CGRC Practice Test 6 — 10 Questions

Question 1

You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitoring security alerts and advisories from vendors and US-CERT. According to NIST SP 800-137, continuous monitoring includes ongoing security control assessments and monitoring of security alerts and advisories. These activities provide situational awareness and ensure controls remain effective. Penetration testing and full reauthorization are not mandatory components, and incident documentation is handled separately from the SSP. The two selected activities are fundamental to maintaining an ongoing authorization.

Answer

Conducting a full reauthorization every six months

Answer

Documenting all security incidents in the System Security Plan (SSP)

Answer

Performing annual penetration testing on all systems

Question 2

A healthcare organization's GRC team is defining key risk indicators (KRIs) for its patient data protection program. The CISO wants KRIs that are predictive of potential breaches, not just historical metrics. Which of the following should the GRC practitioner recommend as a leading KRI?

Accepted Answer

Percentage of critical systems with unpatched vulnerabilities older than 30 days.. The correct answer is the percentage of critical systems with unpatched vulnerabilities older than 30 days. This is a leading KRI because it measures a condition that increases the likelihood of a breach before it happens. It is actionable and predictive, enabling the organization to prioritize remediation and reduce risk proactively, which is exactly what the CISO requested.

Answer

Total number of security awareness training completions in the last quarter.

Answer

Number of past data breach incidents involving patient records.

Answer

Average time to detect a security incident after it occurs.

Question 3

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. Change management approval is the administrative control that ensures a new security tool is reviewed for impact, risk, and rollback before it touches production. It provides documented authorization, prevents unvetted changes from disrupting availability or compliance, and creates an audit trail. Without it, deployment bypasses governance and can violate policy or introduce outages.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 4

During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?

Accepted Answer

Document the finding and develop a POA&M to replace the encryption with a FIPS 140-2 validated module.. When a control is not met, the appropriate action is to document the finding and create a POA&M to bring the system into compliance. In this case, replacing the encryption with a FIPS 140-2 validated module is necessary. The system owner cannot simply accept equivalent encryption without formal approval. Disconnecting the system or misclassifying the control are not standard procedures.

Answer

Mark the control as 'Not Applicable' because the encryption is not required for this system.

Answer

Immediately disconnect the system from the network until the encryption is replaced.

Answer

Accept the encryption as an equivalent control and document the rationale in the SSP.

Question 5

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Accepted Answer

Perform a security impact analysis on the change.. Per NIST SP 800-37 R2, when a significant change occurs during ongoing authorization, the first step is to perform a security impact analysis to determine the extent of the change's effect on the security posture. This analysis informs whether the change is within the already-authorized boundary or requires reauthorization. It is a risk-based approach that ensures the Authorizing Official has the necessary information before deciding on further actions.

Answer

Immediately decommission the system.

Answer

Update the System Security Plan (SSP) and submit for re-certification.

Answer

Wait until the annual assessment cycle to review the change.

Question 6

A federal information system has an approved Authority to Operate (ATO) with an expiration date of 18 months from now. The system owner asks you, the GRC analyst, what triggers a reauthorization before that date. Which of the following events most clearly requires a reauthorization decision by the Authorizing Official?

Accepted Answer

A change in the system's boundary that adds a new interconnection with an external partner system.. A new interconnection with an external partner system expands the authorization boundary and introduces additional risk that was not evaluated in the original ATO. Under NIST SP 800-37, significant changes such as boundary modifications require a security impact analysis and a reauthorization decision by the Authorizing Official. Routine operational activities like log reviews, training, and minor firmware updates do not meet the threshold for reauthorization.

Answer

A minor firmware update to a network switch that does not affect any security controls.

Answer

A quarterly review of audit logs that shows no anomalies or security incidents.

Answer

An annual security awareness training completion report for all system users.

Question 7

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

Accepted Answer

Map Active Directory groups to granular GRC Security Profiles.. Mapping Active Directory groups to granular GRC Security Profiles enforces least privilege by ensuring auditors receive only the permissions their role requires, based on their AD group membership. This leverages existing identity infrastructure (AD) as the source of truth while applying role-based access control within the GRC platform. It is the only option that aligns with least privilege principles.

Answer

Assign Global Administrator rights to the lead auditor.

Answer

Enable Single Sign-On (SSO) for all users globally.

Answer

Configure a shared service account for all audit activities.

Question 8

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Accepted Answer

Automated security regression testing in the CI/CD pipeline.. In a Continuous Authorization model (aligned with NIST SP 800-37 Rev. 2 and the DoD's cATO guidance), automated security regression testing in the CI/CD pipeline is critical because it verifies on every build that previously validated security controls remain effective despite frequent code changes. This provides the continuous, automated evidence needed to maintain the authorization baseline without re-authorizing from scratch with each release.

Answer

Daily vulnerability scanning of the production environment.

Answer

Annual penetration testing of the application.

Answer

Manual sign-off by the CISO before every code commit.

Question 9

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. In Microsoft Endpoint Configuration Manager, Configuration Items (CIs) define the settings and rules you want to evaluate — such as specific registry key values — and are paired with Configuration Baselines to assess compliance across collections of workstations. This is the native compliance settings feature designed exactly for verifying registry, file, and script-based configuration state.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 10

An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)

Accepted Answer

Document the assessment procedures, evidence collected, and findings in a Security Assessment Report (SAR) that can be reviewed and audited.. A reliable and repeatable assessment requires a detailed assessment plan that maps controls to methods and a Security Assessment Report that documents procedures, evidence, and findings. These artifacts ensure consistency, support independent review, and provide a defensible basis for authorization decisions. Relying on a single method or waiting arbitrarily would undermine the assessment's credibility and completeness.

Answer

Use automated tools exclusively for all controls to eliminate human error and ensure consistency.

Answer

Rely solely on interviews with system administrators to verify technical controls because they are the most knowledgeable.

Answer

Conduct the assessment only after the system has been in operation for at least one year to gather sufficient operational data.