CGRC Practice Questions 1 — 50 Questions

Question 1

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Accepted Answer

It reduces the level of effort for the security assessment. A FedRAMP-authorized CSP has already undergone an independent, NIST SP 800-53-based security assessment by a Third-Party Assessment Organization (3PAO) and received an Authority to Operate (ATO) from a federal agency. Federal agencies (and organizations leveraging FedRAMP reciprocity) can reuse that assessment package—the SSP, SAR, and POA&M—rather than performing a full independent assessment of the CSP's environment. This reuse dramatically reduces the level of effort, cost, and time required for the customer's own security authorization activities.

Answer

It guarantees the system will never be breached

Answer

It eliminates the need for any internal security oversight

Answer

It allows the organization to bypass the RMF

Question 2

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

Accepted Answer

Update the SSP to reflect the actual implementation and document the change in the configuration management process.. The correct answer is to update the SSP to reflect the actual implementation. The SSP is a living document that must accurately describe the system's security controls. When an effective control is implemented differently than documented, the SSP should be revised to maintain consistency. This ensures that continuous monitoring and future assessments are based on accurate information.

Answer

Revert the control to match the SSP because the SSP is the authoritative document.

Answer

Initiate a security impact analysis to determine if the change is significant.

Answer

Take no action because the control is still effective and the discrepancy is minor.

Question 3

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. A self-assessment is an audit performed by an internal department to evaluate the effectiveness of security controls without external pressure. It is a proactive internal review that helps identify gaps and improve security posture before external audits occur. This type of audit is typically conducted by internal audit teams or security personnel within the organization.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 4

You are the GRC lead for a U.S. federal agency. A system has an Authorization to Operate (ATO) that expires in 90 days. The system owner submits a revised System Security Plan (SSP) and a new security assessment report showing all controls are still effective, but no changes have been made to the system since the last authorization. According to NIST SP 800-37 Rev. 2, what is the most appropriate action to maintain the authorization?

Accepted Answer

Update the authorization package with the new SSP and assessment results, and continue ongoing authorization without a new authorization decision.. Ongoing authorization allows a system to maintain its ATO through continuous monitoring rather than periodic reauthorization. When no significant changes have occurred and controls are assessed as effective, the authorizing official can continue the authorization based on updated documentation. This approach is risk-based and avoids unnecessary reassessment while ensuring the system remains compliant.

Answer

Allow the ATO to expire and operate the system under an interim authority to test (IATT) until a new authorization can be completed.

Answer

Request a waiver from the authorizing official to extend the ATO indefinitely without any further monitoring or documentation.

Answer

Initiate a full reauthorization process, including a new security assessment of all controls and a new authorization decision.

Question 5

Which document provides the formal authority to operate a system?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document (also called the Authorization to Operate, ATO, or in NIST RMF terms the authorization package's decision) is the formal artifact in which the Authorizing Official accepts the risk and grants authority to operate the system. It is the official record that the system may be placed into operation based on the assessed controls and residual risk.

Answer

System Security Plan

Answer

Risk Assessment Report

Answer

Security Control Assessment

Question 6

A GRC officer is preparing for an annual assessment of a system's continuous monitoring program. The officer must ensure that the program's documentation reflects the current state of security controls. Which of the following artifacts is MOST important to review to verify that the continuous monitoring program is effectively tracking control changes?

Accepted Answer

The continuous monitoring strategy and the associated metrics and reports.. The continuous monitoring strategy and its associated metrics and reports are the most important artifacts because they directly document how controls are monitored, what data is collected, and how that data is reported. This provides verifiable evidence that the program is actively tracking control changes and effectiveness, as required by NIST SP 800-137. Other documents support the program but do not replace the core monitoring artifacts.

Answer

The configuration management plan and change logs.

Answer

The plan of action and milestones (POA&M) and its status reports.

Answer

The system security plan (SSP) and its recent updates.

Question 7

A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact is specifically designed to depict the system boundary and its interfaces?

Accepted Answer

Authorization Boundary Diagram. The Authorization Boundary Diagram is the artifact specifically created to depict the system boundary, including components and interfaces. It provides a clear visual scope for the assessment and is essential for the Authorizing Official to understand what is being authorized. Other documents like the SSP reference the boundary but do not serve as the primary depiction.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Privacy Impact Assessment (PIA)

Question 8

During a system compliance review, the Security Control Assessor (SCA) issues a finding that a critical security control is only partially implemented. The system owner disagrees and wants to proceed with authorization. As the Information System Security Officer (ISSO), what should you do FIRST?

Accepted Answer

Request that the SCA reconsider the finding by providing additional evidence that demonstrates the control is fully implemented.. The ISSO should first attempt to resolve the disagreement by providing additional evidence to the SCA. If the SCA maintains the finding, it becomes a risk that the AO must accept or mitigate. Proceeding directly to a POA&M or AO escalation skips the necessary step of validating the assessment finding.

Answer

Advise the system owner to submit a Plan of Action and Milestones (POA&M) for the partial control and proceed with authorization.

Answer

Escalate the issue to the Authorizing Official (AO) immediately and recommend denying the Authorization to Operate (ATO).

Answer

Document the disagreement in the System Security Plan (SSP) and allow the Authorizing Official (AO) to make the final risk-based decision.

Question 9

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Accepted Answer

The percentage reduction in repeat audit findings.. A Board of Directors cares about outcomes that reduce organizational risk and cost while improving compliance posture. A reduction in repeat audit findings demonstrates that the GRC program is not just identifying issues but driving durable remediation — the same problems are not recurring. This metric ties GRC activity directly to improved control effectiveness and lower regulatory exposure, which is the language of the boardroom.

Answer

The number of tickets opened in the GRC helpdesk.

Answer

The total storage space consumed by evidence files.

Answer

The number of users logged into the GRC platform daily.

Question 10

You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a commercial cloud service provider (CSP) for infrastructure as a service (IaaS). The CSP has a FedRAMP authorization at the Moderate impact level. Your system requires additional controls beyond the CSP's baseline. Which action should you take first to address the gap?

Accepted Answer

Implement a control overlay that adds the necessary controls and documents them in the system security plan.. The first step is to implement a control overlay to add the necessary controls to the CSP's Moderate baseline. Overlays are designed to tailor baselines for specific environments or impact levels, enabling the system to meet its security requirements without disrupting the CSP's authorization. This approach is efficient and aligns with NIST guidance.

Answer

Require the CSP to obtain a new FedRAMP authorization at the High impact level before proceeding.

Answer

Document the gap as a risk and accept it without additional controls, since the CSP is already authorized.

Answer

Select a different CSP that already has a FedRAMP High authorization and migrate the system.

Question 11

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The System Security Plan (SSP) documents the system boundary, controls selected and implemented, and how they meet requirements. The Security Assessment Report (SAR) is the output of assessing those controls, evaluating whether the controls described in the SSP are effective. Thus the SAR evaluates the SSP's controls, and both feed the authorization decision.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP

Question 12

You are the Information System Security Officer (ISSO) for a federal payroll system undergoing an annual assessment. The Security Control Assessor (SCA) reports that a firewall rule allowing inbound RDP from any source is in place, contradicting the documented configuration in the System Security Plan (SSP). The system owner argues the rule is temporary for a migration. What is the most appropriate immediate action?

Accepted Answer

Instruct the network team to remove or restrict the rule immediately, then update the SSP and POA&M to reflect the change.. An undocumented firewall rule allowing unrestricted RDP is a critical finding that must be addressed immediately. The correct approach is to restrict or remove the rule to eliminate exposure, then update the SSP to reflect the actual configuration and create a POA&M entry to track root-cause remediation. This restores compliance and ensures the system operates within its authorized security posture.

Answer

Document the discrepancy in the Plan of Action and Milestones (POA&M) and allow the migration to complete.

Answer

Accept the risk because the system owner has authority over the system and can approve temporary deviations.

Answer

Suspend the system's Authorization to Operate (ATO) until the migration is complete and the rule is removed.

Question 13

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. During the Control Selection phase, the Authorizing Official (AO) is responsible for approving the tailoring decisions made by the system owner and security team, ensuring the selected controls adequately address the system's risk profile. The AO's approval formalizes the agreed-upon control set before it moves into implementation and assessment. This approval is a key governance step that ties control selection to the authorization decision.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 14

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Accepted Answer

The on-premises servers are included in the boundary because they are under the agency's direct control and process CUI.. The boundary should include components under the agency's direct control that process CUI, such as on-premises servers. For cloud services with FedRAMP authorizations, the agency can exclude those components if it documents inherited controls and accepts residual risk. This approach aligns with NIST guidance on leveraging external authorizations and focusing on the agency's own responsibilities.

Answer

The boundary must include all cloud components regardless of the provider's authorization status to ensure end-to-end security.

Answer

The boundary should be defined based on the physical location of the servers to ensure data sovereignty requirements are met.

Answer

The PaaS provider's underlying infrastructure is included in the boundary because the agency's applications run on it.

Question 15

A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?

Accepted Answer

FedRAMP Customer Responsibility Matrix (CRM). The FedRAMP Customer Responsibility Matrix (CRM) is the key document that defines which security controls are inherited from the CSP and which the agency must implement and assess. By using the CRM, the agency can avoid duplicating assessments and focus on its own responsibilities. This leverages the FedRAMP authorization to streamline the ATO process while ensuring all controls are covered.

Answer

FedRAMP Authority to Operate (ATO) letter

Answer

FedRAMP Security Assessment Report (SAR)

Answer

FedRAMP Continuous Monitoring (ConMon) plan

Question 16

A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common control provided by a separate organizational unit. The common control's assessment was performed by that unit, and the results are documented in a shared assessment report. What should the Assessor do to support the system's authorization?

Accepted Answer

Review the shared assessment report to determine if it meets the system's assurance requirements and document any inheritance of the control in the system security plan.. Common controls can be leveraged across systems, and their assessment results can be reused if they meet the receiving system's assurance requirements. The Assessor should review the shared report for currency, scope, and relevance, then document the inheritance in the system security plan. Re-assessing or excluding the control would be inefficient or incorrect. This practice aligns with the RMF's goal of reuse and reciprocity.

Answer

Re-assess the common control independently because the system's high-impact level requires a full assessment of all controls.

Answer

Perform a penetration test of the common control to validate the shared assessment report before accepting it.

Answer

Exclude the common control from the system's assessment because it is outside the system's authorization boundary.

Question 17

An organization is undergoing a periodic security assessment of its production environment. The assessment team lead needs to ensure that the assessment scope is formally agreed upon and that all relevant stakeholders understand the boundaries. Which document should the team lead produce FIRST to establish this shared understanding?

Accepted Answer

Security Assessment Plan (SAP). The Security Assessment Plan is the key document that formalizes the scope, approach, and logistics of an assessment. It ensures that all stakeholders have a common understanding of what will be assessed, how, and by whom. Without an approved SAP, the assessment lacks a controlled framework, leading to potential misunderstandings and inefficiencies. Thus, the SAP is the correct first step.

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

System Security Plan (SSP)

Question 18

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. Configuring an automated workflow trigger based on vendor tier and date ensures that critical vendors are systematically flagged for annual due diligence without manual intervention. This leverages the GRC platform's scheduling and tiering capabilities to enforce policy consistently, generate tasks, and maintain audit trails. It aligns with TPRM best practices by automating recurring assessments and reducing the risk of missed reviews.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 19

You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?

Accepted Answer

An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold.. An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold is correct because it directly enforces the risk appetite statement by initiating a Risk Treatment Plan whenever a score exceeds the defined tolerance. This creates a deterministic, auditable linkage between risk scoring and treatment workflow. It also ensures consistency across all risk records rather than relying on individual action.

Answer

A manual email notification from the risk owner to the CISO.

Answer

A change in the risk rating calculation formula.

Answer

A daily report showing all risks over the appetite.

Question 20

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Accepted Answer

The cloud service provider (CSP).. Under the shared responsibility model, the cloud service provider (CSP) (D) is responsible for compliance of the cloud itself — the physical datacenters, hardware, hypervisor, and foundational services — while the cloud customer (E) is responsible for compliance in the cloud, including their data, configurations, access controls, and applications they deploy. These two parties split security and compliance duties based on the service model (IaaS, PaaS, SaaS), which is why both are the entities typically accountable. The hardware manufacturer (A) only supplies components and does not bear operational compliance responsibility once equipment is deployed in a CSP's datacenter. The local internet service provider (B) merely transports connectivity and has no role in cloud compliance obligations. The end-user of the application (C) consumes services but is not a distinct compliance-responsible entity separate from the cloud customer organization.

Answer

The hardware manufacturer.

Answer

The local internet service provider.

Answer

The end-user of the application.