CGRC Practice Test 8 — 10 Questions

Question 1

Which TWO of the following are considered 'technical' security controls?

Accepted Answer

Encryption of data in transit. Encryption of data in transit (C) is a technical security control because it is implemented through cryptographic mechanisms and protocols such as TLS to protect data as it moves across networks, directly enforcing protection at the system level. Access Control Lists (ACLs) (D) are also technical controls since they are configured on devices like routers, firewalls, and operating systems to permit or deny traffic and resource access based on defined rules. In contrast, an annual risk assessment (A) is a management/administrative control involving analysis and decision-making rather than a technical mechanism, and security policies (B) are administrative controls that define rules and expectations in documentation. Fencing around the data center (E) is a physical control that deters or blocks physical intrusion, not a technical one.

Answer

Annual risk assessment

Answer

Security policies

Answer

Fencing around the data center

Question 2

During continuous monitoring, you discover that a security control that was previously assessed as effective is now failing because the responsible team stopped performing the control due to staff turnover. The control is critical for protecting sensitive data. What is the most appropriate immediate action for the GRC analyst to take?

Accepted Answer

Immediately notify the system owner and ISSO, and initiate a security impact analysis to determine the risk and required remediation.. A failing critical control requires immediate escalation to the system owner and ISSO, followed by a security impact analysis to assess the risk and determine remediation. This ensures timely action and informed decision-making. Waiting, revoking the ATO unilaterally, or removing the control from the SSP are inappropriate because they either delay risk mitigation or bypass proper governance processes.

Answer

Update the system security plan to remove the control and document that it is no longer required.

Answer

Document the failure in the POA&M and wait for the next scheduled assessment to verify if the control is still failing.

Answer

Revoke the system's Authority to Operate (ATO) until the control is restored and reassessed.

Question 3

You are leading a security assessment for a federal agency using NIST SP 800-53A. During the 'Develop Assessment Procedures' step, your team must tailor the assessment procedures to the system's specific environment. Which action should you take FIRST to ensure the procedures are appropriately scoped?

Accepted Answer

Review the system security plan (SSP) to identify the implemented controls and their specific parameters.. The correct answer is to review the system security plan first. The SSP provides the blueprint of implemented controls, including any tailoring or inherited controls. This ensures that assessment procedures are scoped correctly and that resources are focused on relevant controls. Without this step, the assessment may be misaligned with the actual system, leading to inaccurate results and wasted effort.

Answer

Immediately begin testing technical controls to gather objective evidence.

Answer

Select a sample of controls from the NIST SP 800-53 catalog to reduce assessment effort.

Answer

Conduct interviews with system administrators to understand the operational environment.

Question 4

What is the primary goal of the 'Assessment Reporting' phase?

Accepted Answer

To communicate findings to stakeholders. The Assessment Reporting phase in the RMF (Risk Management Framework) and similar assessment lifecycles exists specifically to document and communicate assessment results—findings, risks, and recommendations—to key stakeholders such as authorizing officials, system owners, and oversight bodies. Its core purpose is not remediation or control selection, but ensuring decision-makers have the information needed to make risk-based decisions (e.g., authorization to operate). Thus, 'communicate findings to stakeholders' accurately captures the primary goal.

Answer

To terminate the contract

Answer

To select new security controls

Answer

To patch all identified vulnerabilities

Question 5

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Accepted Answer

Availability.. FIPS 199 defines three security objectives for information types and information systems: confidentiality, integrity, and availability, so the two correct answers here are A (Availability) and E (Confidentiality). Availability (A) is correct because FIPS 199 requires assessing the potential impact of a loss of timely and reliable access to the system and its data, with the resulting categorization of low, moderate, or high. Confidentiality (E) is correct because FIPS 199 requires evaluating the impact of unauthorized disclosure of information, again producing a low, moderate, or high rating. The unmarked options do not belong because authentication, accountability, and non-repudiation are not among the three FIPS 199 impact objectives; they are related security services or controls addressed in other standards such as FIPS 200 and NIST SP 800-53, not the FIPS 199 impact triad.

Answer

Authentication.

Answer

Accountability.

Answer

Non-repudiation.

Question 6

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Before any IT asset holding sensitive information leaves organizational control, the storage media must be sanitized using an approved standard (e.g., NIST SP 800-88 Rev. 1 purge or clear, or physical destruction) to prevent data remanence and unauthorized disclosure. This is the control that directly addresses the confidentiality risk of disposal; all other steps are administrative or operational and do not protect the data itself.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 7

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

Accepted Answer

Apply a 'Category Filter' or 'Saved View' to the dashboard widget.. To display only risks associated with 'Cybersecurity' on a Risk Heat Map, you should apply a 'Category Filter' or 'Saved View' to the dashboard widget. This allows the executive to see a filtered subset of risks without altering the underlying data or system configuration. Filters and saved views are standard features in GRC platforms for customizing dashboards based on user needs.

Answer

Change the risk rating scale from 1-5 to 1-10.

Answer

Delete all non-cybersecurity risks from the system.

Answer

Create a new database user for the executive.

Question 8

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A jump server (bastion host) with multi-factor authentication (MFA) enforces a controlled, auditable entry point to the production network, requiring a second authentication factor before any access is granted. This architecture centralizes access logging, session recording, and credential management, and it prevents direct exposure of production servers to the internet. By combining a hardened intermediary with MFA, the organization achieves defense in depth and satisfies least-privilege and non-repudiation requirements.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 9

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Accepted Answer

Document the weakness in a Plan of Action and Milestones (POA&M). In FedRAMP, when a cloud environment does not meet a required control, the mandatory next step is to document the weakness in a Plan of Action and Milestones (POA&M). The POA&M tracks the non-compliance, including remediation tasks, timelines, and responsible parties. This is required by FedRAMP and NIST SP 800-37. The other options are either not mandatory or inappropriate.

Answer

Immediately terminate the cloud service

Answer

Perform a penetration test

Answer

Request a waiver from the JAB

Answer

Update the System Security Plan (SSP) to reflect compliance

Question 10

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Option B (Chain of custody documentation) is correct because integrity of audit evidence requires an unbroken, auditable record of who collected, handled, transferred, and stored the evidence, ensuring it has not been tampered with or substituted. Option C (Use of cryptographic hashes for log files) is correct because hashing algorithms such as SHA-256 produce a fixed digest that verifies the log data has not been altered, providing a mathematically verifiable integrity check. Option E (Restricting access to the audit evidence folder) is correct because enforcing least-privilege access controls (e.g., NTFS or POSIX permissions, role-based access) prevents unauthorized modification or deletion, preserving the evidence's integrity. Option A (Publishing evidence to the company website) is not appropriate because public disclosure exposes evidence to alteration and does not preserve integrity. Option D (Printing all evidence on paper) is not essential because paper copies can be forged or altered and do not provide cryptographic verification of the original digital data.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper