CGRC Compliance Maintenance Practice Test 2 — 15 Questions

Question 1

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

Accepted Answer

Firewall audit/management logs.. Firewall configuration changes are recorded in the firewall's own audit and management logs, which capture administrative actions such as rule additions, deletions, modifications, and policy commits. To alert on configuration changes in a SIEM, the firewall audit/management log is the authoritative source because it directly records who changed what and when on the device itself. Other log sources do not contain firewall configuration change events.

Answer

Domain controller event logs.

Answer

DHCP server logs.

Answer

Endpoint antivirus logs.

Question 2

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

Accepted Answer

Perform a cryptographic erase by deleting the associated encryption keys.. Cryptographic erase (crypto-shredding) destroys the encryption keys that protect the data, rendering the ciphertext permanently unrecoverable even if residual bits remain on shared cloud storage. In multi-tenant cloud environments, you cannot physically destroy the underlying media, so key destruction is the only reliable way to guarantee data is unrecoverable. This satisfies data privacy regulations that require demonstrable, irreversible disposal of personal data at decommissioning.

Answer

Delete the VM snapshot from the management console.

Answer

Revoke the access rights of the VM administrator.

Answer

Shut down the VM and wait for the provider to recycle the hardware.

Question 3

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Accepted Answer

/etc/ssh/sshd_config. The SSH daemon's runtime behavior is controlled by /etc/ssh/sshd_config, which contains directives such as PermitRootLogin. To verify that root login over SSH is disallowed, you must inspect this file for the PermitRootLogin setting (typically set to 'no' or 'prohibit-password'). This is the authoritative configuration file for the SSH server.

Answer

/etc/hosts.allow

Answer

/etc/shadow

Answer

/etc/passwd

Question 4

Which of the following activities is a core component of the 'Ongoing Authorization' process?

Accepted Answer

Periodically reviewing security assessment results.. Ongoing Authorization (formerly Continuous Monitoring under RMF) requires the Authorizing Official to maintain situational awareness of the system's security posture after the initial ATO. Periodically reviewing security assessment results — including updated SCA scans, POA&M status, and control assessment findings — is a core activity that feeds the ongoing authorization decision. This review ensures the AO can determine whether the system's risk level remains acceptable or whether reauthorization or remediation is needed.

Answer

Performing a full system re-installation annually.

Answer

Changing the system administrator's password every month.

Answer

Increasing the budget for information security.

Question 5

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Accepted Answer

The criticality of the system and the level of change in the environment.. NIST SP 800-137 (Information Security Continuous Monitoring) and SP 800-53 CA-7 tie assessment frequency to risk-based factors: the impact level of the system and the rate/volatility of change in the environment. A high-impact system with frequent changes (new code, config drift, new threats) warrants more frequent assessments than a stable low-impact system. This ensures monitoring resources are allocated proportionally to risk rather than to convenience or vendor schedules.

Answer

The availability of security personnel to perform the tests.

Answer

The vendor's recommendation for maintenance windows.

Answer

The total number of users accessing the system.

Question 6

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Accepted Answer

A formal process for tracking and remediating vulnerabilities.. Option D is correct because an effective continuous monitoring program requires a formal, repeatable process for tracking identified vulnerabilities and ensuring they are remediated in a timely manner, which is central to maintaining an ongoing risk posture. Option E is correct because automated security configuration assessment tools (e.g., SCAP-validated scanners, CIS-CAT, or Nessus-type configuration audits) provide the continuous, repeatable visibility into system hardening and configuration drift that manual reviews cannot sustain. Option A is not essential because a weekly complete physical audit of all hardware is operationally impractical and does not address logical/configuration monitoring. Option B is not essential because forcing daily password changes is a poor practice that increases help-desk load and weakens password quality, and it is not a monitoring control. Option C is not essential because outsourcing all monitoring to a third party removes organizational visibility and accountability; continuous monitoring can be performed internally or in hybrid models.

Answer

A complete physical audit of all hardware every week.

Answer

Requiring all users to change passwords daily.

Answer

Outsourcing all security monitoring to a third party.

Question 7

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Accepted Answer

System Security Plan (SSP).. The System Security Plan (SSP) (B) must be updated because it documents the system's security controls, boundaries, and implementation details; a configuration change can alter how controls are implemented or described, so the SSP must reflect the current state to remain accurate for authorization and continuous monitoring. The Configuration Baseline document (D) must also be updated because it records the approved, documented settings and components of the system; when a configuration changes, the baseline must be revised to capture the new approved state so future comparisons and change detection remain valid. The vendor's hardware sales catalog (A) is a commercial marketing document unrelated to the system's security posture or configuration records. The Employee Handbook (C) covers general HR policies and is not a system-specific security or configuration artifact. The Corporate financial statements (E) are accounting documents and have no bearing on system configuration management or continuous monitoring.

Answer

The vendor's hardware sales catalog.

Answer

Employee Handbook.

Answer

Corporate financial statements.

Question 8

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Accepted Answer

High risk of system instability during patch deployment.. Option B is correct because legacy systems often run outdated or unsupported OS and application versions where applying patches can break dependencies, cause downtime, or trigger instability, making continuous monitoring and remediation risky. Option C is correct because legacy environments frequently lack modern REST APIs, agents, or standardized telemetry interfaces (e.g., syslog, SNMP, WMI, or OpenTelemetry support), forcing manual or custom monitoring workarounds. Option A is incorrect because legacy systems are typically old and well-researched, so bugs are more likely to be known, not undiscovered. Option D is incorrect because legacy systems rarely self-update firmware daily; automatic firmware updates are uncommon and would not represent a monitoring challenge. Option E is incorrect because abundant disk space for logs is not a challenge; insufficient storage or log retention limits would be the actual concern.

Answer

The system is too new for security researchers to find bugs.

Answer

The system automatically updates its own firmware daily.

Answer

Too much disk space available for logging.

Question 9

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

Accepted Answer

Running automated configuration compliance scans.. Option A is correct because automated configuration compliance scans (e.g., using SCAP, CIS-CAT, or Nessus audit policies) directly test whether systems still match the hardened baselines and control settings that were implemented, which is a core continuous-monitoring verification technique. Option C is correct because reviewing system and audit logs (e.g., Windows Event Log, syslog, SIEM correlation) provides evidence that controls such as access enforcement, logging, and intrusion detection are actually operating and generating expected events. Option E is correct because physical inspections of the server room verify that physical and environmental controls (badge access, locks, cameras, HVAC, fire suppression) are present and functioning, which is a legitimate continuous-monitoring activity for the physical domain. Option B does not belong because user productivity interviews measure business performance, not the operational effectiveness of security controls. Option D does not belong because a vendor's assurance claim is not independent verification that the controls are functioning in the organization's own environment.

Answer

Interviewing the system users about their productivity.

Answer

Asking the vendor if the product is secure.

Question 10

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Accepted Answer

Implement and document compensating controls.. When a required patch cannot be applied due to compatibility issues with a critical legacy application, the correct compliance management action is to implement and document compensating controls. Compensating controls are alternative safeguards that provide equivalent or comparable protection to the original requirement, allowing the organization to manage the residual risk while maintaining compliance. This approach is endorsed by frameworks like NIST SP 800-53 and is a standard part of risk management.

Answer

Request an exemption from the CISO without providing documentation.

Answer

Ignore the vulnerability as it cannot be fixed.

Answer

Disconnect the server from the network permanently.

Question 11

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Accepted Answer

Whether the change negatively impacts existing security controls.. A security impact analysis (SIA) under NIST SP 800-37/800-30 examines how a proposed change affects the system's security posture, so option A is correct: you must determine whether the change degrades, bypasses, or otherwise negatively impacts existing security controls (e.g., firewalls, ACLs, encryption, auditing). Option D is correct because the SIA must identify whether the change introduces new weaknesses requiring additional testing or assessment, such as vulnerability scanning, penetration testing, or reauthorization activities, before the change is approved. Option E is correct because the analysis must determine whether the change alters the system's overall risk rating (likelihood and impact of threats exploiting vulnerabilities), which drives whether the change can proceed or needs mitigation. Option B is not a security consideration — cost savings belong to a business or financial impact analysis, not the security impact analysis. Option C is irrelevant; user interface color scheme has no bearing on confidentiality, integrity, or availability controls.

Answer

The expected cost savings from the change.

Answer

The color scheme of the new user interface.

Question 12

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Accepted Answer

Segmenting the system into a separate, isolated network zone.. Compensating controls are alternative safeguards that provide equivalent risk reduction when the prescribed control cannot be implemented exactly as required. Option A is correct because isolating the system in a separate, segmented network zone (e.g., a VLAN or DMZ with restrictive firewall/ACL rules) reduces the attack surface and lateral-movement risk, compensating for a control that cannot be applied as specified. Option C is correct because enhanced logging and monitoring (e.g., forwarding audit logs to a SIEM, enabling verbose event auditing) provides detective coverage that offsets a missing or weakened preventive control. Option E is correct because requiring multi-factor authentication for all administrative access adds a strong authentication factor, compensating for weaknesses such as inadequate password policy or missing privileged-access controls. Option B is not a security control at all—a larger office has no bearing on risk mitigation. Option D is a physical environmental control for availability (HVAC/cooling), not a compensating security control for the scenario described.

Answer

Providing the system administrator with a larger office.

Answer

Installing a new air conditioning unit in the server room.

Question 13

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Accepted Answer

The cloud service provider (CSP).. Under the shared responsibility model, the cloud service provider (CSP) (D) is responsible for compliance of the cloud itself — the physical datacenters, hardware, hypervisor, and foundational services — while the cloud customer (E) is responsible for compliance in the cloud, including their data, configurations, access controls, and applications they deploy. These two parties split security and compliance duties based on the service model (IaaS, PaaS, SaaS), which is why both are the entities typically accountable. The hardware manufacturer (A) only supplies components and does not bear operational compliance responsibility once equipment is deployed in a CSP's datacenter. The local internet service provider (B) merely transports connectivity and has no role in cloud compliance obligations. The end-user of the application (C) consumes services but is not a distinct compliance-responsible entity separate from the cloud customer organization.

Answer

The hardware manufacturer.

Answer

The local internet service provider.

Answer

The end-user of the application.

Question 14

You are the GRC lead for a U.S. federal agency. A system has an Authorization to Operate (ATO) that expires in 90 days. The system owner submits a revised System Security Plan (SSP) and a new security assessment report showing all controls are still effective, but no changes have been made to the system since the last authorization. According to NIST SP 800-37 Rev. 2, what is the most appropriate action to maintain the authorization?

Accepted Answer

Update the authorization package with the new SSP and assessment results, and continue ongoing authorization without a new authorization decision.. Ongoing authorization allows a system to maintain its ATO through continuous monitoring rather than periodic reauthorization. When no significant changes have occurred and controls are assessed as effective, the authorizing official can continue the authorization based on updated documentation. This approach is risk-based and avoids unnecessary reassessment while ensuring the system remains compliant.

Answer

Allow the ATO to expire and operate the system under an interim authority to test (IATT) until a new authorization can be completed.

Answer

Request a waiver from the authorizing official to extend the ATO indefinitely without any further monitoring or documentation.

Answer

Initiate a full reauthorization process, including a new security assessment of all controls and a new authorization decision.

Question 15

A security engineer is using the NIST Risk Management Framework (RMF) to maintain compliance for a high-impact system. During continuous monitoring, the engineer discovers that a critical security control has been modified without a security impact analysis. Which of the following actions should the engineer take FIRST?

Accepted Answer

Conduct a security impact analysis to determine the effect of the change on the system's security posture.. The security impact analysis is a systematic process to determine how a change affects the security posture of a system. It is required by NIST SP 800-37 and must be performed before any other actions, as it informs whether the change can be accepted, what controls need updating, and whether reauthorization is necessary. It ensures that risk is properly managed and documented.

Answer

Immediately revert the control to its original configuration and document the change in the system security plan.

Answer

Notify the authorizing official and request a new authorization to operate (ATO) before taking any other action.

Answer

Update the continuous monitoring strategy to include more frequent assessments of the modified control.