CGRC Assessment And Audit — 20 Questions

Question 1

During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?

Accepted Answer

Testing technical controls. Testing is considered objective because it involves hands-on verification of a system's configuration or behavior, rather than relying on subjective human input (interview).

Answer

Reviewing policies

Answer

Interviewing the IT manager

Answer

Observing physical access

Question 2

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

Accepted Answer

To provide a language for checking system configuration state. OVAL (Open Vulnerability and Assessment Language) is used to verify the state of a system's security configuration, such as registry keys or file permissions.

Answer

To standardize the transfer of vulnerability data

Answer

To define the severity of a vulnerability

Answer

To manage the lifecycle of a POA&M

Question 3

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

Accepted Answer

Assess Security Controls. According to NIST SP 800-53A, the assessment process is a linear flow where the 'Prepare for Assessment' phase leads directly into the 'Assess Security Controls' phase to execute the test procedures.

Answer

Analyze Security Assessment Results

Answer

Develop the Plan of Action and Milestones (POA&M)

Answer

Authorize the Information System

Question 4

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

Accepted Answer

Rules of Engagement. The Rules of Engagement (ROE) define the boundaries, scope, and procedures for an assessment, ensuring both parties understand the limitations.

Answer

Interconnection Security Agreement

Answer

Security Assessment Plan

Answer

Risk Assessment Report

Answer

System Security Plan

Question 5

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

Accepted Answer

Disaster recovery plan test results. Availability requires that systems be available for operation as agreed. Business continuity and disaster recovery testing provide evidence of this.

Answer

Privacy policy publication

Answer

Encryption of data at rest

Answer

User access review logs

Question 6

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Accepted Answer

Document the weakness in a Plan of Action and Milestones (POA&M). FedRAMP requires that all open vulnerabilities and control weaknesses identified during an assessment be documented in a POA&M for tracking and remediation.

Answer

Immediately terminate the cloud service

Answer

Perform a penetration test

Answer

Request a waiver from the JAB

Answer

Update the System Security Plan (SSP) to reflect compliance

Question 7

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Accepted Answer

Verifying user account permissions and group assignments. Reviewing /etc/passwd and /etc/group files and comparing user permissions against assigned roles is a direct method to verify least privilege.

Answer

Running a Nessus vulnerability scan

Answer

Checking for physical server room access

Answer

Reviewing system logs for failed login attempts

Question 8

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Accepted Answer

Greater reliance on third-party audit reports. In a cloud environment, the provider manages the physical and infrastructure controls (inherited), meaning the assessor focuses on verifying the provider's attestations (like SOC 2 reports).

Answer

POA&M is prohibited for cloud providers

Answer

Physical security is no longer assessed

Answer

Manual testing is mandated for all controls

Question 9

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 10

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

Accepted Answer

Update the POA&M with a remediation plan. The system owner is responsible for prioritizing the remediation of high-risk items and ensuring the POA&M reflects the timeline and resource allocation for fixing them.

Answer

Delete the finding from the report

Answer

Transfer the risk to the IT staff

Answer

Accept the risk without documentation

Question 11

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

Accepted Answer

Target state, Current state, Gap identification. You must define the target (what good looks like), determine the current state (as-is), and then identify the delta (gap).

Answer

Current state, Target state, Gap identification

Answer

Gap identification, Target state, Current state

Answer

Current state, Gap identification, Target state

Question 12

Which standard provides the framework for conducting information security audits?

Accepted Answer

ISO/IEC 27007. ISO/IEC 27007 provides guidance on managing an information security management system (ISMS) audit program.

Answer

NIST SP 800-37

Answer

PCI DSS

Answer

ISO/IEC 27001

Question 13

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Disabled account management is a critical detective and preventive control to ensure that only authorized, active users have access.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication

Question 14

What is the primary goal of the 'Assessment Reporting' phase?

Accepted Answer

To communicate findings to stakeholders. Reporting provides stakeholders with an accurate picture of the security posture, identified risks, and the evidence supporting the findings.

Answer

To terminate the contract

Answer

To select new security controls

Answer

To patch all identified vulnerabilities

Question 15

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. A NIST Cryptographic Module Validation Program (CMVP) certificate provides formal verification that a product has met the FIPS 140 requirements.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor

Question 16

When conducting an audit, what is 'sampling'?

Accepted Answer

Selecting a representative subset for testing. Sampling is the process of selecting a subset of data (e.g., user accounts) to represent the entire population to make an inference about the effectiveness of a control.

Answer

Randomly selecting records without criteria

Answer

Testing only the most recent data

Answer

Testing every single record in a database

Question 17

What is the purpose of a 'pre-assessment' meeting?

Accepted Answer

To set expectations and coordinate logistics. A pre-assessment or kickoff meeting ensures alignment on scope, timeline, logistics, and points of contact between the auditor and the client.

Answer

To conduct penetration testing

Answer

To finalize the POA&M

Answer

To perform hardware inventory

Question 18

Which TWO methods are commonly used to gather assessment evidence?

Accepted Answer

Interview. Assessment methods commonly include observing processes and interviewing personnel to understand implementation.

Answer

Budget approval

Answer

Marketing collateral review

Answer

System retirement

Question 19

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 20

Which document defines the specific security controls that an organization must implement based on its risk assessment?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) describes the system and the controls that have been selected (tailored) to meet security requirements.

Answer

Incident Response Plan

Answer

Risk Management Plan

Answer

Security Assessment Report (SAR)