CGRC Compliance Maintenance Practice Test 3 — 15 Questions

Question 1

You are a GRC analyst responsible for continuous monitoring of a federal information system. The system has a current ATO and is in the operations and maintenance phase. Which TWO of the following activities are required to maintain the authorization according to NIST SP 800-37 Rev. 2? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct ongoing security control assessments in accordance with the continuous monitoring strategy.. Maintaining an authorization in the operations and maintenance phase requires ongoing security control assessments and regular reporting to the authorizing official. These activities are part of the continuous monitoring strategy and enable ongoing authorization. They ensure that the authorizing official has current information to determine if the system's risk remains acceptable, allowing the ATO to remain valid without a full reauthorization.

Answer

Reassess all security controls at the same frequency, regardless of their criticality.

Answer

Perform a full reauthorization every three years regardless of system changes.

Answer

Update the system security plan (SSP) only when a major upgrade occurs.

Question 2

You are the GRC analyst for a system that has an approved Authorization to Operate (ATO). A new vulnerability is discovered in a component that is not part of the system's boundary but is used by the system's administrators. According to continuous monitoring principles, what should you do first?

Accepted Answer

Assess whether the vulnerability affects the system's security posture and determine if a security impact analysis is needed.. The correct answer is to assess the vulnerability's impact first. Continuous monitoring involves ongoing assessment of risks, including those from components used by administrators but outside the boundary. A security impact analysis determines whether the vulnerability affects the system's security posture and if the ATO needs adjustment. This proactive step ensures informed decision-making before escalating or taking drastic actions.

Answer

Immediately revoke the ATO until the vulnerability is patched.

Answer

Report the vulnerability to the authorizing official and wait for further instructions.

Answer

Update the system security plan (SSP) to include the component within the boundary.

Question 3

A system's continuous monitoring plan requires weekly vulnerability scans. The scans have been consistently showing the same findings for three months, and remediation efforts have been unsuccessful due to vendor delays. What should the GRC analyst do?

Accepted Answer

Perform a security impact analysis to determine if the unresolved vulnerabilities constitute a significant change to the system's risk posture.. The correct answer is to perform a security impact analysis. When remediation is delayed and findings persist, the system's risk profile may change. A security impact analysis determines if the unresolved vulnerabilities represent a significant change, which could affect the ATO. This analysis provides a basis for decisions such as risk acceptance, additional controls, or escalation to the authorizing official.

Answer

Escalate the issue to the authorizing official and document the vendor delays as a compensating control.

Answer

Modify the continuous monitoring plan to remove the weekly scan requirement until the vendor provides a patch.

Answer

Accept the risk because the vulnerabilities have been present for three months without exploitation.

Question 4

As the GRC analyst, you are reviewing the continuous monitoring program for a financial system that processes transactions. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a risk assessment to determine if monthly scanning provides adequate coverage for the system's risk profile.. The correct action is to conduct a risk assessment because continuous monitoring frequency must be based on the system's risk profile, not arbitrary cost savings. For a financial system, reducing scan frequency could increase risk if vulnerabilities remain undetected. A risk assessment ensures that any change is justified and documented, maintaining compliance with NIST and organizational policies.

Answer

Escalate the decision to the system owner because the GRC analyst does not have authority to change monitoring frequency.

Answer

Deny the change outright because continuous monitoring requires weekly scanning for all systems.

Answer

Approve the change because monthly scanning meets the minimum requirement for continuous monitoring.

Question 5

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

Accepted Answer

Update the SSP to reflect the actual implementation and document the change in the configuration management process.. The correct answer is to update the SSP to reflect the actual implementation. The SSP is a living document that must accurately describe the system's security controls. When an effective control is implemented differently than documented, the SSP should be revised to maintain consistency. This ensures that continuous monitoring and future assessments are based on accurate information.

Answer

Revert the control to match the SSP because the SSP is the authoritative document.

Answer

Initiate a security impact analysis to determine if the change is significant.

Answer

Take no action because the control is still effective and the discrepancy is minor.

Question 6

A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the following should be the PRIMARY focus of the update?

Accepted Answer

Reassessing the security controls to ensure they remain effective with the new boundary.. The primary focus of updating the SSP after a boundary change is to reassess security controls to ensure they remain effective. A boundary change can affect how controls are implemented and may require new controls. The SSP must reflect these changes accurately to maintain compliance and support ongoing authorization. Other actions like notifying the AO or updating subordinate plans are important but secondary.

Answer

Updating the contingency plan to reflect the new system components.

Answer

Notifying the authorizing official of the change and requesting a new ATO.

Answer

Documenting the new hardware and software components added to the system.

Question 7

A financial services firm operates a system processing customer credit data under an active Authority to Operate (ATO). A quarterly review shows that a recent operating system upgrade altered the configuration of the audit logging service, causing it to stop forwarding events to the central log server. The GRC analyst must determine the correct action to maintain the system's security posture and ATO validity. What should the analyst do FIRST?

Accepted Answer

Initiate a security impact analysis to evaluate the change and determine if the ATO conditions are affected.. A security impact analysis is the correct first step because it systematically evaluates how the configuration change affects the system's security controls and whether the existing ATO remains valid. It ensures that any remediation or reauthorization is based on a documented risk assessment, as required by NIST SP 800-37 and continuous monitoring guidance. This approach balances operational needs with compliance obligations.

Answer

Update the system security plan to reflect the new configuration and continue operations without further assessment.

Answer

Immediately revoke the ATO until the logging service is fully restored and verified.

Answer

Schedule a full security control assessment (SCA) for the next annual review cycle.

Question 8

A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which TWO factors should the analyst consider when evaluating this proposal? (Choose two.)

Accepted Answer

The current threat environment and recent vulnerability trends.. The correct answers are the criticality of the system and the sensitivity of the data it processes, and the current threat environment and recent vulnerability trends. For a high-impact system, monitoring frequency must be based on risk. System criticality and data sensitivity determine the potential impact of a compromise, while the threat environment and vulnerability trends indicate the likelihood of exploitation. These factors together inform the appropriate frequency.

Answer

The availability of automated patching tools.

Answer

The number of users who access the system daily.

Answer

The cost savings achieved by reducing the scan frequency.

Question 9

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner wants to use automated tools to collect and analyze security-related data. Which of the following should the analyst ensure is in place to support this automation?

Accepted Answer

A security automation and continuous monitoring (SACM) architecture.. To support automated data collection and analysis in continuous monitoring, a SACM architecture is essential. It provides the standards, tools, and processes to automate the monitoring of security controls. This includes data feeds from sensors, scanners, and logs, as well as automated analysis and reporting. Without such an architecture, automation would be ad hoc and difficult to manage. The GRC analyst should ensure this foundational element is in place.

Answer

An incident response plan that includes automated containment procedures.

Answer

A manual process for correlating data from multiple sources.

Answer

A configuration management plan that defines baseline configurations.

Question 10

A federal information system has an approved Authority to Operate (ATO) with an expiration date of 18 months from now. The system owner asks you, the GRC analyst, what triggers a reauthorization before that date. Which of the following events most clearly requires a reauthorization decision by the Authorizing Official?

Accepted Answer

A change in the system's boundary that adds a new interconnection with an external partner system.. A new interconnection with an external partner system expands the authorization boundary and introduces additional risk that was not evaluated in the original ATO. Under NIST SP 800-37, significant changes such as boundary modifications require a security impact analysis and a reauthorization decision by the Authorizing Official. Routine operational activities like log reviews, training, and minor firmware updates do not meet the threshold for reauthorization.

Answer

A minor firmware update to a network switch that does not affect any security controls.

Answer

A quarterly review of audit logs that shows no anomalies or security incidents.

Answer

An annual security awareness training completion report for all system users.

Question 11

During continuous monitoring, you discover that a security control that was previously assessed as effective is now failing because the responsible team stopped performing the control due to staff turnover. The control is critical for protecting sensitive data. What is the most appropriate immediate action for the GRC analyst to take?

Accepted Answer

Immediately notify the system owner and ISSO, and initiate a security impact analysis to determine the risk and required remediation.. A failing critical control requires immediate escalation to the system owner and ISSO, followed by a security impact analysis to assess the risk and determine remediation. This ensures timely action and informed decision-making. Waiting, revoking the ATO unilaterally, or removing the control from the SSP are inappropriate because they either delay risk mitigation or bypass proper governance processes.

Answer

Update the system security plan to remove the control and document that it is no longer required.

Answer

Document the failure in the POA&M and wait for the next scheduled assessment to verify if the control is still failing.

Answer

Revoke the system's Authority to Operate (ATO) until the control is restored and reassessed.

Question 12

You are reviewing the continuous monitoring strategy for a system that processes Controlled Unclassified Information (CUI). The system owner proposes reducing the frequency of vulnerability scans from weekly to quarterly to save costs. As the GRC analyst, what is your primary consideration when evaluating this proposal?

Accepted Answer

The potential increase in risk exposure and whether it aligns with the organization's risk tolerance and compliance requirements.. The primary consideration when changing vulnerability scan frequency is the impact on risk exposure and whether that risk is acceptable given the organization's risk tolerance and compliance obligations. For CUI, frameworks like NIST SP 800-171 require regular scanning. Cost, tool availability, and historical vulnerability counts are secondary and cannot justify an increase in risk that violates requirements or exceeds tolerance.

Answer

The number of vulnerabilities identified in previous scans.

Answer

The cost savings achieved by reducing scan frequency.

Answer

The availability of automated tools to perform quarterly scans instead of weekly scans.

Question 13

A GRC analyst is reviewing the continuous monitoring results for a system that has been in operation for two years. The analyst notices that a security control for access control (AC-2) has been consistently failing automated checks for the past three months. The system owner argues that the control is not critical and wants to accept the risk. What is the most appropriate action for the analyst to take?

Accepted Answer

Escalate the finding to the authorizing official for a risk-based decision, providing details of the control failure and potential impact.. The most appropriate action is to escalate the persistent control failure to the authorizing official. This ensures that a risk-based decision is made by the proper authority, in line with continuous monitoring and RMF processes. The analyst should provide comprehensive details to support the decision, including the control's importance and the duration of the failure. This maintains compliance and security.

Answer

Modify the automated check to ignore the control failure and reduce false positives.

Answer

Document the risk acceptance in the system's risk register and continue monitoring without escalation.

Answer

Immediately disable the system until the access control issue is resolved.

Question 14

A GRC officer is preparing for an annual assessment of a system's continuous monitoring program. The officer must ensure that the program's documentation reflects the current state of security controls. Which of the following artifacts is MOST important to review to verify that the continuous monitoring program is effectively tracking control changes?

Accepted Answer

The continuous monitoring strategy and the associated metrics and reports.. The continuous monitoring strategy and its associated metrics and reports are the most important artifacts because they directly document how controls are monitored, what data is collected, and how that data is reported. This provides verifiable evidence that the program is actively tracking control changes and effectiveness, as required by NIST SP 800-137. Other documents support the program but do not replace the core monitoring artifacts.

Answer

The configuration management plan and change logs.

Answer

The plan of action and milestones (POA&M) and its status reports.

Answer

The system security plan (SSP) and its recent updates.

Question 15

You are conducting a security impact analysis for a proposed change to a system that has an existing Authority to Operate (ATO). The change involves migrating the database to a new cloud service provider. Which TWO of the following factors are most critical to evaluate in this analysis? (Choose two.)

Accepted Answer

The new provider's data encryption methods for data at rest and in transit.. The most critical factors in a security impact analysis for a cloud migration are the new provider's FedRAMP authorization status and inherited controls, and the provider's encryption methods for data at rest and in transit. These directly affect the system's control baseline and data protection. Cost, staffing, and timeline are not security impact factors and do not determine whether the ATO remains valid.

Answer

The cost difference between the old and new cloud service providers.

Answer

The migration timeline and project milestones.

Answer

The number of database administrators employed by the new provider.