CGRC Practice Questions 2 — 50 Questions

Question 1

You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitoring security alerts and advisories from vendors and US-CERT. According to NIST SP 800-137, continuous monitoring includes ongoing security control assessments and monitoring of security alerts and advisories. These activities provide situational awareness and ensure controls remain effective. Penetration testing and full reauthorization are not mandatory components, and incident documentation is handled separately from the SSP. The two selected activities are fundamental to maintaining an ongoing authorization.

Answer

Conducting a full reauthorization every six months

Answer

Documenting all security incidents in the System Security Plan (SSP)

Answer

Performing annual penetration testing on all systems

Question 2

A healthcare organization's GRC team is defining key risk indicators (KRIs) for its patient data protection program. The CISO wants KRIs that are predictive of potential breaches, not just historical metrics. Which of the following should the GRC practitioner recommend as a leading KRI?

Accepted Answer

Percentage of critical systems with unpatched vulnerabilities older than 30 days.. The correct answer is the percentage of critical systems with unpatched vulnerabilities older than 30 days. This is a leading KRI because it measures a condition that increases the likelihood of a breach before it happens. It is actionable and predictive, enabling the organization to prioritize remediation and reduce risk proactively, which is exactly what the CISO requested.

Answer

Total number of security awareness training completions in the last quarter.

Answer

Number of past data breach incidents involving patient records.

Answer

Average time to detect a security incident after it occurs.

Question 3

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. Change management approval is the administrative control that ensures a new security tool is reviewed for impact, risk, and rollback before it touches production. It provides documented authorization, prevents unvetted changes from disrupting availability or compliance, and creates an audit trail. Without it, deployment bypasses governance and can violate policy or introduce outages.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 4

During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?

Accepted Answer

Document the finding and develop a POA&M to replace the encryption with a FIPS 140-2 validated module.. When a control is not met, the appropriate action is to document the finding and create a POA&M to bring the system into compliance. In this case, replacing the encryption with a FIPS 140-2 validated module is necessary. The system owner cannot simply accept equivalent encryption without formal approval. Disconnecting the system or misclassifying the control are not standard procedures.

Answer

Mark the control as 'Not Applicable' because the encryption is not required for this system.

Answer

Immediately disconnect the system from the network until the encryption is replaced.

Answer

Accept the encryption as an equivalent control and document the rationale in the SSP.

Question 5

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Accepted Answer

Perform a security impact analysis on the change.. Per NIST SP 800-37 R2, when a significant change occurs during ongoing authorization, the first step is to perform a security impact analysis to determine the extent of the change's effect on the security posture. This analysis informs whether the change is within the already-authorized boundary or requires reauthorization. It is a risk-based approach that ensures the Authorizing Official has the necessary information before deciding on further actions.

Answer

Immediately decommission the system.

Answer

Update the System Security Plan (SSP) and submit for re-certification.

Answer

Wait until the annual assessment cycle to review the change.

Question 6

A federal information system has an approved Authority to Operate (ATO) with an expiration date of 18 months from now. The system owner asks you, the GRC analyst, what triggers a reauthorization before that date. Which of the following events most clearly requires a reauthorization decision by the Authorizing Official?

Accepted Answer

A change in the system's boundary that adds a new interconnection with an external partner system.. A new interconnection with an external partner system expands the authorization boundary and introduces additional risk that was not evaluated in the original ATO. Under NIST SP 800-37, significant changes such as boundary modifications require a security impact analysis and a reauthorization decision by the Authorizing Official. Routine operational activities like log reviews, training, and minor firmware updates do not meet the threshold for reauthorization.

Answer

A minor firmware update to a network switch that does not affect any security controls.

Answer

A quarterly review of audit logs that shows no anomalies or security incidents.

Answer

An annual security awareness training completion report for all system users.

Question 7

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

Accepted Answer

Map Active Directory groups to granular GRC Security Profiles.. Mapping Active Directory groups to granular GRC Security Profiles enforces least privilege by ensuring auditors receive only the permissions their role requires, based on their AD group membership. This leverages existing identity infrastructure (AD) as the source of truth while applying role-based access control within the GRC platform. It is the only option that aligns with least privilege principles.

Answer

Assign Global Administrator rights to the lead auditor.

Answer

Enable Single Sign-On (SSO) for all users globally.

Answer

Configure a shared service account for all audit activities.

Question 8

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Accepted Answer

Automated security regression testing in the CI/CD pipeline.. In a Continuous Authorization model (aligned with NIST SP 800-37 Rev. 2 and the DoD's cATO guidance), automated security regression testing in the CI/CD pipeline is critical because it verifies on every build that previously validated security controls remain effective despite frequent code changes. This provides the continuous, automated evidence needed to maintain the authorization baseline without re-authorizing from scratch with each release.

Answer

Daily vulnerability scanning of the production environment.

Answer

Annual penetration testing of the application.

Answer

Manual sign-off by the CISO before every code commit.

Question 9

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. In Microsoft Endpoint Configuration Manager, Configuration Items (CIs) define the settings and rules you want to evaluate — such as specific registry key values — and are paired with Configuration Baselines to assess compliance across collections of workstations. This is the native compliance settings feature designed exactly for verifying registry, file, and script-based configuration state.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 10

An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)

Accepted Answer

Document the assessment procedures, evidence collected, and findings in a Security Assessment Report (SAR) that can be reviewed and audited.. A reliable and repeatable assessment requires a detailed assessment plan that maps controls to methods and a Security Assessment Report that documents procedures, evidence, and findings. These artifacts ensure consistency, support independent review, and provide a defensible basis for authorization decisions. Relying on a single method or waiting arbitrarily would undermine the assessment's credibility and completeness.

Answer

Use automated tools exclusively for all controls to eliminate human error and ensure consistency.

Answer

Rely solely on interviews with system administrators to verify technical controls because they are the most knowledgeable.

Answer

Conduct the assessment only after the system has been in operation for at least one year to gather sufficient operational data.

Question 11

You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider. The control is documented in the system security plan as 'Inherited'. What is the most critical item to verify during assessment?

Accepted Answer

That the control is implemented correctly and consistently by the common control provider.. When a control is inherited, the system owner depends on the common control provider for its implementation. Therefore, the most critical verification is that the control is implemented correctly and consistently. This ensures the inheritance is valid and the system's security posture is not compromised by relying on an ineffective control.

Answer

That the common control provider has a current authorization to operate.

Answer

That the system owner has signed a memorandum of understanding with the provider.

Answer

That the control is listed in the common control provider's security plan.

Question 12

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the primary, account- and bucket-level control specifically designed to override any policy or ACL that would grant public access, acting as a centralized guardrail. It can be applied at the account level to prevent any bucket from becoming public, which is the strongest preventive mechanism. This directly addresses the requirement to prevent public exposure of PII stored in S3.

Answer

Encryption at Rest

Answer

Bucket ACLs

Answer

IAM User Permissions

Question 13

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Accepted Answer

Explicit assignment of policy ownership and accountability.. Option B is correct because effective governance requires that each policy have a clearly identified owner who is accountable for its maintenance, enforcement, and review, ensuring there is no ambiguity about who is responsible. Option D is correct because a GRC policy must contain clear, unambiguous policy statements tied to organizational objectives, so that the controls and requirements directly support the business goals and can be measured and audited. Options A, C, and E are incorrect because a CISO's home address, employees' social media handles, and a website color scheme are irrelevant operational or personal details that do not contribute to policy ownership, accountability, or alignment with organizational objectives.

Answer

The home address of the CISO.

Answer

A list of all employees' social media handles.

Answer

The exact color scheme of the company website.

Question 14

An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end, an application server, and a database. The database is hosted in a separate virtual private cloud (VPC) managed by the same organization. The ISO wants to minimize the boundary while ensuring all necessary components are included. What should the ISO do?

Accepted Answer

Include the web front-end, application server, and database in the boundary, and document the network segmentation and controls between the VPCs.. The authorization boundary must include all components that process, store, or transmit system data, regardless of their location. The database, even in a separate VPC, is part of the system. Documenting the network segmentation and controls ensures that the interconnections are assessed. Excluding the database or the network infrastructure would create gaps, while including the entire organization would be overbroad. The ISO should define a boundary that accurately reflects the system's logical and physical components.

Answer

Define the boundary as the entire organization's network because all components are managed by the same organization.

Answer

Include only the web front-end and application server, treating the database as an external service because it is in a separate VPC.

Answer

Include the web front-end, application server, and database, but exclude the network infrastructure that connects the VPCs.

Question 15

A security analyst is documenting the authorization boundary for a new system. The system will be deployed on a government cloud environment and will interface with an external identity provider for authentication. The identity provider is owned and operated by another agency. How should the analyst represent the external identity provider in the authorization boundary documentation?

Accepted Answer

Document the identity provider as an external interface and describe the trust relationship and any inherited controls.. The external identity provider should be documented as an external interface, with details about the trust relationship and any inherited controls. This aligns with NIST SP 800-37, which requires external dependencies to be described in the authorization boundary documentation. This ensures that the system's risk assessment considers the provider's security posture and any reliance on its controls.

Answer

Represent the identity provider as a common control that is fully inherited without further documentation.

Answer

Exclude the identity provider entirely from the boundary documentation because it is external.

Answer

Include the identity provider as an internal component of the system boundary because it is critical to authentication.

Question 16

You are conducting an assessment of a cloud service provider's (CSP) compliance with the FedRAMP Moderate baseline. The CSP has provided a system security plan (SSP) and a set of assessment procedures. You notice that the SSP indicates that a particular control is inherited from the underlying IaaS provider. What is the most appropriate action to verify the effectiveness of this inherited control?

Accepted Answer

Request and review the IaaS provider's FedRAMP authorization package and assess the control there.. The correct action is to request and review the IaaS provider's FedRAMP authorization package. Inherited controls are assessed by the provider that implements them, and their assessment results are documented in their authorization package. The CSP's assessor should verify that the inherited control is covered by a current authorization and that it meets the required baseline. This approach avoids duplication and ensures a reliable assessment.

Answer

Mark the control as 'not applicable' in the assessment because it is inherited.

Answer

Conduct interviews with the CSP's staff to confirm that they rely on the IaaS provider's control.

Answer

Directly test the inherited control as if it were implemented by the CSP.

Question 17

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Accepted Answer

Verifying user account permissions and group assignments. Least privilege means each user, process, and service has only the minimum permissions necessary to perform its function. The most direct audit activity is therefore to examine user account permissions, group memberships, sudoers entries, and file/directory ACLs to verify that no account has excessive rights. This directly tests the control's design and operation against the principle.

Answer

Running a Nessus vulnerability scan

Answer

Checking for physical server room access

Answer

Reviewing system logs for failed login attempts

Question 18

Which document is used to standardize the implementation of security controls across an organization?

Accepted Answer

Security Baseline. A security baseline is a documented set of minimum security configurations and controls that must be applied consistently across an organization's systems. It standardizes the implementation of security controls by providing a reference configuration (e.g., CIS Benchmarks, DISA STIGs) that ensures all systems meet a consistent security posture. Baselines are used to harden systems and are a key part of configuration management.

Answer

Incident Response Plan

Answer

Risk Register

Answer

Acceptable Use Policy

Question 19

A financial services firm operates a system processing customer credit data under an active Authority to Operate (ATO). A quarterly review shows that a recent operating system upgrade altered the configuration of the audit logging service, causing it to stop forwarding events to the central log server. The GRC analyst must determine the correct action to maintain the system's security posture and ATO validity. What should the analyst do FIRST?

Accepted Answer

Initiate a security impact analysis to evaluate the change and determine if the ATO conditions are affected.. A security impact analysis is the correct first step because it systematically evaluates how the configuration change affects the system's security controls and whether the existing ATO remains valid. It ensures that any remediation or reauthorization is based on a documented risk assessment, as required by NIST SP 800-37 and continuous monitoring guidance. This approach balances operational needs with compliance obligations.

Answer

Update the system security plan to reflect the new configuration and continue operations without further assessment.

Answer

Immediately revoke the ATO until the logging service is fully restored and verified.

Answer

Schedule a full security control assessment (SCA) for the next annual review cycle.

Question 20

A global retailer's GRC team is preparing for an external audit of its compliance program. The auditor requests evidence that the program's governing body has reviewed and approved the risk appetite and tolerance levels within the last twelve months. Which activity satisfies this request?

Accepted Answer

The risk committee's meeting minutes record approval of the risk appetite statement. The auditor needs evidence that the governing body reviewed and approved risk appetite and tolerance levels within twelve months. Meeting minutes recording that approval are the direct, dated governance artifact. Other documents show management activity or assurance but do not demonstrate governing body approval, which is the specific evidence requirement in the scenario.

Answer

The enterprise risk register showing current risk scores against appetite thresholds

Answer

The internal audit report on risk management process effectiveness

Answer

The chief information security officer's annual attestation of the security program