CGRC Assessment And Audit — Timed 30 Questions

Question 1

During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?

Accepted Answer

Testing technical controls. Objective evidence gathering relies on direct observation or measurement of the control's actual operation, independent of human interpretation. Testing technical controls — for example, attempting to bypass an access control or running a configuration check — produces reproducible, verifiable results that an auditor can independently confirm. This is the hallmark of objective evidence under assessment methodologies like NIST SP 800-53A.

Answer

Reviewing policies

Answer

Interviewing the IT manager

Answer

Observing physical access

Question 2

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

Accepted Answer

Target state, Current state, Gap identification. The correct order for a gap analysis is to first define the target state (the desired future state or standard), then assess the current state (where the organization is now), and finally identify the gaps between them. This logical sequence ensures that the assessment is directed towards a known goal, and the gaps are the differences that need to be addressed.

Answer

Current state, Target state, Gap identification

Answer

Gap identification, Target state, Current state

Answer

Current state, Gap identification, Target state

Question 3

Which TWO of the following are primary components of an effective security control assessment report?

Accepted Answer

Detailed Findings and Supporting Evidence. Option A (Detailed Findings and Supporting Evidence) is correct because a security control assessment report must document each assessed control, its compliance status (satisfied, not satisfied, or not applicable), the specific weaknesses or gaps identified, and the artifacts (configurations, logs, screenshots, interview notes) that substantiate those conclusions. Option B (Executive Summary) is correct because it provides leadership with a concise, non-technical overview of the assessment scope, overall risk posture, and prioritized recommendations, enabling informed decision-making without requiring them to parse the full technical detail. The remaining options do not belong: employee performance reviews (C) are an HR function unrelated to evaluating security controls, a list of all vendor contracts (D) is a procurement/third-party management artifact rather than an assessment component (though specific vendor-related controls may be tested), and company financial statements (E) are accounting documents with no bearing on the technical or procedural adequacy of security controls.

Answer

Employee performance reviews

Answer

List of all vendor contracts

Answer

Company financial statements

Question 4

Which TWO types of controls are specifically examined during an audit?

Accepted Answer

Administrative controls. During an audit, the two control categories specifically examined are administrative controls (C) and technical controls (D). Administrative controls are correct because they encompass the policies, procedures, and governance documents—such as security policies, standards, and HR-related procedures—that auditors review to verify management's intent and compliance framework. Technical controls are correct because auditors examine the logical mechanisms implemented in systems, such as access controls, encryption, firewalls, and audit logging, to confirm they operate as intended and mitigate risks. Physical building aesthetics (A) is not a control category; physical security controls exist, but aesthetics are not audited as a control type. HR hiring policies (B) fall under administrative controls rather than being a separate audited control type. Marketing controls (E) are not a recognized control category in IT or security audits.

Answer

Physical building aesthetics

Answer

HR hiring policies

Answer

Marketing controls

Question 5

You are leading a security assessment of a financial institution's payment processing system. After defining the assessment scope and objectives, you need to select the appropriate assessment procedures. According to NIST SP 800-53A, which of the following best describes the next step in the assessment process?

Accepted Answer

Develop assessment procedures based on the security controls in scope.. The NIST SP 800-53A assessment process begins with preparation (scope, objectives, plan). Once those are set, the next logical step is to develop assessment procedures for the controls in scope. These procedures define the specific examine, interview, and test activities to be performed. Only after procedures are developed can evidence be collected and analyzed. Therefore, developing assessment procedures is the correct next step.

Answer

Prepare an assessment plan and obtain management approval.

Answer

Analyze the collected evidence and determine control effectiveness.

Answer

Conduct the assessment by collecting evidence through interviews and observations.

Question 6

You are planning a security assessment for a system that processes sensitive data. As part of the assessment, you need to gather evidence to evaluate the effectiveness of access control policies. Which TWO of the following activities are considered objective evidence gathering methods according to NIST SP 800-53A? (Choose two.)

Accepted Answer

Examining system configuration files and access control lists.. The two objective evidence gathering methods are examining system configuration files and access control lists, and testing user access by attempting unauthorized access. Both are direct methods that yield tangible, verifiable data about control implementation and effectiveness. Interviews and reviews of training records are indirect and subjective, while observing a guard addresses physical, not logical, access control.

Answer

Observing a security guard checking badges at the data center entrance.

Answer

Interviewing system administrators about their access control practices.

Answer

Reviewing the organization's security awareness training records.

Question 7

You are an assessor for an organization seeking ISO/IEC 27001 certification. During the Stage 1 audit, you identify that the information security management system (ISMS) documentation is incomplete, particularly regarding risk treatment plans. According to ISO/IEC 27001, what is the most appropriate action for the certification body to take?

Accepted Answer

Issue a nonconformity and require the organization to correct it before Stage 2.. The correct action is to issue a nonconformity and require correction before Stage 2. ISO/IEC 27001 Stage 1 is a readiness review; significant gaps like incomplete risk treatment plans must be resolved before the Stage 2 audit. This ensures that the ISMS is fully implemented and can be effectively assessed. The certification body may postpone Stage 2 until the organization provides evidence of correction.

Answer

Proceed to Stage 2 audit and address the gaps during the audit.

Answer

Conduct a full Stage 2 audit but exclude the risk treatment process from the scope.

Answer

Cancel the certification process immediately due to the incomplete documentation.

Question 8

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

Accepted Answer

To provide a language for checking system configuration state. OVAL (Open Vulnerability and Assessment Language) is the SCAP component that provides a standardized language for expressing system state checks — it defines how to test for specific configurations, patches, and vulnerabilities on a host. OVAL definitions contain tests, objects, states, and variables that an OVAL interpreter evaluates to produce a true/false result. This makes OVAL the 'checking' language of SCAP, distinct from other components like XCCDF (benchmarks) and CVE (vulnerability naming).

Answer

To standardize the transfer of vulnerability data

Answer

To define the severity of a vulnerability

Answer

To manage the lifecycle of a POA&M

Question 9

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

Accepted Answer

Assess Security Controls. NIST SP 800-53A defines the security control assessment process as: Prepare for Assessment, Assess Security Controls, Analyze Security Assessment Results, and Document/Report. Immediately after 'Prepare for Assessment' (which includes developing the assessment plan, selecting controls, and gathering artifacts), the assessor executes the 'Assess Security Controls' phase — collecting evidence through examine, interview, and test methods.

Answer

Analyze Security Assessment Results

Answer

Develop the Plan of Action and Milestones (POA&M)

Answer

Authorize the Information System

Question 10

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

Accepted Answer

Rules of Engagement. The Rules of Engagement (RoE) is the formal document that defines the scope, boundaries, timing, and authorized activities of a security assessment, and it is signed by both the assessor and the target organization before testing begins. It establishes what systems may be tested, what techniques are permitted, and the points of contact, making it the primary agreement governing the audit.

Answer

Interconnection Security Agreement

Answer

Security Assessment Plan

Answer

Risk Assessment Report

Answer

System Security Plan

Question 11

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

Accepted Answer

Disaster recovery plan test results. The Availability criterion in SOC 2 Trust Services Criteria focuses on ensuring systems are available for operation and use as committed or agreed. Disaster recovery plan test results are the most relevant evidence because they demonstrate the organization's ability to recover from disruptions and maintain availability. The other options relate to different criteria: privacy, confidentiality, or security.

Answer

Privacy policy publication

Answer

Encryption of data at rest

Answer

User access review logs

Question 12

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Accepted Answer

Document the weakness in a Plan of Action and Milestones (POA&M). In FedRAMP, when a cloud environment does not meet a required control, the mandatory next step is to document the weakness in a Plan of Action and Milestones (POA&M). The POA&M tracks the non-compliance, including remediation tasks, timelines, and responsible parties. This is required by FedRAMP and NIST SP 800-37. The other options are either not mandatory or inappropriate.

Answer

Immediately terminate the cloud service

Answer

Perform a penetration test

Answer

Request a waiver from the JAB

Answer

Update the System Security Plan (SSP) to reflect compliance

Question 13

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Accepted Answer

Verifying user account permissions and group assignments. Least privilege means each user, process, and service has only the minimum permissions necessary to perform its function. The most direct audit activity is therefore to examine user account permissions, group memberships, sudoers entries, and file/directory ACLs to verify that no account has excessive rights. This directly tests the control's design and operation against the principle.

Answer

Running a Nessus vulnerability scan

Answer

Checking for physical server room access

Answer

Reviewing system logs for failed login attempts

Question 14

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Accepted Answer

Greater reliance on third-party audit reports. In cloud-native environments, organizations inherit controls from cloud providers and must rely on third-party audit reports such as SOC 2, ISO 27001, or FedRAMP to assess those inherited controls. This is the most significant change because you cannot directly audit the provider's infrastructure. The other options are not accurate descriptions of the change.

Answer

POA&M is prohibited for cloud providers

Answer

Physical security is no longer assessed

Answer

Manual testing is mandated for all controls

Question 15

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. A self-assessment is an audit performed by an internal department to evaluate the effectiveness of security controls without external pressure. It is a proactive internal review that helps identify gaps and improve security posture before external audits occur. This type of audit is typically conducted by internal audit teams or security personnel within the organization.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 16

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

Accepted Answer

Update the POA&M with a remediation plan. Under NIST RMF and FedRAMP processes, when an assessment identifies a High risk finding, the system owner is required to document it in the Plan of Action and Milestones (POA&M) along with a remediation plan, responsible party, and milestone dates. The POA&M is the authoritative tracking artifact for unresolved weaknesses, and High findings typically require remediation within 30 days per FedRAMP timelines. Simply accepting or deleting the finding is not permitted without formal risk acceptance by the Authorizing Official.

Answer

Delete the finding from the report

Answer

Transfer the risk to the IT staff

Answer

Accept the risk without documentation

Question 17

Which standard provides the framework for conducting information security audits?

Accepted Answer

ISO/IEC 27007. ISO/IEC 27007 provides guidelines for auditing information security management systems (ISMS), specifically supporting ISO/IEC 27001 audits by detailing audit program management, auditor competence, and audit conduct. It is the standard that frameworks the conduct of information security audits, making it the correct answer.

Answer

NIST SP 800-37

Answer

PCI DSS

Answer

ISO/IEC 27001

Question 18

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Account management lifecycle controls govern the creation, review, disabling, and deletion of accounts, including timely disabling of inactive accounts. The failure to disable inactive accounts is a direct breakdown of the lifecycle control, which typically specifies inactivity thresholds (e.g., 30, 60, or 90 days) and automated or manual review processes. This maps to NIST SP 800-53 AC-2 (Account Management) and its enhancement AC-2(3) for disabling inactive accounts.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication

Question 19

What is the primary goal of the 'Assessment Reporting' phase?

Accepted Answer

To communicate findings to stakeholders. The Assessment Reporting phase in the RMF (Risk Management Framework) and similar assessment lifecycles exists specifically to document and communicate assessment results—findings, risks, and recommendations—to key stakeholders such as authorizing officials, system owners, and oversight bodies. Its core purpose is not remediation or control selection, but ensuring decision-makers have the information needed to make risk-based decisions (e.g., authorization to operate). Thus, 'communicate findings to stakeholders' accurately captures the primary goal.

Answer

To terminate the contract

Answer

To select new security controls

Answer

To patch all identified vulnerabilities

Question 20

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. The CMVP (Cryptographic Module Validation Program) validation certificate is the authoritative, independently verified proof that a cryptographic module meets FIPS 140-3 requirements. It is issued only after NIST-accredited CST laboratory testing and CMVP review, and it lists the exact module, version, and validated security levels. This makes it the strongest and only formally recognized evidence of FIPS 140-3 compliance.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor