CGRC Assessment And Audit — Timed 10 Questions

Question 1

During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?

Accepted Answer

Testing technical controls. Testing is considered objective because it involves hands-on verification of a system's configuration or behavior, rather than relying on subjective human input (interview).

Answer

Reviewing policies

Answer

Interviewing the IT manager

Answer

Observing physical access

Question 2

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

Accepted Answer

To provide a language for checking system configuration state. OVAL (Open Vulnerability and Assessment Language) is used to verify the state of a system's security configuration, such as registry keys or file permissions.

Answer

To standardize the transfer of vulnerability data

Answer

To define the severity of a vulnerability

Answer

To manage the lifecycle of a POA&M

Question 3

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

Accepted Answer

Assess Security Controls. According to NIST SP 800-53A, the assessment process is a linear flow where the 'Prepare for Assessment' phase leads directly into the 'Assess Security Controls' phase to execute the test procedures.

Answer

Analyze Security Assessment Results

Answer

Develop the Plan of Action and Milestones (POA&M)

Answer

Authorize the Information System

Question 4

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

Accepted Answer

Rules of Engagement. The Rules of Engagement (ROE) define the boundaries, scope, and procedures for an assessment, ensuring both parties understand the limitations.

Answer

Interconnection Security Agreement

Answer

Security Assessment Plan

Answer

Risk Assessment Report

Answer

System Security Plan

Question 5

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

Accepted Answer

Disaster recovery plan test results. Availability requires that systems be available for operation as agreed. Business continuity and disaster recovery testing provide evidence of this.

Answer

Privacy policy publication

Answer

Encryption of data at rest

Answer

User access review logs

Question 6

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Accepted Answer

Document the weakness in a Plan of Action and Milestones (POA&M). FedRAMP requires that all open vulnerabilities and control weaknesses identified during an assessment be documented in a POA&M for tracking and remediation.

Answer

Immediately terminate the cloud service

Answer

Perform a penetration test

Answer

Request a waiver from the JAB

Answer

Update the System Security Plan (SSP) to reflect compliance

Question 7

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Accepted Answer

Verifying user account permissions and group assignments. Reviewing /etc/passwd and /etc/group files and comparing user permissions against assigned roles is a direct method to verify least privilege.

Answer

Running a Nessus vulnerability scan

Answer

Checking for physical server room access

Answer

Reviewing system logs for failed login attempts

Question 8

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Accepted Answer

Greater reliance on third-party audit reports. In a cloud environment, the provider manages the physical and infrastructure controls (inherited), meaning the assessor focuses on verifying the provider's attestations (like SOC 2 reports).

Answer

POA&M is prohibited for cloud providers

Answer

Physical security is no longer assessed

Answer

Manual testing is mandated for all controls

Question 9

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 10

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

Accepted Answer

Update the POA&M with a remediation plan. The system owner is responsible for prioritizing the remediation of high-risk items and ensuring the POA&M reflects the timeline and resource allocation for fixing them.

Answer

Delete the finding from the report

Answer

Transfer the risk to the IT staff

Answer

Accept the risk without documentation