CGRC Practice Test 7 — 10 Questions

Question 1

You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider. The control is documented in the system security plan as 'Inherited'. What is the most critical item to verify during assessment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

That the control is implemented correctly and consistently by the common control provider.. When a control is inherited, the system owner depends on the common control provider for its implementation. Therefore, the most critical verification is that the control is implemented correctly and consistently. This ensures the inheritance is valid and the system's security posture is not compromised by relying on an ineffective control.

Answer

That the common control provider has a current authorization to operate.

Answer

That the system owner has signed a memorandum of understanding with the provider.

Answer

That the control is listed in the common control provider's security plan.

Question 2

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the primary, account- and bucket-level control specifically designed to override any policy or ACL that would grant public access, acting as a centralized guardrail. It can be applied at the account level to prevent any bucket from becoming public, which is the strongest preventive mechanism. This directly addresses the requirement to prevent public exposure of PII stored in S3.

Answer

Encryption at Rest

Answer

Bucket ACLs

Answer

IAM User Permissions

Question 3

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Accepted Answer

Explicit assignment of policy ownership and accountability.. Option B is correct because effective governance requires that each policy have a clearly identified owner who is accountable for its maintenance, enforcement, and review, ensuring there is no ambiguity about who is responsible. Option D is correct because a GRC policy must contain clear, unambiguous policy statements tied to organizational objectives, so that the controls and requirements directly support the business goals and can be measured and audited. Options A, C, and E are incorrect because a CISO's home address, employees' social media handles, and a website color scheme are irrelevant operational or personal details that do not contribute to policy ownership, accountability, or alignment with organizational objectives.

Answer

The home address of the CISO.

Answer

A list of all employees' social media handles.

Answer

The exact color scheme of the company website.

Question 4

An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end, an application server, and a database. The database is hosted in a separate virtual private cloud (VPC) managed by the same organization. The ISO wants to minimize the boundary while ensuring all necessary components are included. What should the ISO do?

Accepted Answer

Include the web front-end, application server, and database in the boundary, and document the network segmentation and controls between the VPCs.. The authorization boundary must include all components that process, store, or transmit system data, regardless of their location. The database, even in a separate VPC, is part of the system. Documenting the network segmentation and controls ensures that the interconnections are assessed. Excluding the database or the network infrastructure would create gaps, while including the entire organization would be overbroad. The ISO should define a boundary that accurately reflects the system's logical and physical components.

Answer

Define the boundary as the entire organization's network because all components are managed by the same organization.

Answer

Include only the web front-end and application server, treating the database as an external service because it is in a separate VPC.

Answer

Include the web front-end, application server, and database, but exclude the network infrastructure that connects the VPCs.

Question 5

A security analyst is documenting the authorization boundary for a new system. The system will be deployed on a government cloud environment and will interface with an external identity provider for authentication. The identity provider is owned and operated by another agency. How should the analyst represent the external identity provider in the authorization boundary documentation?

Accepted Answer

Document the identity provider as an external interface and describe the trust relationship and any inherited controls.. The external identity provider should be documented as an external interface, with details about the trust relationship and any inherited controls. This aligns with NIST SP 800-37, which requires external dependencies to be described in the authorization boundary documentation. This ensures that the system's risk assessment considers the provider's security posture and any reliance on its controls.

Answer

Represent the identity provider as a common control that is fully inherited without further documentation.

Answer

Exclude the identity provider entirely from the boundary documentation because it is external.

Answer

Include the identity provider as an internal component of the system boundary because it is critical to authentication.

Question 6

You are conducting an assessment of a cloud service provider's (CSP) compliance with the FedRAMP Moderate baseline. The CSP has provided a system security plan (SSP) and a set of assessment procedures. You notice that the SSP indicates that a particular control is inherited from the underlying IaaS provider. What is the most appropriate action to verify the effectiveness of this inherited control?

Accepted Answer

Request and review the IaaS provider's FedRAMP authorization package and assess the control there.. The correct action is to request and review the IaaS provider's FedRAMP authorization package. Inherited controls are assessed by the provider that implements them, and their assessment results are documented in their authorization package. The CSP's assessor should verify that the inherited control is covered by a current authorization and that it meets the required baseline. This approach avoids duplication and ensures a reliable assessment.

Answer

Mark the control as 'not applicable' in the assessment because it is inherited.

Answer

Conduct interviews with the CSP's staff to confirm that they rely on the IaaS provider's control.

Answer

Directly test the inherited control as if it were implemented by the CSP.

Question 7

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Accepted Answer

Verifying user account permissions and group assignments. Least privilege means each user, process, and service has only the minimum permissions necessary to perform its function. The most direct audit activity is therefore to examine user account permissions, group memberships, sudoers entries, and file/directory ACLs to verify that no account has excessive rights. This directly tests the control's design and operation against the principle.

Answer

Running a Nessus vulnerability scan

Answer

Checking for physical server room access

Answer

Reviewing system logs for failed login attempts

Question 8

Which document is used to standardize the implementation of security controls across an organization?

Accepted Answer

Security Baseline. A security baseline is a documented set of minimum security configurations and controls that must be applied consistently across an organization's systems. It standardizes the implementation of security controls by providing a reference configuration (e.g., CIS Benchmarks, DISA STIGs) that ensures all systems meet a consistent security posture. Baselines are used to harden systems and are a key part of configuration management.

Answer

Incident Response Plan

Answer

Risk Register

Answer

Acceptable Use Policy

Question 9

A financial services firm operates a system processing customer credit data under an active Authority to Operate (ATO). A quarterly review shows that a recent operating system upgrade altered the configuration of the audit logging service, causing it to stop forwarding events to the central log server. The GRC analyst must determine the correct action to maintain the system's security posture and ATO validity. What should the analyst do FIRST?

Accepted Answer

Initiate a security impact analysis to evaluate the change and determine if the ATO conditions are affected.. A security impact analysis is the correct first step because it systematically evaluates how the configuration change affects the system's security controls and whether the existing ATO remains valid. It ensures that any remediation or reauthorization is based on a documented risk assessment, as required by NIST SP 800-37 and continuous monitoring guidance. This approach balances operational needs with compliance obligations.

Answer

Update the system security plan to reflect the new configuration and continue operations without further assessment.

Answer

Immediately revoke the ATO until the logging service is fully restored and verified.

Answer

Schedule a full security control assessment (SCA) for the next annual review cycle.

Question 10

A global retailer's GRC team is preparing for an external audit of its compliance program. The auditor requests evidence that the program's governing body has reviewed and approved the risk appetite and tolerance levels within the last twelve months. Which activity satisfies this request?

Accepted Answer

The risk committee's meeting minutes record approval of the risk appetite statement. The auditor needs evidence that the governing body reviewed and approved risk appetite and tolerance levels within twelve months. Meeting minutes recording that approval are the direct, dated governance artifact. Other documents show management activity or assurance but do not demonstrate governing body approval, which is the specific evidence requirement in the scenario.

Answer

The enterprise risk register showing current risk scores against appetite thresholds

Answer

The internal audit report on risk management process effectiveness

Answer

The chief information security officer's annual attestation of the security program