CGRC Practice Test 9 — 10 Questions

Question 1

A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premises. The system owner wants to maximize efficiency by reducing duplicate documentation. The organization already has an enterprise-wide access control policy and a centralized identity management system. When developing the system security plan, what is the most appropriate approach for addressing the access control family controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the access control controls as common controls provided by the enterprise identity management system and reference the enterprise policy.. The correct approach is to leverage existing enterprise common controls for access control, as this reduces duplication and ensures consistency with organizational policy. Documenting them as common controls in the system security plan accurately reflects the inheritance and fulfills the requirement to address all applicable controls. This aligns with NIST SP 800-53 guidance on common controls and tailoring.

Answer

Mark all access control controls as not applicable because the enterprise identity management system handles authentication and authorization outside the system boundary.

Answer

Implement all access control controls independently within the payroll system, even if they duplicate enterprise capabilities, to ensure full control.

Answer

Select only the access control controls that are explicitly required by the payroll application vendor's security guide, ignoring the enterprise baseline.

Question 2

Which THREE of the following are elements of a secure incident response control set?

Accepted Answer

Establishing a dedicated Incident Response Team (IRT). Option A is correct because a dedicated Incident Response Team (IRT) is a core element of a secure incident response control set, providing defined roles, authority, and accountability for detecting, containing, eradicating, and recovering from security incidents. Option C is correct because a SIEM (Security Information and Event Management) system centralizes log collection, correlation, and alerting, which is essential for timely detection and analysis of incidents. Option D is correct because an updated Incident Response Plan (IRP) documents procedures, communication paths, escalation criteria, and recovery steps, ensuring a consistent and effective response. Option B is incorrect because sharing sensitive server logs on a public forum violates confidentiality and could expose credentials, PII, or exploitable system details. Option E is incorrect because disabling all security controls during an investigation removes visibility and protections, increasing risk and potentially destroying evidence.

Answer

Sharing sensitive server logs on a public forum

Answer

Disabling all security controls during an investigation

Question 3

Which THREE types of information should be included in a risk acceptance memo?

Accepted Answer

Description of the identified risk. A risk acceptance memo must document what is being accepted, so option C (Description of the identified risk) is correct because it clearly states the specific vulnerability, threat, or weakness being formally accepted. Option D (The impact on the organizational mission) is correct because decision-makers need to understand the potential business consequences, such as mission degradation, financial loss, or operational disruption, to make an informed acceptance decision. Option E (Justification for accepting the risk) is correct because it records the rationale—such as cost-benefit analysis, compensating controls, or low likelihood—that explains why the risk is being accepted rather than mitigated, transferred, or avoided. Options A and B are incorrect because vendor names and server technical specifications are asset or inventory details, not the risk-governance content required in a risk acceptance memo.

Answer

The name of the software vendor

Answer

The technical specifications of the server

Question 4

Which TWO of the following are examples of physical security controls?

Accepted Answer

Security cameras. Security cameras (B) are a physical security control because they are hardware devices deployed to monitor and record activity in a physical facility, deterring and detecting intrusions. Key card access systems (D) are also physical controls, as they use tangible badge readers and door hardware to restrict physical entry to authorized personnel. The remaining options are logical/technical controls: a host-based firewall (A) filters network traffic in software, a strong password policy (C) is an administrative control governing authentication, and encryption of database tables (E) is a technical control protecting data at rest.

Answer

Host-based firewall

Answer

Strong password policy

Answer

Encryption of database tables

Question 5

A financial services firm is implementing a new payment processing system. The security architect must ensure that all changes to the production environment are authorized, tested, and documented before deployment. Which of the following controls best addresses this requirement?

Accepted Answer

Change management process with approval workflows and segregation of duties. The requirement is for a control that ensures changes are authorized, tested, and documented. A change management process with approval workflows and segregation of duties provides this governance by requiring formal requests, reviews, and approvals before deployment. Monitoring, scanning, and RBAC are complementary but do not enforce the change lifecycle, making the change management process the correct choice.

Answer

Continuous security monitoring using a SIEM

Answer

Role-based access control (RBAC) for production systems

Answer

Vulnerability scanning of the production environment

Question 6

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. The CMVP (Cryptographic Module Validation Program) validation certificate is the authoritative, independently verified proof that a cryptographic module meets FIPS 140-3 requirements. It is issued only after NIST-accredited CST laboratory testing and CMVP review, and it lists the exact module, version, and validated security levels. This makes it the strongest and only formally recognized evidence of FIPS 140-3 compliance.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor

Question 7

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Accepted Answer

Add additional controls to the baseline to address specific threat vectors.. In NIST SP 800-53 Rev. 5 tailoring, 'supplementing' means adding controls to the baseline to address specific threats, technologies, or organizational requirements not covered by the initial baseline. The authorization official's request to supplement therefore means adding additional controls (B).

Answer

Replace a control with a vendor-provided security feature.

Answer

Remove controls from the baseline that are technically infeasible.

Answer

Adjust the parameters of existing controls to lower operational impact.

Question 8

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Accepted Answer

Inbound Rule: Type HTTPS, Port 443, Source 0.0.0.0/0. An AWS Security Group is stateful and evaluates inbound traffic against inbound rules; to permit public HTTPS access to the web server, you must create an inbound rule allowing TCP 443 from 0.0.0.0/0 (the entire IPv4 internet). The source 0.0.0.0/0 is the correct CIDR notation for 'any IPv4 address,' and specifying HTTPS/443 matches the standard secure web port. This rule satisfies the requirement to allow incoming HTTPS while other traffic remains blocked by default due to Security Groups' implicit deny.

Answer

Outbound Rule: Type HTTPS, Port 443, Destination 0.0.0.0/0

Answer

Inbound Rule: Type All Traffic, Port All, Source 0.0.0.0/0

Answer

Inbound Rule: Type HTTPS, Port 443, Source 127.0.0.1/32

Question 9

A GRC practitioner is establishing a process for maintaining the compliance program's documented information. The goal is to ensure that policies, standards, and procedures remain current, authorized, and available to the right audiences. Which TWO of the following activities are essential to this process? (Choose two.)

Accepted Answer

Defining a review cycle and assigning document owners who revalidate content. Maintaining documented information requires clear ownership with periodic review and a controlled process for versioning and approval. These two activities ensure documents stay current, authorized, and traceable. Public disclosure, personal storage, and distributed rewriting all undermine control, availability, or consistency, and therefore do not support the stated goal of a reliable documentation process.

Answer

Requiring every employee to rewrite each policy annually in their own words

Answer

Publishing all documents to the public corporate website for transparency

Answer

Storing documents only in the personal drives of the GRC team members who wrote them

Question 10

Which GRC platform component is most critical for ensuring that executive leadership receives accurate, real-time risk posture data?

Accepted Answer

The Executive Dashboard and Reporting module.. The Executive Dashboard and Reporting module is correct because it aggregates risk data from across the GRC platform and presents it in real-time, role-appropriate views for leadership. It provides the visualization, drill-down, and trend analysis executives need to make informed risk decisions. Other components support the data but do not deliver the executive-facing risk posture.

Answer

The system audit log.

Answer

The User Provisioning interface.

Answer

The API integration module.