CGRC Practice Questions 1 — 50 Questions

Question 1

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

Accepted Answer

Document the removal of the family with a justification.. If a control or family is not applicable to the system's function, it should be scoped out or documented as not applicable during the tailoring process.

Answer

Replace the family with general security controls.

Answer

Keep the controls but set them to 'manual' mode.

Answer

Implement the controls as high-priority items.

Question 2

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A System Interconnection Agreement (SIA) or Data Use Agreement (DUA) provides the formal record of cross-boundary data flows.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 3

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)

Accepted Answer

Administrative personnel managing the system.. An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Answer

The local library book catalog.

Answer

The public social media feed of the organization.

Question 4

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Accepted Answer

Add additional controls to the baseline to address specific threat vectors.. Supplementing is the process of adding controls to a baseline to address specific mission or business requirements that are not covered by the standard baseline.

Answer

Replace a control with a vendor-provided security feature.

Answer

Remove controls from the baseline that are technically infeasible.

Answer

Adjust the parameters of existing controls to lower operational impact.

Question 5

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

Accepted Answer

Define the frequency based on organizational policy.. Organizations must define the value for the assignment within the bracket to make the control actionable.

Answer

Use the default value provided in the appendix.

Answer

Remove the control since it is not fully defined.

Answer

Leave the assignment blank.

Question 6

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

Accepted Answer

Update the POA&M with a remediation plan. The system owner is responsible for prioritizing the remediation of high-risk items and ensuring the POA&M reflects the timeline and resource allocation for fixing them.

Answer

Delete the finding from the report

Answer

Transfer the risk to the IT staff

Answer

Accept the risk without documentation

Question 7

Which document defines the specific security controls that an organization must implement based on its risk assessment?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) describes the system and the controls that have been selected (tailored) to meet security requirements.

Answer

Incident Response Plan

Answer

Risk Management Plan

Answer

Security Assessment Report (SAR)

Question 8

If a control is determined to be 'system-specific', what does that mean?

Accepted Answer

It is implemented by the system owner for that system only.. A system-specific control is one that is implemented solely by the information system and is not inherited from an enterprise service.

Answer

It is a hybrid control.

Answer

It must be implemented by the vendor.

Answer

It is inherited from the enterprise.

Question 9

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Accepted Answer

The cloud service provider (CSP).. Security in the cloud is a shared endeavor where the provider covers the infrastructure and the customer covers the configuration and data.

Answer

The hardware manufacturer.

Answer

The local internet service provider.

Answer

The end-user of the application.

Question 10

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config Remediation Actions.. AWS Config Rules combined with Systems Manager Automation documents allow for automated remediation of non-compliant resources.

Answer

AWS CloudTrail Event Selectors.

Answer

AWS Config Aggregators.

Answer

AWS Config Conformance Packs.

Question 11

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

Accepted Answer

Rules of Engagement. The Rules of Engagement (ROE) define the boundaries, scope, and procedures for an assessment, ensuring both parties understand the limitations.

Answer

Interconnection Security Agreement

Answer

Security Assessment Plan

Answer

Risk Assessment Report

Answer

System Security Plan

Question 12

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Accepted Answer

Greater reliance on third-party audit reports. In a cloud environment, the provider manages the physical and infrastructure controls (inherited), meaning the assessor focuses on verifying the provider's attestations (like SOC 2 reports).

Answer

POA&M is prohibited for cloud providers

Answer

Physical security is no longer assessed

Answer

Manual testing is mandated for all controls

Question 13

Which TWO of the following represent best practices for password management?

Accepted Answer

Using a password manager for unique, complex passwords. Complex, unique passwords and the use of a password manager are foundational security practices.

Answer

Forcing users to change passwords every 30 days

Answer

Allowing password sharing among team members

Answer

Logging passwords in a shared spreadsheet

Question 14

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Accepted Answer

After the 'Assess' step and before the 'Authorize' step. The SAR provides the technical basis for the AO to make the risk-based decision after the assessment is complete.

Answer

During the 'Categorize' step

Answer

After the 'Monitor' step

Answer

During the 'Prepare' step

Question 15

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The SSP describes the controls that *should* be in place, and the SAR reports on whether those controls are actually effective.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP

Question 16

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

Accepted Answer

To provide a language for checking system configuration state. OVAL (Open Vulnerability and Assessment Language) is used to verify the state of a system's security configuration, such as registry keys or file permissions.

Answer

To standardize the transfer of vulnerability data

Answer

To define the severity of a vulnerability

Answer

To manage the lifecycle of a POA&M

Question 17

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

Accepted Answer

To document the approved security configuration of a system.. A baseline provides a documented, approved state of a system that serves as a reference point for future changes.

Answer

To automate the deployment of new software patches.

Answer

To identify all users with administrative privileges.

Answer

To serve as a temporary backup for system files.

Question 18

What is the purpose of a 'pre-assessment' meeting?

Accepted Answer

To set expectations and coordinate logistics. A pre-assessment or kickoff meeting ensures alignment on scope, timeline, logistics, and points of contact between the auditor and the client.

Answer

To conduct penetration testing

Answer

To finalize the POA&M

Answer

To perform hardware inventory

Question 19

Which TWO types of controls are specifically examined during an audit?

Accepted Answer

Administrative controls. Audits assess both technical controls (logical) and administrative controls (policies/procedures).

Answer

Physical building aesthetics

Answer

HR hiring policies

Answer

Marketing controls

Question 20

You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?

Accepted Answer

Azure AD Conditional Access Policy. Conditional Access policies allow for risk-based and context-aware authentication enforcement.

Answer

Password Protection Policy

Answer

Security Defaults

Answer

Identity Protection User Risk Policy