CGRC Practice Questions 2 — 50 Questions

Question 1

Which TWO factors contribute to the 'scope' of an information security audit?

Accepted Answer

Network boundaries. The audit scope is driven by the physical and logical boundaries of the system being reviewed.

Answer

External stock prices

Answer

Competitor market analysis

Answer

Employee home addresses

Question 2

Which type of control is an alarm system installed in a server room?

Accepted Answer

Detective. An alarm system is a detective control designed to alert staff of unauthorized presence.

Answer

Preventative

Answer

Corrective

Answer

Deterrent

Question 3

In VMware vSphere, what is the best practice for securing virtual machine consoles?

Accepted Answer

Use the VMRC (VMware Remote Console) with encrypted connections. Disabling the remote console access or enforcing authentication is vital to prevent unauthorized access.

Answer

Share the ESXi root password

Answer

Disable all logging

Answer

Leave the VNC port open

Question 4

Which of the following activities is a core component of the 'Ongoing Authorization' process?

Accepted Answer

Periodically reviewing security assessment results.. Maintaining the authorization requires continuous assessment of the system's security posture to ensure it remains within an acceptable risk level.

Answer

Performing a full system re-installation annually.

Answer

Changing the system administrator's password every month.

Answer

Increasing the budget for information security.

Question 5

You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?

Accepted Answer

On a Span Port of the core distribution switch. Placing the sensor on the span port of the core switch allows visibility into internal traffic flows.

Answer

Directly on the public ISP router

Answer

Inside the isolated guest Wi-Fi network

Answer

On the WAN interface of the firewall

Question 6

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Accepted Answer

High risk of system instability during patch deployment.. Legacy systems often lack support for modern automation tools and are difficult to patch without downtime.

Answer

The system is too new for security researchers to find bugs.

Answer

The system automatically updates its own firmware daily.

Answer

Too much disk space available for logging.

Question 7

When implementing an 802.1X environment, what is the role of the RADIUS server?

Accepted Answer

Authenticating the supplicant. The RADIUS server acts as the Authentication Server, validating the credentials provided by the supplicant via the authenticator.

Answer

Encapsulating EAP frames

Answer

Providing the EAP method to the client

Answer

Enforcing the physical port state

Question 8

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

Accepted Answer

The server's TLS configuration file. The web server's SSL/TLS configuration file (e.g., httpd.conf or nginx.conf) defines the supported cipher suites.

Answer

The server's BIOS settings

Answer

The web application's root directory

Answer

The firewall access control list

Question 9

To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?

Accepted Answer

dm-crypt/LUKS. dm-crypt/LUKS is the industry-standard tool for transparent full disk encryption on Linux.

Answer

BitLocker

Answer

IPsec

Answer

VeraCrypt

Question 10

When performing vulnerability management, what is the purpose of a 'credentialed scan'?

Accepted Answer

To identify missing patches and misconfigurations. Credentialed scans allow the tool to look inside the OS and application configuration, providing more accurate results.

Answer

To perform penetration testing

Answer

To automate the patching process

Answer

To bypass the firewall

Question 11

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement is the process of adjusting the implementation of a control to be more specific to the technology or mission.

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 12

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Accepted Answer

Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0. Security groups are stateful; allowing inbound traffic automatically allows the return traffic, and the default is to deny all other traffic.

Answer

Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0

Answer

Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0

Answer

Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32

Question 13

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A Bastion Host with MFA ensures that access to production is controlled, logged, and authenticated securely.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 14

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Accepted Answer

Use an established 'Data Connector' or 'API Integration' module.. Using pre-built API connectors or 'Data Integrators' provided by the GRC platform is the standard way to ingest external security data.

Answer

Build a custom script to write directly to the GRC database tables.

Answer

Manually export and import CSV files every hour.

Answer

Have the CSPM tool email screenshots of security alerts to the GRC team.

Question 15

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. A 'Scheduled Assessment' or 'Workflow Trigger' based on 'Vendor Criticality' ensures compliance with due diligence timelines.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 16

What document provides the most granular guidance on tailoring security controls for federal systems?

Accepted Answer

NIST SP 800-53.. NIST SP 800-53, specifically the tailoring guidance section, provides the framework for modifying baselines.

Answer

FIPS 200.

Answer

NIST SP 800-37.

Answer

CNSSI 1253.

Question 17

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Accepted Answer

It provides a standardized set of controls for a specific technology stack.. Overlays are pre-defined sets of controls that address specific environments, technologies, or missions, ensuring consistent security posture.

Answer

It replaces the need for FIPS 199 categorization.

Answer

It eliminates the need for manual tailoring.

Answer

It automatically tests the controls for compliance.

Question 18

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. An inaccurate boundary leads to 'security gaps' where assets go unmonitored or unprotected.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 19

When configuring an email security gateway (e.g., Proofpoint), which record should be added to DNS to prevent domain spoofing?

Accepted Answer

SPF. SPF, DKIM, and DMARC are the trifecta of email authentication; SPF is the most foundational DNS record for authorized senders.

Answer

CNAME

Answer

A

Answer

MX

Question 20

Which THREE of the following are components of a secure server hardening process?

Accepted Answer

Applying security patches. Disabling unnecessary services, updating software, and using minimal feature sets are key to reducing the attack surface.

Answer

Installing all available third-party software

Answer

Running the web server as the root user