CGRC Compliance Maintenance — Timed 10 Questions

Question 1

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

The vulnerability scan was not performed after the patch was applied.. This discrepancy indicates a failure in the synchronization between the patch management process and the vulnerability management detection phase.

Answer

The Nessus scanner plugin needs an update to recognize the patch.

Answer

The scan policy is set to 'Discovery' instead of 'Audit'.

Answer

The scan agent was decommissioned prematurely.

Question 2

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Accepted Answer

Perform a security impact analysis on the change.. Continuous monitoring requires assessing the impact of changes to determine if the authorization remains valid.

Answer

Immediately decommission the system.

Answer

Update the System Security Plan (SSP) and submit for re-certification.

Answer

Wait until the annual assessment cycle to review the change.

Question 3

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

Accepted Answer

Configuration Items (CIs).. Configuration Items (CIs) in MECM allow you to define settings and verify compliance across client systems.

Answer

Application Catalog.

Answer

Client Health Reports.

Answer

Software Metering.

Question 4

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Accepted Answer

Sanitize the storage media according to an approved standard.. Sanitizing the media is the most critical step to prevent unauthorized access to data remaining on the physical hardware.

Answer

Update the asset inventory list.

Answer

Remove the BIOS password.

Answer

Format the primary operating system partition.

Answer

Deactivate the user accounts associated with the system.

Question 5

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config Remediation Actions.. AWS Config Rules combined with Systems Manager Automation documents allow for automated remediation of non-compliant resources.

Answer

AWS CloudTrail Event Selectors.

Answer

AWS Config Aggregators.

Answer

AWS Config Conformance Packs.

Question 6

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

Accepted Answer

Destroy the hard drive via shredding or incineration.. According to NIST SP 800-88, destroying the physical media is the only method that prevents recovery from laboratory-grade forensic tools.

Answer

Clear the file system using a standard OS format command.

Answer

Overwrite the drive once with zeros.

Answer

Purge the data using a cryptographic erase (CE) method.

Question 7

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

Accepted Answer

Failure to perform annual control testing as part of continuous monitoring.. NIST SP 800-37 R2 requires that security controls are monitored and assessed frequently enough to maintain an ongoing authorization.

Answer

The organization failed to report the breach to the US-CERT.

Answer

The system failed to undergo a full re-accreditation.

Answer

The System Security Plan (SSP) was not updated in the FISMA database.

Question 8

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

Accepted Answer

To document the approved security configuration of a system.. A baseline provides a documented, approved state of a system that serves as a reference point for future changes.

Answer

To automate the deployment of new software patches.

Answer

To identify all users with administrative privileges.

Answer

To serve as a temporary backup for system files.

Question 9

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Accepted Answer

To automate the assessment of security configurations against benchmarks.. SCAP provides a standardized way to automate the assessment of system security configurations against established benchmarks.

Answer

To provide encrypted tunnels for administrative access.

Answer

To monitor network traffic for anomalous behavior.

Answer

To manage the lifecycle of cryptographic keys.

Question 10

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Accepted Answer

Automated security regression testing in the CI/CD pipeline.. Automated security testing in the CI/CD pipeline ensures that security controls are validated with every deployment, maintaining the baseline.

Answer

Daily vulnerability scanning of the production environment.

Answer

Annual penetration testing of the application.

Answer

Manual sign-off by the CISO before every code commit.