CGRC Assessment And Audit Practice Test 3 — 15 Questions

Question 1

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. During the Assessment Execution phase, the assessor gathers evidence to evaluate security controls, so reviewing system documentation (C) is correct because examining policies, procedures, and architecture documents establishes what controls are documented and how the system is intended to operate. Testing system configuration (D) is correct because hands-on examination and testing of settings, services, and parameters verifies whether controls are actually implemented as intended. Interviewing key personnel (E) is correct because discussions with system owners, administrators, and users provide essential evidence about operational practices and control effectiveness that documentation and testing alone may not reveal. Developing the final risk strategy (A) belongs to earlier planning and scoping activities, and purchasing new hardware (B) is an implementation or remediation activity, not part of executing the assessment itself.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 2

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) (A) is critical because NIST SP 800-53 compliance verification requires documenting the system boundary, the implemented security controls, and how each control satisfies the selected baseline, which is exactly what the SSP provides. The Security Assessment Report (SAR) (C) is also essential because it records the independent assessor's findings on whether the controls in the SSP are implemented correctly and effectively, giving the evidence needed to judge compliance. The Plan of Action and Milestones (POA&M) (E) is required as well, since it tracks identified control deficiencies, remediation tasks, responsible parties, and milestone dates, which NIST SP 800-53 and the RMF use to manage residual risk and demonstrate progress toward compliance. The annual report of stock performance (B) is a financial document unrelated to security control assessment, and the internal marketing strategy (D) concerns business promotion rather than NIST SP 800-53 controls, so neither belongs in a compliance verification process.

Answer

Annual report of stock performance

Answer

Internal marketing strategy

Question 3

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Option B (Chain of custody documentation) is correct because integrity of audit evidence requires an unbroken, auditable record of who collected, handled, transferred, and stored the evidence, ensuring it has not been tampered with or substituted. Option C (Use of cryptographic hashes for log files) is correct because hashing algorithms such as SHA-256 produce a fixed digest that verifies the log data has not been altered, providing a mathematically verifiable integrity check. Option E (Restricting access to the audit evidence folder) is correct because enforcing least-privilege access controls (e.g., NTFS or POSIX permissions, role-based access) prevents unauthorized modification or deletion, preserving the evidence's integrity. Option A (Publishing evidence to the company website) is not appropriate because public disclosure exposes evidence to alteration and does not preserve integrity. Option D (Printing all evidence on paper) is not essential because paper copies can be forged or altered and do not provide cryptographic verification of the original digital data.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper

Question 4

Which THREE roles are typically involved in a security assessment?

Accepted Answer

Assessor / Auditor. The Assessor/Auditor (C) is correct because this role performs the actual evaluation of controls, gathers evidence, and reports findings against a defined framework or scope. The Chief Information Security Officer (D) is correct because the CISO owns the security program, approves the assessment scope and criteria, and receives and acts on the results at an executive level. The System Owner (E) is correct because this role is accountable for the system being assessed, provides access and documentation, and is responsible for remediating identified weaknesses. Customer support agents (A) and an external public relations firm (B) are not typically core roles in a security assessment; they may be interviewed or consulted in specific cases, but they do not own, conduct, or authorize the assessment.

Answer

Customer support agents

Answer

External public relations firm

Question 5

Which THREE types of findings might appear in an audit report?

Accepted Answer

Operational observations. An audit report focuses on the state of controls, compliance, and risk, so Operational observations (B) are correct because auditors routinely document how processes and controls actually function in practice, including gaps between policy and execution. Documentation deficiencies (C) are correct because missing, incomplete, or outdated records (e.g., policies, logs, change tickets, evidence of approvals) are classic audit findings that undermine traceability and compliance. Critical vulnerabilities (D) are correct because unpatched or high-severity security weaknesses (e.g., CVEs rated Critical, missing patches, misconfigurations) are material findings that auditors report due to their risk impact. Employee performance pay (A) and office furniture inventory (E) are not audit-report finding types in this context; compensation decisions and furniture asset counts are administrative or HR/facilities matters, not control, compliance, or security findings.

Answer

Employee performance pay

Answer

Office furniture inventory

Question 6

You are leading a security assessment team using the NIST Risk Management Framework (RMF). During the 'Assess' step, your team must determine the overall effectiveness of the security controls implemented in a new system. The system owner asks which activities are essential to complete this assessment step. (Choose two.)

Accepted Answer

Develop a security assessment plan (SAP) that defines the scope, methods, and procedures for assessing each control.. The Assess step in the RMF requires developing a security assessment plan (SAP) and producing a security assessment report (SAR). These artifacts ensure that the assessment is systematically planned and that results are clearly documented for decision-makers. Tabletop exercises, penetration tests, and continuous monitoring are valuable but belong to other phases or are specialized techniques, not essential activities for completing the Assess step.

Answer

Conduct a tabletop exercise to simulate a cyber attack and evaluate the incident response team's performance.

Answer

Implement a continuous monitoring strategy to track control effectiveness over time.

Answer

Perform a penetration test to identify vulnerabilities in the system's external interfaces.

Question 7

During an assessment of a federal information system, you are evaluating the implementation of the access control policy. You discover that the system administrator has granted temporary elevated privileges to a user for a critical maintenance task, but the privileges were not revoked after the task was completed. According to NIST SP 800-53A, which assessment method would best verify the effectiveness of the account management control?

Accepted Answer

Examine the system's audit logs and account management records to verify that temporary privileges were revoked within the required timeframe.. Examining audit logs and account management records is the best method because it provides objective, verifiable evidence of whether temporary privileges were revoked as required. Interviews and policy reviews are subjective or indirect, and testing may not reveal the full extent of the issue. The assessment should focus on actual system data to determine control effectiveness.

Answer

Test the system by attempting to access resources using the user's account to see if elevated privileges are still active.

Answer

Interview the system administrator to understand the process for granting and revoking temporary privileges.

Answer

Review the organization's access control policy to ensure it requires timely revocation of temporary privileges.

Question 8

You are conducting a security assessment of a cloud service provider's environment. The provider claims that its system meets the FedRAMP Moderate baseline. As part of your assessment, you need to verify that the provider has implemented the required continuous monitoring activities. Which document should you review to find the provider's continuous monitoring strategy and deliverables?

Accepted Answer

The continuous monitoring plan (CMP).. The continuous monitoring plan (CMP) is the correct document because it details the ongoing monitoring strategy, including frequencies, deliverables, and responsibilities. The SSP, SAR, and POA&M serve different purposes and do not contain the comprehensive continuous monitoring strategy. Under FedRAMP, the CMP is a key artifact for ensuring sustained compliance.

Answer

The system security plan (SSP).

Answer

The security assessment report (SAR).

Answer

The plan of action and milestones (POA&M).

Question 9

You are the lead auditor for a CGRC assessment of a government agency's financial system. The system owner claims that a new access control mechanism has been implemented and is operating effectively. You need to gather sufficient appropriate evidence to support your conclusion. Which evidence-gathering technique provides the MOST reliable evidence regarding the operating effectiveness of this control?

Accepted Answer

Observing the system administrator perform a user provisioning task and reperforming the access review process. Observation and reperformance yield direct, objective evidence about a control's operating effectiveness. Observing the administrator perform provisioning confirms the control is executed as intended, while reperforming the access review independently validates the outcome. These techniques reduce reliance on management assertions and provide stronger assurance than interviews, document reviews, or surveys.

Answer

Interviewing the system administrator who configured the access control mechanism

Answer

Distributing a survey to all employees asking whether they believe access controls are effective

Answer

Reviewing the system security plan to confirm the control is documented

Question 10

An organization is undergoing a periodic security assessment of its production environment. The assessment team lead needs to ensure that the assessment scope is formally agreed upon and that all relevant stakeholders understand the boundaries. Which document should the team lead produce FIRST to establish this shared understanding?

Accepted Answer

Security Assessment Plan (SAP). The Security Assessment Plan is the key document that formalizes the scope, approach, and logistics of an assessment. It ensures that all stakeholders have a common understanding of what will be assessed, how, and by whom. Without an approved SAP, the assessment lacks a controlled framework, leading to potential misunderstandings and inefficiencies. Thus, the SAP is the correct first step.

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

System Security Plan (SSP)

Question 11

You are conducting an audit of a cloud service provider's continuous monitoring program. The provider claims to follow NIST SP 800-137 guidelines. You need to verify that the organization's continuous monitoring strategy includes the required elements for ongoing assessment of security controls. Which TWO elements are essential components of an effective continuous monitoring program according to NIST SP 800-137? (Choose two.)

Accepted Answer

A configuration management process that tracks changes to the system. NIST SP 800-137 emphasizes a risk-based approach to continuous monitoring, including configuration management to track changes and a defined frequency for assessing controls. These elements ensure the organization maintains an accurate baseline and evaluates controls at appropriate intervals. Annual penetration tests and board-only reporting are not required, and automation is encouraged but not mandated.

Answer

An annual penetration test performed by an external third party

Answer

A process for reporting monitoring results to the board of directors only

Answer

A requirement to use only automated tools for all monitoring activities

Question 12

A security assessor is reviewing audit logs from a critical server. The logs show that a user account with administrative privileges was used to access sensitive files outside of normal business hours. The assessor needs to determine whether this activity was authorized. Which type of evidence would BEST support this determination?

Accepted Answer

A signed change request or maintenance window approval from management. To determine whether after-hours administrative access was authorized, the assessor needs evidence that links the activity to an approved business process. A signed change request or maintenance window approval is documentary evidence that explicitly authorizes the access. It is objective, verifiable, and directly relevant. Other types of evidence, such as logs or interviews, may support the timeline but do not establish authorization.

Answer

Interview notes from the system administrator stating they sometimes work late

Answer

A screenshot of the file directory showing the sensitive files

Answer

System-generated audit logs showing the access time and user ID

Question 13

You are an ISSO preparing for an upcoming CGRC assessment of a major information system. The auditor has requested a kickoff meeting to discuss the scope, objectives, and logistics of the assessment. What is the PRIMARY purpose of this kickoff meeting?

Accepted Answer

To establish a common understanding of the assessment scope, objectives, and roles. A kickoff meeting aligns the auditor and the organization on the assessment's scope, objectives, timeline, and roles. It ensures that both parties understand what will be assessed, how evidence will be gathered, and who will be involved. This planning step is critical for a smooth assessment and is distinct from fieldwork, reporting, or contracting activities.

Answer

To perform detailed testing of security controls and document findings

Answer

To negotiate the auditor's fee and sign the engagement letter

Answer

To present the final audit report and obtain management's response

Question 14

An organization is preparing for a compliance audit against ISO/IEC 27001. The internal audit team needs to gather evidence that the information security management system (ISMS) is operating effectively. Which activity is MOST appropriate for the team to perform?

Accepted Answer

Reviewing the ISMS scope statement and security policy. An ISO/IEC 27001 internal audit should focus on the ISMS processes and documentation. Reviewing the ISMS scope statement and security policy is a direct way to verify that the organization has established the framework for its information security management. This activity aligns with the standard's requirements for audit evidence. Other options are technical tests that do not comprehensively assess the ISMS.

Answer

Interviewing the IT manager about server uptime

Answer

Conducting a penetration test on the external network

Answer

Testing the performance of a new firewall

Question 15

You are leading a security assessment for a federal agency using NIST SP 800-53A. During the 'Develop Assessment Procedures' step, your team must tailor the assessment procedures to the system's specific environment. Which action should you take FIRST to ensure the procedures are appropriately scoped?

Accepted Answer

Review the system security plan (SSP) to identify the implemented controls and their specific parameters.. The correct answer is to review the system security plan first. The SSP provides the blueprint of implemented controls, including any tailoring or inherited controls. This ensures that assessment procedures are scoped correctly and that resources are focused on relevant controls. Without this step, the assessment may be misaligned with the actual system, leading to inaccurate results and wasted effort.

Answer

Immediately begin testing technical controls to gather objective evidence.

Answer

Select a sample of controls from the NIST SP 800-53 catalog to reduce assessment effort.

Answer

Conduct interviews with system administrators to understand the operational environment.