CGRC Compliance Maintenance Practice Test 1 — 15 Questions

Question 1

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Accepted Answer

Create a certificate of destruction for audit purposes.. Option B is correct because a certificate of destruction provides documented, auditable evidence that Classified media was properly sanitized or destroyed, which is required for compliance and chain-of-custody records. Option C is correct because storage media that held Classified information must be physically destroyed (e.g., degaussing, shredding, incineration) since logical sanitization alone is insufficient for media that stored classified data. Option E is correct because decommissioning requires removing the system from the active asset inventory so it is no longer tracked, maintained, or counted as an operational asset. Option A is incorrect because indefinite secure storage does not complete decommissioning and leaves classified media unaccounted for rather than properly destroyed. Option D is incorrect because reformatting is a logical sanitization method that does not adequately remove Classified data and is not permitted for reuse in a non-sensitive project.

Answer

Move the system to a secure storage area for indefinite holding.

Answer

Reformat the drive for reuse in a non-sensitive project.

Question 2

A GRC manager is updating the continuous monitoring strategy for a high-impact federal system after a major change to its boundary. The system now interfaces with an external cloud service. The manager must ensure that the monitoring strategy remains compliant with NIST SP 800-137. Which TWO of the following actions are most critical to include in the updated strategy? (Choose two.)

Accepted Answer

Define metrics and thresholds for monitoring the security controls associated with the new external interface.. The most critical actions are defining metrics and thresholds for the new interface and establishing a reporting frequency to the authorizing official. These directly align with NIST SP 800-137's requirements for continuous monitoring: measurable indicators of control effectiveness and regular reporting to support risk decisions. They ensure that the new boundary is actively monitored and that leadership remains informed, preserving the system's compliance posture.

Answer

Conduct a full security control assessment of all system controls immediately.

Answer

Schedule penetration testing of the external interface on an annual basis.

Answer

Update the system security plan to document the new interface and its security controls.

Question 3

A GRC analyst is preparing for an annual assessment of a system's continuous monitoring program. The analyst needs to review the security posture and ensure compliance with NIST SP 800-53A. Which TWO of the following are the most critical artifacts to examine during this review? (Choose two.)

Accepted Answer

Plan of action and milestones (POA&M).. The most critical artifacts for reviewing a continuous monitoring program are the security assessment report (SAR) and the plan of action and milestones (POA&M). The SAR provides the results of the last assessment, highlighting weaknesses and their severity. The POA&M tracks the remediation of those weaknesses. Together, they give a comprehensive view of the system's security posture and the effectiveness of continuous monitoring. Other plans like the SSP, BCP, and IRP are important but not as directly tied to the assessment of monitoring activities.

Answer

System security plan (SSP).

Answer

Business continuity plan (BCP).

Answer

Incident response plan (IRP).

Question 4

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

Accepted Answer

The vulnerability scan was not performed after the patch was applied.. Tenable.io reports vulnerability status based on the most recent scan data it has received. If a patch was applied but no scan was run afterward, the platform has no evidence of remediation and will continue to show the vulnerability as open. The configuration management database reflects the intended state (patch deployed), while the scanner reflects the observed state (last scan result) — the gap is simply the absence of a post-patch verification scan.

Answer

The Nessus scanner plugin needs an update to recognize the patch.

Answer

The scan policy is set to 'Discovery' instead of 'Audit'.

Answer

The scan agent was decommissioned prematurely.

Question 5

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Accepted Answer

Perform a security impact analysis on the change.. Per NIST SP 800-37 R2, when a significant change occurs during ongoing authorization, the first step is to perform a security impact analysis to determine the extent of the change's effect on the security posture. This analysis informs whether the change is within the already-authorized boundary or requires reauthorization. It is a risk-based approach that ensures the Authorizing Official has the necessary information before deciding on further actions.

Answer

Immediately decommission the system.

Answer

Update the System Security Plan (SSP) and submit for re-certification.

Answer

Wait until the annual assessment cycle to review the change.

Question 6

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. In Microsoft Endpoint Configuration Manager, Configuration Items (CIs) define the settings and rules you want to evaluate — such as specific registry key values — and are paired with Configuration Baselines to assess compliance across collections of workstations. This is the native compliance settings feature designed exactly for verifying registry, file, and script-based configuration state.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 7

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Before any IT asset holding sensitive information leaves organizational control, the storage media must be sanitized using an approved standard (e.g., NIST SP 800-88 Rev. 1 purge or clear, or physical destruction) to prevent data remanence and unauthorized disclosure. This is the control that directly addresses the confidentiality risk of disposal; all other steps are administrative or operational and do not protect the data itself.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 8

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config Remediation Actions.. AWS Config Remediation Actions allow you to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. You can associate a remediation action with a Config rule that checks for private S3 buckets, so when a bucket is non-compliant, the remediation action automatically applies the necessary changes (e.g., setting the bucket ACL to private).

Answer

AWS CloudTrail Event Selectors.

Answer

AWS Config Aggregators.

Answer

AWS Config Conformance Packs.

Question 9

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

Accepted Answer

Destroy the hard drive via shredding or incineration.. NIST SP 800-88 Rev. 1 defines three sanitization categories: Clear, Purge, and Destroy. Destroy—via shredding, incineration, disintegration, or melting—renders the media physically unusable so that data cannot be recovered even with laboratory techniques, which is the highest assurance level. For PII on a legacy drive being decommissioned, destruction is the appropriate method when the media will not be reused.

Answer

Clear the file system using a standard OS format command.

Answer

Overwrite the drive once with zeros.

Answer

Purge the data using a cryptographic erase (CE) method.

Question 10

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

Accepted Answer

Failure to perform annual control testing as part of continuous monitoring.. Under FISMA and NIST SP 800-53 / SP 800-137 continuous monitoring guidance, security controls must be assessed at a frequency sufficient to support ongoing authorization — commonly at least annually for most controls. Assessment results that are three years old indicate the organization failed to perform the required recurring control testing that underpins continuous monitoring and ongoing authorization.

Answer

The organization failed to report the breach to the US-CERT.

Answer

The system failed to undergo a full re-accreditation.

Answer

The System Security Plan (SSP) was not updated in the FISMA database.

Question 11

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

Accepted Answer

To document the approved security configuration of a system.. A Configuration Baseline is the documented, approved security configuration of a system — the authoritative reference of how the system should be set up (OS hardening settings, service states, registry values, file permissions). It is the 'known good' state against which ongoing configurations are compared during audits and continuous monitoring, forming the foundation of CM-2 and CM-6 controls in NIST SP 800-53.

Answer

To automate the deployment of new software patches.

Answer

To identify all users with administrative privileges.

Answer

To serve as a temporary backup for system files.

Question 12

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Accepted Answer

To automate the assessment of security configurations against benchmarks.. SCAP (Security Content Automation Protocol) is a NIST-maintained suite of specifications—including CVE, CCE, CPE, CVSS, XCCDF, OVAL, and SWID—that enables automated, standardized assessment of system configurations and vulnerabilities against established benchmarks such as the DISA STIGs or NIST SP 800-53 controls. In a continuous monitoring program (per NIST SP 800-137), SCAP-validated tools scan endpoints, compare findings to a target baseline, and produce machine-readable results that feed ongoing authorization decisions. This makes automated configuration/benchmark assessment its primary function.

Answer

To provide encrypted tunnels for administrative access.

Answer

To monitor network traffic for anomalous behavior.

Answer

To manage the lifecycle of cryptographic keys.

Question 13

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Accepted Answer

Automated security regression testing in the CI/CD pipeline.. In a Continuous Authorization model (aligned with NIST SP 800-37 Rev. 2 and the DoD's cATO guidance), automated security regression testing in the CI/CD pipeline is critical because it verifies on every build that previously validated security controls remain effective despite frequent code changes. This provides the continuous, automated evidence needed to maintain the authorization baseline without re-authorizing from scratch with each release.

Answer

Daily vulnerability scanning of the production environment.

Answer

Annual penetration testing of the application.

Answer

Manual sign-off by the CISO before every code commit.

Question 14

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. An ATO with conditions means the Authorizing Official has accepted the system for operation but requires specific actions (e.g., additional controls, mitigations, or monitoring) to be completed. These conditions are documented as weaknesses and must be entered into the Plan of Action and Milestones (POA&M) so they are tracked, resourced, and remediated within agreed timeframes during continuous monitoring. The POA&M is the authoritative mechanism for managing outstanding risk items post-authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 15

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

Accepted Answer

Plan of Action and Milestones (POA&M).. The Plan of Action and Milestones (POA&M) is the RMF artifact specifically designed to document, track, and manage identified security control weaknesses, including those discovered during continuous monitoring. It records each weakness, the planned remediation action, the responsible party, and the milestone dates for completion. The SSP describes the system and its controls, but the POA&M is the tracking document for changes and deficiencies.

Answer

System Security Plan (SSP).

Answer

Risk Assessment Report (RAR).

Answer

Authority to Operate (ATO).