During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?
You are leading a security assessment of a financial institution's payment processing system. After defining the assessment scope and objectives, you need to select the appropriate assessment procedures. According to NIST SP 800-53A, which of the following best describes the next step in the assessment process?
You are planning a security assessment for a system that processes sensitive data. As part of the assessment, you need to gather evidence to evaluate the effectiveness of access control policies. Which TWO of the following activities are considered objective evidence gathering methods according to NIST SP 800-53A? (Choose two.)
You are an assessor for an organization seeking ISO/IEC 27001 certification. During the Stage 1 audit, you identify that the information security management system (ISMS) documentation is incomplete, particularly regarding risk treatment plans. According to ISO/IEC 27001, what is the most appropriate action for the certification body to take?
You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?
You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?
During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?
During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?
You are leading a security assessment team using the NIST Risk Management Framework (RMF). During the 'Assess' step, your team must determine the overall effectiveness of the security controls implemented in a new system. The system owner asks which activities are essential to complete this assessment step. (Choose two.)
During an assessment of a federal information system, you are evaluating the implementation of the access control policy. You discover that the system administrator has granted temporary elevated privileges to a user for a critical maintenance task, but the privileges were not revoked after the task was completed. According to NIST SP 800-53A, which assessment method would best verify the effectiveness of the account management control?
You are conducting a security assessment of a cloud service provider's environment. The provider claims that its system meets the FedRAMP Moderate baseline. As part of your assessment, you need to verify that the provider has implemented the required continuous monitoring activities. Which document should you review to find the provider's continuous monitoring strategy and deliverables?
You are the lead auditor for a CGRC assessment of a government agency's financial system. The system owner claims that a new access control mechanism has been implemented and is operating effectively. You need to gather sufficient appropriate evidence to support your conclusion. Which evidence-gathering technique provides the MOST reliable evidence regarding the operating effectiveness of this control?
An organization is undergoing a periodic security assessment of its production environment. The assessment team lead needs to ensure that the assessment scope is formally agreed upon and that all relevant stakeholders understand the boundaries. Which document should the team lead produce FIRST to establish this shared understanding?
You are conducting an audit of a cloud service provider's continuous monitoring program. The provider claims to follow NIST SP 800-137 guidelines. You need to verify that the organization's continuous monitoring strategy includes the required elements for ongoing assessment of security controls. Which TWO elements are essential components of an effective continuous monitoring program according to NIST SP 800-137? (Choose two.)
A security assessor is reviewing audit logs from a critical server. The logs show that a user account with administrative privileges was used to access sensitive files outside of normal business hours. The assessor needs to determine whether this activity was authorized. Which type of evidence would BEST support this determination?
You are an ISSO preparing for an upcoming CGRC assessment of a major information system. The auditor has requested a kickoff meeting to discuss the scope, objectives, and logistics of the assessment. What is the PRIMARY purpose of this kickoff meeting?
An organization is preparing for a compliance audit against ISO/IEC 27001. The internal audit team needs to gather evidence that the information security management system (ISMS) is operating effectively. Which activity is MOST appropriate for the team to perform?
You are leading a security assessment for a federal agency using NIST SP 800-53A. During the 'Develop Assessment Procedures' step, your team must tailor the assessment procedures to the system's specific environment. Which action should you take FIRST to ensure the procedures are appropriately scoped?
You are reviewing the audit documentation of a junior assessor who tested a contingency planning control. The assessor noted that the control was 'effective' based on a tabletop exercise conducted six months ago. The system has undergone a major architecture change since then. According to CGRC assessment principles, what is the MOST significant deficiency in the assessor's conclusion?
As an ISC2 CGRC candidate, you are asked to distinguish between different types of audits. Which type of audit is characterized by an independent external party evaluating an organization's security controls to provide assurance to stakeholders?
You are an auditor evaluating the results of a security assessment. The assessment team identified a high-risk finding related to inadequate logging and monitoring. The system owner disagrees with the finding and argues that compensating controls mitigate the risk. As the auditor, what should you do NEXT to resolve this disagreement?
A security assessor is evaluating an organization's access control policy. The assessor needs to verify that the policy includes all required elements for compliance with a specific framework. Which of the following would be the MOST reliable source of evidence to confirm the policy's content?
You are conducting an assessment of a cloud service provider's (CSP) compliance with the FedRAMP Moderate baseline. The CSP has provided a system security plan (SSP) and a set of assessment procedures. You notice that the SSP indicates that a particular control is inherited from the underlying IaaS provider. What is the most appropriate action to verify the effectiveness of this inherited control?
You are conducting a security assessment of a government agency's network. During evidence collection, you must ensure the integrity and authenticity of the evidence. Which TWO of the following actions are most critical to maintain the integrity of audit evidence? (Choose two.)
A security assessment team is planning to assess an organization's incident response capability. The team lead must ensure that the assessment covers the necessary components to evaluate the effectiveness of the incident response process. Which TWO of the following should be included in the assessment scope? (Choose two.)
You are an internal auditor tasked with assessing the effectiveness of your organization's security controls. You have full access to internal documentation and personnel. Which type of audit are you performing?
You are assessing an organization's compliance with the Payment Card Industry Data Security Standard (PCI DSS). As part of the assessment, you need to verify that the organization has implemented proper access control measures for its cardholder data environment (CDE). Which of the following assessment activities would best provide objective evidence of compliance with PCI DSS Requirement 7 (Restrict access to cardholder data by business need to know)?
You are an assessor for a cloud service provider (CSP) undergoing a FedRAMP Moderate baseline assessment. During the assessment, you discover that a required control (AC-2 Account Management) is not fully implemented. According to the FedRAMP assessment process, what is the next step you must take?
During a security control assessment of a U.S. federal information system, the assessment team must verify that the system's boundary protection controls meet the requirements of NIST SP 800-53 Rev. 5. The team has already collected the system security plan and the most recent security assessment report. Which action should the team take NEXT to obtain independent evidence of the implemented controls?
A security assessor is evaluating an organization's continuous monitoring program as part of a NIST SP 800-137 assessment. The assessor must verify that the program includes the essential elements required for effective ongoing situational awareness. Which TWO elements are essential components of a continuous monitoring program? (Choose two.)
An organization is preparing for an independent security assessment of its cloud-hosted customer relationship management (CRM) system. The assessment will evaluate compliance with the organization's security policies and applicable regulations. Which document should the assessor request FIRST to understand the system's boundary, components, and data flows?