CGRC Assessment And Audit Practice Test 2 — 15 Questions

Question 1

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

Accepted Answer

Update the POA&M with a remediation plan. Under NIST RMF and FedRAMP processes, when an assessment identifies a High risk finding, the system owner is required to document it in the Plan of Action and Milestones (POA&M) along with a remediation plan, responsible party, and milestone dates. The POA&M is the authoritative tracking artifact for unresolved weaknesses, and High findings typically require remediation within 30 days per FedRAMP timelines. Simply accepting or deleting the finding is not permitted without formal risk acceptance by the Authorizing Official.

Answer

Delete the finding from the report

Answer

Transfer the risk to the IT staff

Answer

Accept the risk without documentation

Question 2

Which standard provides the framework for conducting information security audits?

Accepted Answer

ISO/IEC 27007. ISO/IEC 27007 provides guidelines for auditing information security management systems (ISMS), specifically supporting ISO/IEC 27001 audits by detailing audit program management, auditor competence, and audit conduct. It is the standard that frameworks the conduct of information security audits, making it the correct answer.

Answer

NIST SP 800-37

Answer

PCI DSS

Answer

ISO/IEC 27001

Question 3

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Account management lifecycle controls govern the creation, review, disabling, and deletion of accounts, including timely disabling of inactive accounts. The failure to disable inactive accounts is a direct breakdown of the lifecycle control, which typically specifies inactivity thresholds (e.g., 30, 60, or 90 days) and automated or manual review processes. This maps to NIST SP 800-53 AC-2 (Account Management) and its enhancement AC-2(3) for disabling inactive accounts.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication

Question 4

What is the primary goal of the 'Assessment Reporting' phase?

Accepted Answer

To communicate findings to stakeholders. The Assessment Reporting phase in the RMF (Risk Management Framework) and similar assessment lifecycles exists specifically to document and communicate assessment results—findings, risks, and recommendations—to key stakeholders such as authorizing officials, system owners, and oversight bodies. Its core purpose is not remediation or control selection, but ensuring decision-makers have the information needed to make risk-based decisions (e.g., authorization to operate). Thus, 'communicate findings to stakeholders' accurately captures the primary goal.

Answer

To terminate the contract

Answer

To select new security controls

Answer

To patch all identified vulnerabilities

Question 5

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. The CMVP (Cryptographic Module Validation Program) validation certificate is the authoritative, independently verified proof that a cryptographic module meets FIPS 140-3 requirements. It is issued only after NIST-accredited CST laboratory testing and CMVP review, and it lists the exact module, version, and validated security levels. This makes it the strongest and only formally recognized evidence of FIPS 140-3 compliance.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor

Question 6

When conducting an audit, what is 'sampling'?

Accepted Answer

Selecting a representative subset for testing. Sampling in an audit is the process of selecting a representative subset of records or transactions for testing, rather than examining the entire population. This allows auditors to draw reasonable conclusions about the whole population while managing time and cost. The sample must be selected using a defined methodology (statistical or judgmental) to be defensible and representative.

Answer

Randomly selecting records without criteria

Answer

Testing only the most recent data

Answer

Testing every single record in a database

Question 7

What is the purpose of a 'pre-assessment' meeting?

Accepted Answer

To set expectations and coordinate logistics. A pre-assessment meeting is held before a formal assessment to align all parties on scope, schedule, roles, logistics, evidence requirements, and expectations. It ensures the assessor and the organization-under-assessment agree on what will be examined, when, by whom, and in what format evidence will be provided, reducing surprises and delays during the actual assessment.

Answer

To conduct penetration testing

Answer

To finalize the POA&M

Answer

To perform hardware inventory

Question 8

Which TWO methods are commonly used to gather assessment evidence?

Accepted Answer

Interview. Option C (Interview) is correct because interviewing stakeholders such as system owners, administrators, and users is a standard evidence-gathering technique that elicits qualitative information about processes, controls, and practices that may not be documented anywhere else. Option D (Observation) is correct because directly observing personnel performing tasks and watching systems in operation provides first-hand, verifiable evidence of whether controls and procedures are actually implemented as intended. Together, interviews and observation are recognized assessment methods (alongside examination of documents and technical testing) used to collect audit and certification evidence. Option A (Budget approval) is not an evidence-gathering method but a management/financial authorization activity. Option B (Marketing collateral review) is not a standard assessment technique, since promotional materials are not reliable audit evidence. Option E (System retirement) is a lifecycle/disposal activity, not a means of collecting assessment evidence.

Answer

Budget approval

Answer

Marketing collateral review

Answer

System retirement

Question 9

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. The most appropriate recommendation when an organization is not logging administrative access is to configure audit logging for administrative actions. This directly addresses the gap by enabling the collection of audit trails for privileged activities, which is essential for detecting and investigating security incidents, meeting compliance requirements, and ensuring accountability.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 10

Which document defines the specific security controls that an organization must implement based on its risk assessment?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the document that describes the system boundary, operational environment, and — critically — the security controls selected and implemented based on the organization's risk assessment (typically derived from NIST SP 800-53 via the RMF process). It maps each control to its implementation status and is the primary artifact reviewed during assessment and authorization. The SSP is what the assessor tests against and what the Authorizing Official uses to grant an ATO.

Answer

Incident Response Plan

Answer

Risk Management Plan

Answer

Security Assessment Report (SAR)

Question 11

What is the primary function of an assessor's 'working papers'?

Accepted Answer

To document evidence and support the findings. Working papers are the assessor's documented evidence — records of tests performed, observations, interviews, and artifacts collected — that substantiate the audit findings and conclusions. They provide the traceable link between raw evidence and reported results, enabling independent review and defending the assessment if challenged.

Answer

To list the audit team members

Answer

To submit to the regulator

Answer

To replace the need for an audit

Question 12

You are auditing a backup solution. Which metric is most critical for the Availability audit?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disruption, directly measuring the availability of the backup solution. It ensures that backups can be restored within the required timeframe to meet business continuity needs. Thus, RTO is the most critical metric for an availability audit.

Answer

Encryption key rotation

Answer

Tape rotation schedule

Answer

Backup storage capacity

Question 13

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Accepted Answer

Target completion date. Option A (Target completion date) is correct because a POA&M must specify the scheduled date by which each identified weakness will be remediated, which is essential for tracking progress and accountability. Option D (Description of the vulnerability) is correct because a POA&M must clearly identify and describe the weakness or finding being addressed so that remediation efforts can be understood and verified. Options B, C, and E are incorrect because personnel salary data, historical audit logs, and software licensing keys are not required POA&M elements; POA&Ms focus on the weakness, its remediation actions, resources, milestones, and completion dates, not on payroll, raw log history, or license keys.

Answer

Personnel salary data

Answer

Historical audit logs

Answer

Software licensing keys

Question 14

Which technique is best to detect 'false negatives' during a security control assessment?

Accepted Answer

Reviewing security log correlation. False negatives occur when a vulnerability or malicious activity exists but the assessment fails to detect it. Correlating security logs from multiple sources (endpoint, network, authentication, application) surfaces events that a single control or tool missed, revealing gaps in detection coverage. This cross-source correlation is the most reliable technique for exposing false negatives in a control assessment.

Answer

Interviewing developers

Answer

Checking server physical locks

Answer

Single tool vulnerability scanning

Question 15

Which TWO factors contribute to the 'scope' of an information security audit?

Accepted Answer

Network boundaries. The scope of an information security audit is defined by what will be examined, and option C (Network boundaries) is correct because the audit perimeter—such as internal LAN segments, DMZs, VPN entry points, and internet-facing subnets—determines which systems, traffic flows, and controls fall inside or outside the assessment. Option E (System components and assets) is also correct because the inventory of hardware, software, applications, databases, and data assets directly establishes the breadth of the audit and the controls to be tested. Options A (External stock prices) and B (Competitor market analysis) are financial and competitive-intelligence concerns unrelated to defining an audit's technical scope, and option D (Employee home addresses) is personal data that does not determine which systems or boundaries the audit covers.

Answer

External stock prices

Answer

Competitor market analysis

Answer

Employee home addresses