CGRC Compliance Maintenance — 20 Questions

Question 1

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The vulnerability scan was not performed after the patch was applied.. This discrepancy indicates a failure in the synchronization between the patch management process and the vulnerability management detection phase.

Answer

The Nessus scanner plugin needs an update to recognize the patch.

Answer

The scan policy is set to 'Discovery' instead of 'Audit'.

Answer

The scan agent was decommissioned prematurely.

Question 2

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Accepted Answer

Perform a security impact analysis on the change.. Continuous monitoring requires assessing the impact of changes to determine if the authorization remains valid.

Answer

Immediately decommission the system.

Answer

Update the System Security Plan (SSP) and submit for re-certification.

Answer

Wait until the annual assessment cycle to review the change.

Question 3

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. Configuration Items (CIs) in MECM allow you to define settings and verify compliance across client systems.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 4

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Sanitizing the media is the most critical step to prevent unauthorized access to data remaining on the physical hardware.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 5

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config Remediation Actions.. AWS Config Rules combined with Systems Manager Automation documents allow for automated remediation of non-compliant resources.

Answer

AWS CloudTrail Event Selectors.

Answer

AWS Config Aggregators.

Answer

AWS Config Conformance Packs.

Question 6

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

Accepted Answer

Destroy the hard drive via shredding or incineration.. According to NIST SP 800-88, destroying the physical media is the only method that prevents recovery from laboratory-grade forensic tools.

Answer

Clear the file system using a standard OS format command.

Answer

Overwrite the drive once with zeros.

Answer

Purge the data using a cryptographic erase (CE) method.

Question 7

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

Accepted Answer

Failure to perform annual control testing as part of continuous monitoring.. NIST SP 800-37 R2 requires that security controls are monitored and assessed frequently enough to maintain an ongoing authorization.

Answer

The organization failed to report the breach to the US-CERT.

Answer

The system failed to undergo a full re-accreditation.

Answer

The System Security Plan (SSP) was not updated in the FISMA database.

Question 8

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

Accepted Answer

To document the approved security configuration of a system.. A baseline provides a documented, approved state of a system that serves as a reference point for future changes.

Answer

To automate the deployment of new software patches.

Answer

To identify all users with administrative privileges.

Answer

To serve as a temporary backup for system files.

Question 9

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Accepted Answer

To automate the assessment of security configurations against benchmarks.. SCAP provides a standardized way to automate the assessment of system security configurations against established benchmarks.

Answer

To provide encrypted tunnels for administrative access.

Answer

To monitor network traffic for anomalous behavior.

Answer

To manage the lifecycle of cryptographic keys.

Question 10

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Accepted Answer

Automated security regression testing in the CI/CD pipeline.. Automated security testing in the CI/CD pipeline ensures that security controls are validated with every deployment, maintaining the baseline.

Answer

Daily vulnerability scanning of the production environment.

Answer

Annual penetration testing of the application.

Answer

Manual sign-off by the CISO before every code commit.

Question 11

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. Conditions attached to an ATO represent known risks that must be tracked and mitigated through the POA&M to transition to full, unconditioned authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 12

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

Accepted Answer

Plan of Action and Milestones (POA&M).. The Plan of Action and Milestones (POA&M) is the standard document used to track the remediation of security control deficiencies.

Answer

System Security Plan (SSP).

Answer

Risk Assessment Report (RAR).

Answer

Authority to Operate (ATO).

Question 13

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

Accepted Answer

Firewall audit/management logs.. Firewall configuration logs provide the audit trail necessary to detect changes to security policy parameters.

Answer

Domain controller event logs.

Answer

DHCP server logs.

Answer

Endpoint antivirus logs.

Question 14

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

Accepted Answer

Perform a cryptographic erase by deleting the associated encryption keys.. Deleting the VM is not enough; you must verify that the underlying storage blocks have been properly sanitized or that the keys used to encrypt the data have been destroyed.

Answer

Delete the VM snapshot from the management console.

Answer

Revoke the access rights of the VM administrator.

Answer

Shut down the VM and wait for the provider to recycle the hardware.

Question 15

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Accepted Answer

/etc/ssh/sshd_config. The sshd_config file contains the 'PermitRootLogin' directive which must be set to 'no' for compliance.

Answer

/etc/hosts.allow

Answer

/etc/shadow

Answer

/etc/passwd

Question 16

Which of the following activities is a core component of the 'Ongoing Authorization' process?

Accepted Answer

Periodically reviewing security assessment results.. Maintaining the authorization requires continuous assessment of the system's security posture to ensure it remains within an acceptable risk level.

Answer

Performing a full system re-installation annually.

Answer

Changing the system administrator's password every month.

Answer

Increasing the budget for information security.

Question 17

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Accepted Answer

The criticality of the system and the level of change in the environment.. NIST guidance suggests that the frequency of monitoring should be based on the risk level of the system and the volatility of the environment.

Answer

The availability of security personnel to perform the tests.

Answer

The vendor's recommendation for maintenance windows.

Answer

The total number of users accessing the system.

Question 18

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Accepted Answer

A formal process for tracking and remediating vulnerabilities.. Continuous monitoring relies on both the automated collection of data and the procedural management of security findings.

Answer

A complete physical audit of all hardware every week.

Answer

Requiring all users to change passwords daily.

Answer

Outsourcing all security monitoring to a third party.

Question 19

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Accepted Answer

System Security Plan (SSP).. The System Security Plan and the associated configuration baselines must be kept current to reflect the system's actual state.

Answer

The vendor's hardware sales catalog.

Answer

Employee Handbook.

Answer

Corporate financial statements.

Question 20

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Accepted Answer

High risk of system instability during patch deployment.. Legacy systems often lack support for modern automation tools and are difficult to patch without downtime.

Answer

The system is too new for security researchers to find bugs.

Answer

The system automatically updates its own firmware daily.

Answer

Too much disk space available for logging.