CGRC Practice Test 7 — 10 Questions

Question 1

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement is the process of adjusting the implementation of a control to be more specific to the technology or mission.

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 2

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Accepted Answer

Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0. Security groups are stateful; allowing inbound traffic automatically allows the return traffic, and the default is to deny all other traffic.

Answer

Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0

Answer

Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0

Answer

Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32

Question 3

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A Bastion Host with MFA ensures that access to production is controlled, logged, and authenticated securely.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 4

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Accepted Answer

Use an established 'Data Connector' or 'API Integration' module.. Using pre-built API connectors or 'Data Integrators' provided by the GRC platform is the standard way to ingest external security data.

Answer

Build a custom script to write directly to the GRC database tables.

Answer

Manually export and import CSV files every hour.

Answer

Have the CSPM tool email screenshots of security alerts to the GRC team.

Question 5

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. A 'Scheduled Assessment' or 'Workflow Trigger' based on 'Vendor Criticality' ensures compliance with due diligence timelines.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 6

What document provides the most granular guidance on tailoring security controls for federal systems?

Accepted Answer

NIST SP 800-53.. NIST SP 800-53, specifically the tailoring guidance section, provides the framework for modifying baselines.

Answer

FIPS 200.

Answer

NIST SP 800-37.

Answer

CNSSI 1253.

Question 7

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Accepted Answer

It provides a standardized set of controls for a specific technology stack.. Overlays are pre-defined sets of controls that address specific environments, technologies, or missions, ensuring consistent security posture.

Answer

It replaces the need for FIPS 199 categorization.

Answer

It eliminates the need for manual tailoring.

Answer

It automatically tests the controls for compliance.

Question 8

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. An inaccurate boundary leads to 'security gaps' where assets go unmonitored or unprotected.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 9

When configuring an email security gateway (e.g., Proofpoint), which record should be added to DNS to prevent domain spoofing?

Accepted Answer

SPF. SPF, DKIM, and DMARC are the trifecta of email authentication; SPF is the most foundational DNS record for authorized senders.

Answer

CNAME

Answer

A

Answer

MX

Question 10

Which THREE of the following are components of a secure server hardening process?

Accepted Answer

Applying security patches. Disabling unnecessary services, updating software, and using minimal feature sets are key to reducing the attack surface.

Answer

Installing all available third-party software

Answer

Running the web server as the root user