CGRC Control Implementation Practice Test 2 — 15 Questions

Question 1

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

Accepted Answer

Implement Separation of Duties. Separation of Duties (SoD) is an administrative control that divides critical functions among different individuals so that no single person has enough privileges to compromise the system. For a DBA account, SoD ensures that the ability to modify data, change schemas, and manage backups or audit logs is split across multiple roles, so a compromised DBA account cannot unilaterally cause widespread damage or cover tracks. This minimizes impact by limiting the blast radius of a single compromised account.

Answer

Disable all auditing

Answer

Store passwords in plain text

Answer

Use a single shared account

Question 2

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the primary, account- and bucket-level control specifically designed to override any policy or ACL that would grant public access, acting as a centralized guardrail. It can be applied at the account level to prevent any bucket from becoming public, which is the strongest preventive mechanism. This directly addresses the requirement to prevent public exposure of PII stored in S3.

Answer

Encryption at Rest

Answer

Bucket ACLs

Answer

IAM User Permissions

Question 3

What is the physical security control used to prevent piggybacking at an entry point?

Accepted Answer

Mantrap. A mantrap is a physical access control consisting of two interlocking doors with a small vestibule between them, designed so that only one door can open at a time. This forces each person to authenticate individually before proceeding, which physically prevents tailgating/piggybacking because an unauthorized follower cannot slip through behind an authenticated user. It is the only option that directly and physically stops the act of piggybacking at the entry point.

Answer

Biometric scanner

Answer

CCTV camera

Answer

Security guard

Question 4

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A jump server (bastion host) with multi-factor authentication (MFA) enforces a controlled, auditable entry point to the production network, requiring a second authentication factor before any access is granted. This architecture centralizes access logging, session recording, and credential management, and it prevents direct exposure of production servers to the internet. By combining a hardened intermediary with MFA, the organization achieves defense in depth and satisfies least-privilege and non-repudiation requirements.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server

Question 5

You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?

Accepted Answer

INPUT. In iptables, the INPUT chain processes packets destined for the local host itself, making it the correct place to filter traffic addressed to the machine. The OUTPUT chain handles locally generated outbound traffic, and FORWARD handles packets routed through the host. Therefore, filtering traffic destined for the local host requires the INPUT chain.

Answer

OUTPUT

Answer

FORWARD

Answer

PREROUTING

Question 6

When performing vulnerability management, what is the purpose of a 'credentialed scan'?

Accepted Answer

To identify missing patches and misconfigurations. A credentialed scan supplies the vulnerability scanner with valid OS or application credentials (e.g., SSH keys, SMB accounts, SNMP community strings) so it can log into the target and inspect installed patches, registry settings, configuration files, and local package versions. This deep visibility lets it identify missing patches and misconfigurations that an unauthenticated scan would miss, and it dramatically reduces false positives by confirming actual software versions rather than inferring from banners.

Answer

To perform penetration testing

Answer

To automate the patching process

Answer

To bypass the firewall

Question 7

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

Accepted Answer

Exclude known safe processes and signers. Excluding known safe processes and signers reduces false positives by allowing legitimate applications to run without triggering alerts, while still monitoring for anomalous behavior. This maintains visibility because the EDR continues to log and analyze all other activities, only suppressing noise from trusted sources.

Answer

Only monitor server logs

Answer

Set to 'Block All' mode

Answer

Disable real-time scanning

Question 8

Which administrative control is essential before deploying a new security tool to production?

Accepted Answer

Change management approval. Change management approval is the administrative control that ensures a new security tool is reviewed for impact, risk, and rollback before it touches production. It provides documented authorization, prevents unvetted changes from disrupting availability or compliance, and creates an audit trail. Without it, deployment bypasses governance and can violate policy or introduce outages.

Answer

Sharing administrator credentials

Answer

Disabling internal auditing

Answer

Immediate deployment to production

Question 9

Which type of control is an alarm system installed in a server room?

Accepted Answer

Detective. An alarm system is a detective control because it detects and alerts to unauthorized access or anomalies after they occur. It does not prevent the event from happening but provides notification so that response actions can be taken. Thus, it is classified as detective.

Answer

Preventative

Answer

Corrective

Answer

Deterrent

Question 10

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

Accepted Answer

The server's TLS configuration file. TLS cipher suites and protocol versions are configured in the web server's TLS/SSL configuration — for example, Apache's ssl.conf (SSLCipherSuite, SSLProtocol), Nginx's nginx.conf (ssl_ciphers, ssl_protocols), or IIS's SCHANNEL registry and site bindings. This is where administrators disable weak ciphers like RC4, 3DES, and NULL, and restrict protocols to TLS 1.2/1.3. The other options affect unrelated layers and cannot control which cipher suites the server negotiates during the TLS handshake.

Answer

The server's BIOS settings

Answer

The web application's root directory

Answer

The firewall access control list

Question 11

Which document is used to standardize the implementation of security controls across an organization?

Accepted Answer

Security Baseline. A security baseline is a documented set of minimum security configurations and controls that must be applied consistently across an organization's systems. It standardizes the implementation of security controls by providing a reference configuration (e.g., CIS Benchmarks, DISA STIGs) that ensures all systems meet a consistent security posture. Baselines are used to harden systems and are a key part of configuration management.

Answer

Incident Response Plan

Answer

Risk Register

Answer

Acceptable Use Policy

Question 12

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing the BitLocker recovery key in Active Directory (specifically in the computer object's msFVE-RecoveryInformation attribute) is the recommended enterprise practice because AD provides centralized, access-controlled, and auditable storage. This allows authorized administrators to retrieve the key if the drive is locked, while preventing unauthorized access through AD permissions. It also ensures the key survives hardware failures or user turnover.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop

Question 13

Which TWO of the following are examples of physical security controls?

Accepted Answer

Security cameras. Security cameras (B) are a physical security control because they are hardware devices deployed to monitor and record activity in a physical facility, deterring and detecting intrusions. Key card access systems (D) are also physical controls, as they use tangible badge readers and door hardware to restrict physical entry to authorized personnel. The remaining options are logical/technical controls: a host-based firewall (A) filters network traffic in software, a strong password policy (C) is an administrative control governing authentication, and encryption of database tables (E) is a technical control protecting data at rest.

Answer

Host-based firewall

Answer

Strong password policy

Answer

Encryption of database tables

Question 14

Which TWO of the following represent best practices for password management?

Accepted Answer

Using a password manager for unique, complex passwords. Option B is correct because a password manager generates and stores unique, complex credentials per account, which prevents password reuse and credential-stuffing attacks while keeping secrets encrypted behind a single strong master passphrase. Option E is correct because enforcing a minimum length requirement (e.g., 12–16+ characters per NIST SP 800-63B guidance) increases entropy and resistance to brute-force and dictionary attacks far more effectively than complexity rules alone. The unmarked options do not belong: forcing changes every 30 days (A) is discouraged by modern guidance such as NIST SP 800-63B because it leads to predictable incremental passwords and weaker choices; allowing password sharing among team members (C) destroys individual accountability and non-repudiation; and logging passwords in a shared spreadsheet (D) exposes plaintext credentials to anyone with file access and violates secure secret-storage practices.

Answer

Forcing users to change passwords every 30 days

Answer

Allowing password sharing among team members

Answer

Logging passwords in a shared spreadsheet

Question 15

Which TWO of the following are considered 'technical' security controls?

Accepted Answer

Encryption of data in transit. Encryption of data in transit (C) is a technical security control because it is implemented through cryptographic mechanisms and protocols such as TLS to protect data as it moves across networks, directly enforcing protection at the system level. Access Control Lists (ACLs) (D) are also technical controls since they are configured on devices like routers, firewalls, and operating systems to permit or deny traffic and resource access based on defined rules. In contrast, an annual risk assessment (A) is a management/administrative control involving analysis and decision-making rather than a technical mechanism, and security policies (B) are administrative controls that define rules and expectations in documentation. Fencing around the data center (E) is a physical control that deters or blocks physical intrusion, not a technical one.

Answer

Annual risk assessment

Answer

Security policies

Answer

Fencing around the data center