging for all rules to improve performance

Answer

Applying rules in random order

Answer

Using 'Any' as the destination for all rules

Question 3

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. Conditions attached to an ATO represent known risks that must be tracked and mitigated through the POA&M to transition to full, unconditioned authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 4

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Accepted Answer

Create a certificate of destruction for audit purposes.. Sanitizing the media, updating the inventory, and documenting the destruction process are all critical steps for classified systems.

Answer

Move the system to a secure storage area for indefinite holding.

Answer

Reformat the drive for reuse in a non-sensitive project.

Question 5

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Disabled account management is a critical detective and preventive control to ensure that only authorized, active users have access.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication

Question 6

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Accepted Answer

Target completion date. A POA&M must define the vulnerability/weakness and the specific milestone/date for remediation.

Answer

Personnel salary data

Answer

Historical audit logs

Answer

Software licensing keys

Question 7

Which TWO methods are commonly used to gather assessment evidence?

Accepted Answer

Interview. Assessment methods commonly include observing processes and interviewing personnel to understand implementation.

Answer

Budget approval

Answer

Marketing collateral review

Answer

System retirement

Question 8

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

Accepted Answer

Exclude known safe processes and signers. Tuning policies to exclude known safe administrative scripts and software reduces noise while maintaining core monitoring.

Answer

Only monitor server logs

Answer

Set to 'Block All' mode

Answer

Disable real-time scanning

Question 9

You are auditing a backup solution. Which metric is most critical for the Availability audit?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) dictates how quickly a system must be available after an outage, which is the primary metric for availability testing.

Answer

Encryption key rotation

Answer

Tape rotation schedule

Answer

Backup storage capacity

Question 10

You are configuring a SIEM (e.g., Splunk) to monitor failed login attempts. What is the most efficient way to reduce noise while maintaining audit integrity?

Accepted Answer

Apply filters on the Universal Forwarder. Filtering at the forwarder level prevents unnecessary ingestion of logs, saving storage and improving performance.

Answer

Disable logging on the domain controller

Answer

Delete logs after ingestion

Answer

Increase log rotation frequency