CGRC Compliance Maintenance — All Questions With Answers

Question 1

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Accepted Answer

Create a certificate of destruction for audit purposes.. Option B is correct because a certificate of destruction provides documented, auditable evidence that Classified media was properly sanitized or destroyed, which is required for compliance and chain-of-custody records. Option C is correct because storage media that held Classified information must be physically destroyed (e.g., degaussing, shredding, incineration) since logical sanitization alone is insufficient for media that stored classified data. Option E is correct because decommissioning requires removing the system from the active asset inventory so it is no longer tracked, maintained, or counted as an operational asset. Option A is incorrect because indefinite secure storage does not complete decommissioning and leaves classified media unaccounted for rather than properly destroyed. Option D is incorrect because reformatting is a logical sanitization method that does not adequately remove Classified data and is not permitted for reuse in a non-sensitive project.

Answer

Move the system to a secure storage area for indefinite holding.

Answer

Reformat the drive for reuse in a non-sensitive project.

Question 2

A GRC manager is updating the continuous monitoring strategy for a high-impact federal system after a major change to its boundary. The system now interfaces with an external cloud service. The manager must ensure that the monitoring strategy remains compliant with NIST SP 800-137. Which TWO of the following actions are most critical to include in the updated strategy? (Choose two.)

Accepted Answer

Define metrics and thresholds for monitoring the security controls associated with the new external interface.. The most critical actions are defining metrics and thresholds for the new interface and establishing a reporting frequency to the authorizing official. These directly align with NIST SP 800-137's requirements for continuous monitoring: measurable indicators of control effectiveness and regular reporting to support risk decisions. They ensure that the new boundary is actively monitored and that leadership remains informed, preserving the system's compliance posture.

Answer

Conduct a full security control assessment of all system controls immediately.

Answer

Schedule penetration testing of the external interface on an annual basis.

Answer

Update the system security plan to document the new interface and its security controls.

Question 3

A GRC analyst is preparing for an annual assessment of a system's continuous monitoring program. The analyst needs to review the security posture and ensure compliance with NIST SP 800-53A. Which TWO of the following are the most critical artifacts to examine during this review? (Choose two.)

Accepted Answer

Plan of action and milestones (POA&M).. The most critical artifacts for reviewing a continuous monitoring program are the security assessment report (SAR) and the plan of action and milestones (POA&M). The SAR provides the results of the last assessment, highlighting weaknesses and their severity. The POA&M tracks the remediation of those weaknesses. Together, they give a comprehensive view of the system's security posture and the effectiveness of continuous monitoring. Other plans like the SSP, BCP, and IRP are important but not as directly tied to the assessment of monitoring activities.

Answer

System security plan (SSP).

Answer

Business continuity plan (BCP).

Answer

Incident response plan (IRP).

Question 4

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

Accepted Answer

The vulnerability scan was not performed after the patch was applied.. Tenable.io reports vulnerability status based on the most recent scan data it has received. If a patch was applied but no scan was run afterward, the platform has no evidence of remediation and will continue to show the vulnerability as open. The configuration management database reflects the intended state (patch deployed), while the scanner reflects the observed state (last scan result) — the gap is simply the absence of a post-patch verification scan.

Answer

The Nessus scanner plugin needs an update to recognize the patch.

Answer

The scan policy is set to 'Discovery' instead of 'Audit'.

Answer

The scan agent was decommissioned prematurely.

Question 5

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Accepted Answer

Perform a security impact analysis on the change.. Per NIST SP 800-37 R2, when a significant change occurs during ongoing authorization, the first step is to perform a security impact analysis to determine the extent of the change's effect on the security posture. This analysis informs whether the change is within the already-authorized boundary or requires reauthorization. It is a risk-based approach that ensures the Authorizing Official has the necessary information before deciding on further actions.

Answer

Immediately decommission the system.

Answer

Update the System Security Plan (SSP) and submit for re-certification.

Answer

Wait until the annual assessment cycle to review the change.

Question 6

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. In Microsoft Endpoint Configuration Manager, Configuration Items (CIs) define the settings and rules you want to evaluate — such as specific registry key values — and are paired with Configuration Baselines to assess compliance across collections of workstations. This is the native compliance settings feature designed exactly for verifying registry, file, and script-based configuration state.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 7

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Before any IT asset holding sensitive information leaves organizational control, the storage media must be sanitized using an approved standard (e.g., NIST SP 800-88 Rev. 1 purge or clear, or physical destruction) to prevent data remanence and unauthorized disclosure. This is the control that directly addresses the confidentiality risk of disposal; all other steps are administrative or operational and do not protect the data itself.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 8

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config Remediation Actions.. AWS Config Remediation Actions allow you to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. You can associate a remediation action with a Config rule that checks for private S3 buckets, so when a bucket is non-compliant, the remediation action automatically applies the necessary changes (e.g., setting the bucket ACL to private).

Answer

AWS CloudTrail Event Selectors.

Answer

AWS Config Aggregators.

Answer

AWS Config Conformance Packs.

Question 9

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

Accepted Answer

Destroy the hard drive via shredding or incineration.. NIST SP 800-88 Rev. 1 defines three sanitization categories: Clear, Purge, and Destroy. Destroy—via shredding, incineration, disintegration, or melting—renders the media physically unusable so that data cannot be recovered even with laboratory techniques, which is the highest assurance level. For PII on a legacy drive being decommissioned, destruction is the appropriate method when the media will not be reused.

Answer

Clear the file system using a standard OS format command.

Answer

Overwrite the drive once with zeros.

Answer

Purge the data using a cryptographic erase (CE) method.

Question 10

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

Accepted Answer

Failure to perform annual control testing as part of continuous monitoring.. Under FISMA and NIST SP 800-53 / SP 800-137 continuous monitoring guidance, security controls must be assessed at a frequency sufficient to support ongoing authorization — commonly at least annually for most controls. Assessment results that are three years old indicate the organization failed to perform the required recurring control testing that underpins continuous monitoring and ongoing authorization.

Answer

The organization failed to report the breach to the US-CERT.

Answer

The system failed to undergo a full re-accreditation.

Answer

The System Security Plan (SSP) was not updated in the FISMA database.

Question 11

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

Accepted Answer

To document the approved security configuration of a system.. A Configuration Baseline is the documented, approved security configuration of a system — the authoritative reference of how the system should be set up (OS hardening settings, service states, registry values, file permissions). It is the 'known good' state against which ongoing configurations are compared during audits and continuous monitoring, forming the foundation of CM-2 and CM-6 controls in NIST SP 800-53.

Answer

To automate the deployment of new software patches.

Answer

To identify all users with administrative privileges.

Answer

To serve as a temporary backup for system files.

Question 12

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Accepted Answer

To automate the assessment of security configurations against benchmarks.. SCAP (Security Content Automation Protocol) is a NIST-maintained suite of specifications—including CVE, CCE, CPE, CVSS, XCCDF, OVAL, and SWID—that enables automated, standardized assessment of system configurations and vulnerabilities against established benchmarks such as the DISA STIGs or NIST SP 800-53 controls. In a continuous monitoring program (per NIST SP 800-137), SCAP-validated tools scan endpoints, compare findings to a target baseline, and produce machine-readable results that feed ongoing authorization decisions. This makes automated configuration/benchmark assessment its primary function.

Answer

To provide encrypted tunnels for administrative access.

Answer

To monitor network traffic for anomalous behavior.

Answer

To manage the lifecycle of cryptographic keys.

Question 13

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Accepted Answer

Automated security regression testing in the CI/CD pipeline.. In a Continuous Authorization model (aligned with NIST SP 800-37 Rev. 2 and the DoD's cATO guidance), automated security regression testing in the CI/CD pipeline is critical because it verifies on every build that previously validated security controls remain effective despite frequent code changes. This provides the continuous, automated evidence needed to maintain the authorization baseline without re-authorizing from scratch with each release.

Answer

Daily vulnerability scanning of the production environment.

Answer

Annual penetration testing of the application.

Answer

Manual sign-off by the CISO before every code commit.

Question 14

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. An ATO with conditions means the Authorizing Official has accepted the system for operation but requires specific actions (e.g., additional controls, mitigations, or monitoring) to be completed. These conditions are documented as weaknesses and must be entered into the Plan of Action and Milestones (POA&M) so they are tracked, resourced, and remediated within agreed timeframes during continuous monitoring. The POA&M is the authoritative mechanism for managing outstanding risk items post-authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 15

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

Accepted Answer

Plan of Action and Milestones (POA&M).. The Plan of Action and Milestones (POA&M) is the RMF artifact specifically designed to document, track, and manage identified security control weaknesses, including those discovered during continuous monitoring. It records each weakness, the planned remediation action, the responsible party, and the milestone dates for completion. The SSP describes the system and its controls, but the POA&M is the tracking document for changes and deficiencies.

Answer

System Security Plan (SSP).

Answer

Risk Assessment Report (RAR).

Answer

Authority to Operate (ATO).

Question 16

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

Accepted Answer

Firewall audit/management logs.. Firewall configuration changes are recorded in the firewall's own audit and management logs, which capture administrative actions such as rule additions, deletions, modifications, and policy commits. To alert on configuration changes in a SIEM, the firewall audit/management log is the authoritative source because it directly records who changed what and when on the device itself. Other log sources do not contain firewall configuration change events.

Answer

Domain controller event logs.

Answer

DHCP server logs.

Answer

Endpoint antivirus logs.

Question 17

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

Accepted Answer

Perform a cryptographic erase by deleting the associated encryption keys.. Cryptographic erase (crypto-shredding) destroys the encryption keys that protect the data, rendering the ciphertext permanently unrecoverable even if residual bits remain on shared cloud storage. In multi-tenant cloud environments, you cannot physically destroy the underlying media, so key destruction is the only reliable way to guarantee data is unrecoverable. This satisfies data privacy regulations that require demonstrable, irreversible disposal of personal data at decommissioning.

Answer

Delete the VM snapshot from the management console.

Answer

Revoke the access rights of the VM administrator.

Answer

Shut down the VM and wait for the provider to recycle the hardware.

Question 18

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Accepted Answer

/etc/ssh/sshd_config. The SSH daemon's runtime behavior is controlled by /etc/ssh/sshd_config, which contains directives such as PermitRootLogin. To verify that root login over SSH is disallowed, you must inspect this file for the PermitRootLogin setting (typically set to 'no' or 'prohibit-password'). This is the authoritative configuration file for the SSH server.

Answer

/etc/hosts.allow

Answer

/etc/shadow

Answer

/etc/passwd

Question 19

Which of the following activities is a core component of the 'Ongoing Authorization' process?

Accepted Answer

Periodically reviewing security assessment results.. Ongoing Authorization (formerly Continuous Monitoring under RMF) requires the Authorizing Official to maintain situational awareness of the system's security posture after the initial ATO. Periodically reviewing security assessment results — including updated SCA scans, POA&M status, and control assessment findings — is a core activity that feeds the ongoing authorization decision. This review ensures the AO can determine whether the system's risk level remains acceptable or whether reauthorization or remediation is needed.

Answer

Performing a full system re-installation annually.

Answer

Changing the system administrator's password every month.

Answer

Increasing the budget for information security.

Question 20

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Accepted Answer

The criticality of the system and the level of change in the environment.. NIST SP 800-137 (Information Security Continuous Monitoring) and SP 800-53 CA-7 tie assessment frequency to risk-based factors: the impact level of the system and the rate/volatility of change in the environment. A high-impact system with frequent changes (new code, config drift, new threats) warrants more frequent assessments than a stable low-impact system. This ensures monitoring resources are allocated proportionally to risk rather than to convenience or vendor schedules.

Answer

The availability of security personnel to perform the tests.

Answer

The vendor's recommendation for maintenance windows.

Answer

The total number of users accessing the system.

CGRC Compliance Maintenance — All Questions With Answers

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

A GRC analyst is preparing for an annual assessment of a system's continuous monitoring program. The analyst needs to review the security posture and ensure compliance with NIST SP 800-53A. Which TWO of the following are the most critical artifacts to examine during this review? (Choose two.)

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Which of the following activities is a core component of the 'Ongoing Authorization' process?

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

You are the GRC analyst for a system that has an approved Authorization to Operate (ATO). A new vulnerability is discovered in a component that is not part of the system's boundary but is used by the system's administrators. According to continuous monitoring principles, what should you do first?

A system's continuous monitoring plan requires weekly vulnerability scans. The scans have been consistently showing the same findings for three months, and remediation efforts have been unsuccessful due to vendor delays. What should the GRC analyst do?

As the GRC analyst, you are reviewing the continuous monitoring program for a financial system that processes transactions. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which of the following is the MOST appropriate action?

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the following should be the PRIMARY focus of the update?

A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which TWO factors should the analyst consider when evaluating this proposal? (Choose two.)

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner wants to use automated tools to collect and analyze security-related data. Which of the following should the analyst ensure is in place to support this automation?

After a system receives an Authority to Operate (ATO), the organization must maintain compliance through continuous monitoring. Which of the following activities is a core component of a continuous monitoring program?

CGRC Compliance Maintenance — All Questions With Answers

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

A GRC analyst is preparing for an annual assessment of a system's continuous monitoring program. The analyst needs to review the security posture and ensure compliance with NIST SP 800-53A. Which TWO of the following are the most critical artifacts to examine during this review? (Choose two.)

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Which of the following activities is a core component of the 'Ongoing Authorization' process?

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

You are the GRC analyst for a system that has an approved Authorization to Operate (ATO). A new vulnerability is discovered in a component that is not part of the system's boundary but is used by the system's administrators. According to continuous monitoring principles, what should you do first?

A system's continuous monitoring plan requires weekly vulnerability scans. The scans have been consistently showing the same findings for three months, and remediation efforts have been unsuccessful due to vendor delays. What should the GRC analyst do?

As the GRC analyst, you are reviewing the continuous monitoring program for a financial system that processes transactions. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which of the following is the MOST appropriate action?

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the following should be the PRIMARY focus of the update?

A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which TWO factors should the analyst consider when evaluating this proposal? (Choose two.)

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner wants to use automated tools to collect and analyze security-related data. Which of the following should the analyst ensure is in place to support this automation?

After a system receives an Authority to Operate (ATO), the organization must maintain compliance through continuous monitoring. Which of the following activities is a core component of a continuous monitoring program?