CGRC Practice Test 8 — 10 Questions

Question 1

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Accepted Answer

Network architecture diagrams.. The AO needs visual, written, and logical proof of what they are authorizing.

Answer

The janitorial service contract for the building.

Answer

The organization's holiday schedule.

Question 2

Which TWO of the following are examples of physical security controls?

Accepted Answer

Security cameras. Physical controls protect the physical facility and hardware.

Answer

Host-based firewall

Answer

Strong password policy

Answer

Encryption of database tables

Question 3

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Accepted Answer

System boundary and authorization boundary. Identifying the scope and boundaries of the system is the prerequisite for developing a SAP to ensure all components under the authorization boundary are evaluated.

Answer

Security control baselines

Answer

Contingency plan testing

Answer

Risk acceptance threshold

Question 4

Which THREE categories of controls are identified in NIST SP 800-53?

Accepted Answer

Operational. NIST categorizes controls into Technical, Management, and Operational families.

Answer

Financial

Answer

Environmental

Question 5

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

Accepted Answer

Implement Separation of Duties. Separation of duties ensures no single administrator has total control over all aspects, minimizing risk.

Answer

Disable all auditing

Answer

Store passwords in plain text

Answer

Use a single shared account

Question 6

Which document is used to standardize the implementation of security controls across an organization?

Accepted Answer

Security Baseline. A Security Baseline (or Standard) provides the specific, actionable configuration requirements for assets.

Answer

Incident Response Plan

Answer

Risk Register

Answer

Acceptable Use Policy

Question 7

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Accepted Answer

To provide a standardized starting point based on impact level.. NIST SP 800-53B focuses on establishing a starting point of security controls based on the FIPS 199 impact categorization to ensure a minimum security posture.

Answer

To remove all controls that do not apply to the local network.

Answer

To define the continuous monitoring strategy for the system.

Answer

To identify all system-specific compensations.

Question 8

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. The AO reviews and approves the selected control set to ensure it meets the risk appetite of the organization.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 9

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing recovery keys in Active Directory Domain Services (AD DS) ensures central management and recovery capability for IT staff.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop

Question 10

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data partitioning or 'Multi-Tenancy/Geographic Segregation' allows GRC platforms to isolate data based on geographic origin.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.