CGRC Control Implementation Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are recommended practices for managing firewall rules?

Accepted Answer

Documenting the business justification for each rule. Option A is correct because documenting the business justification for each firewall rule provides an audit trail and ensures that every rule has a legitimate, approved purpose, which is essential for accountability and change management. Option B is correct because periodically reviewing rules to remove unnecessary ones (rule recertification) reduces the attack surface and prevents rule bloat that can degrade performance and introduce security gaps. Option C is incorrect because disabling logging removes visibility into allowed and denied traffic, undermining incident detection and forensic analysis; logging should generally be enabled for critical rules. Option D is incorrect because applying rules in random order is dangerous—firewalls evaluate rules top-down, so order must be deliberate to ensure correct permit/deny behavior. Option E is incorrect because using 'Any' as the destination for all rules creates overly permissive policies that violate the principle of least privilege and expose systems to unnecessary risk.

Answer

Disabling logging for all rules to improve performance

Answer

Applying rules in random order

Answer

Using 'Any' as the destination for all rules

Question 2

Which TWO of the following are examples of administrative security controls?

Accepted Answer

Data classification policy. Administrative security controls are the management-oriented, policy and people-based safeguards an organization puts in place, so B (Data classification policy) qualifies because it is a documented governance rule that defines how data is labeled and handled by sensitivity level. C (Security awareness training) also qualifies because it is a personnel-focused program that educates users on policies, phishing, and safe practices, which is a classic administrative control. By contrast, A (Firewall configuration) and E (Intrusion detection systems) are technical/logical controls implemented in hardware or software, and D (Biometric locks) is a physical control, so none of those three belong to the administrative category.

Answer

Firewall configuration

Answer

Biometric locks

Answer

Intrusion detection systems

Question 3

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Option B is correct because automated patch testing in a staging environment lets you validate updates against representative systems before production rollout, catching compatibility, regression, and deployment issues while keeping the process repeatable and scalable. Option E is correct because defined emergency patch procedures are essential for out-of-band critical vulnerabilities (for example, zero-days or actively exploited CVEs), specifying expedited risk assessment, approval, deployment, and rollback steps so urgent fixes are applied without bypassing governance. Option A is wrong because hosting patch files on a public FTP site exposes unauthenticated, unencrypted distribution and risks tampered or spoofed binaries; patches should come from vendor-signed, integrity-verified sources over HTTPS. Option C is wrong because requiring manual approval for every single update does not scale, creates bottlenecks, and delays critical fixes; approval should be risk-based and largely automated for routine patches. Option D is wrong because disabling all automatic updates removes timely delivery of security fixes and increases exposure windows, contradicting the goal of an effective patch management program.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 4

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

Accepted Answer

Updating the asset inventory database. Option A (Updating the asset inventory database) is correct because decommissioning must be reflected in the configuration management database (CMDB) or asset register so the server is no longer tracked as an active, supported asset and any dependencies, licenses, or monitoring are removed. Option B (Cryptographic erase of the storage media) is correct because crypto-erasure destroys or invalidates the encryption key protecting the data at rest (e.g., SED/self-encrypting drive or BitLocker/LUKS key), rendering the sensitive data unrecoverable in a fast, verifiable manner. Option D (Disconnecting from the network and removing physical identity) is correct because the host must be isolated from the production network to prevent unauthorized access or data exfiltration, and asset tags, hostnames, and rack labels should be removed to prevent misidentification or reuse of a still-sensitive system. Option C is not sufficient because a single reformat only removes the file system references and leaves recoverable data remnants on the platters or cells; secure media sanitization (NIST SP 800-88 purge/destroy) is required. Option E is wrong because leaving the server powered on in the rack keeps the data accessible and the system live, which is the opposite of decommissioning.

Answer

Reformatting the drive once

Answer

Leaving the server powered on in the rack

Question 5

Which THREE of the following are components of a secure server hardening process?

Accepted Answer

Applying security patches. Option B is correct because applying security patches closes known vulnerabilities in the OS and applications, which is a foundational hardening step that reduces the attack surface before other controls are layered on. Option C is correct because configuring the OS with a minimal footprint (removing unnecessary packages, roles, and features) limits the number of potential exploit targets and simplifies patch management. Option E is correct because disabling unused services and ports eliminates unnecessary listening sockets and daemons, directly shrinking the attack surface and preventing exploitation of services that are not required for the server's role. Option A is incorrect because installing all available third-party software increases the attack surface and introduces unvetted code, which is the opposite of hardening. Option D is incorrect because running the web server as root violates the principle of least privilege; web services should run under a dedicated low-privilege account to contain any compromise.

Answer

Installing all available third-party software

Answer

Running the web server as the root user

Question 6

Which TWO of the following are effective ways to secure endpoints against malware?

Accepted Answer

Implementing a patch management policy. Option A (Implementing a patch management policy) is correct because keeping operating systems and applications up to date closes known vulnerabilities that malware exploits, reducing the attack surface on endpoints. Option E (Deploying EDR software) is correct because Endpoint Detection and Response tools continuously monitor endpoint activity, detect malicious behavior, and can automatically contain or remediate threats that evade signature-based defenses. Option B is wrong because allowing users to install any software increases risk by introducing unvetted, potentially malicious or vulnerable applications. Option C is wrong because turning off all logging destroys the audit trail and telemetry needed to detect, investigate, and respond to malware incidents. Option D is wrong because disabling the OS firewall removes a key network-level control that blocks unauthorized inbound and outbound connections used by malware.

Answer

Allowing users to install any software

Answer

Turning off all logging

Answer

Disabling the OS firewall

Question 7

Which THREE of the following are elements of a secure incident response control set?

Accepted Answer

Establishing a dedicated Incident Response Team (IRT). Option A is correct because a dedicated Incident Response Team (IRT) is a core element of a secure incident response control set, providing defined roles, authority, and accountability for detecting, containing, eradicating, and recovering from security incidents. Option C is correct because a SIEM (Security Information and Event Management) system centralizes log collection, correlation, and alerting, which is essential for timely detection and analysis of incidents. Option D is correct because an updated Incident Response Plan (IRP) documents procedures, communication paths, escalation criteria, and recovery steps, ensuring a consistent and effective response. Option B is incorrect because sharing sensitive server logs on a public forum violates confidentiality and could expose credentials, PII, or exploitable system details. Option E is incorrect because disabling all security controls during an investigation removes visibility and protections, increasing risk and potentially destroying evidence.

Answer

Sharing sensitive server logs on a public forum

Answer

Disabling all security controls during an investigation

Question 8

A financial services firm must comply with GLBA Safeguards Rule. The security team is implementing encryption for data at rest on a new PostgreSQL database. Which of the following is the most appropriate control to protect the data if the underlying storage media is physically stolen?

Accepted Answer

Implement full disk encryption (FDE) on the database server's volumes.. Full disk encryption is the most effective control against physical theft of storage media because it encrypts all data on the disk, including the operating system, database files, and temporary files. Database-level or file-level encryption may leave parts of the system unprotected, allowing an attacker to extract sensitive information from unencrypted areas. For GLBA compliance, FDE provides a strong safeguard for data at rest.

Answer

Apply file-level encryption to the PostgreSQL data directory.

Answer

Use column-level encryption for all sensitive fields.

Answer

Enable Transparent Data Encryption (TDE) at the database level.

Question 9

A healthcare organization is implementing controls to comply with HIPAA Security Rule. The security team is configuring audit logging for a new electronic health record (EHR) system. Which two of the following are essential elements to include in the audit log configuration to meet HIPAA's audit control requirements? (Choose two.)

Accepted Answer

Record the date, time, and user ID for each access event.. HIPAA's audit control standard requires implementing mechanisms to record and examine activity in systems containing ePHI. Essential elements include logging all access to ePHI and capturing sufficient detail such as date, time, and user ID. These enable detection of unauthorized access and support forensic investigations. Other options, like storing logs on the same server or limiting logging, fail to meet the security and retention requirements.

Answer

Enable logging only for failed login attempts to reduce storage costs.

Answer

Configure logs to be overwritten every 24 hours to save disk space.

Answer

Store audit logs on the same server as the EHR application for quick access.

Question 10

A security administrator at a financial firm is hardening a new Windows Server 2022 domain controller. The administrator must ensure that the server meets the organization's requirement to enforce a minimum password length of 14 characters and account lockout after 5 invalid attempts. Which control type best describes the configuration of these settings?

Accepted Answer

Technical control. The enforcement of password length and account lockout thresholds through Group Policy or Local Security Policy is a technical control because it is executed by the operating system to restrict access automatically. Administrative controls are policy documents, physical controls are tangible barriers, and compensating controls are substitutes; none of these directly enforce the settings in real time.

Answer

Physical control

Answer

Administrative control

Answer

Compensating control

Question 11

A retail company is implementing a new point-of-sale (POS) system that must comply with PCI-DSS. The security manager is reviewing the network architecture and wants to ensure that the POS systems are isolated from the corporate network. Which of the following controls best achieves this isolation while allowing necessary communication with the payment processor?

Accepted Answer

Place the POS systems in a separate VLAN with strict firewall rules.. Placing POS systems in a separate VLAN with strict firewall rules provides network segmentation, which is a PCI-DSS requirement to isolate the cardholder data environment from other networks. This control restricts traffic to only necessary communications, such as with the payment processor, reducing the risk of lateral movement from a compromised corporate network. Other options address different risks and do not achieve the required isolation.

Answer

Use a next-generation firewall (NGFW) at the corporate perimeter.

Answer

Enable full disk encryption on all POS terminals.

Answer

Install host-based intrusion prevention systems (HIPS) on each POS terminal.

Question 12

A healthcare organization must protect electronic protected health information (ePHI) in a new cloud-based patient portal. The security team decides to implement a control that renders data unreadable to unauthorized parties even if the storage media is compromised. Which of the following best describes this type of control?

Accepted Answer

Data encryption at rest using AES-256. The scenario requires a control that makes data unreadable if storage media is compromised. Encryption at rest using AES-256 directly fulfills this by converting ePHI into ciphertext, ensuring confidentiality even if physical or logical access to the media occurs. Other controls like RBAC, segmentation, or training address different risk areas and do not provide cryptographic protection of data at rest.

Answer

Network segmentation isolating the patient portal from the corporate network

Answer

Security awareness training for all employees handling ePHI

Answer

Role-based access control (RBAC) limiting access to authorized clinicians

Question 13

A financial services firm is implementing a new credit-scoring application that processes consumer PII. The CISO mandates that the application must enforce a control that restricts access based on the sensitivity of the data and the user's role, and that the control must be evaluated during the design phase. Which type of control is the CISO requiring?

Accepted Answer

Preventive technical control. The requirement is for a control that enforces access restrictions based on data sensitivity and user role, and it must be considered during design. This describes a preventive technical control, such as RBAC or ABAC, which stops unauthorized access before it happens. Detective, corrective, and compensating controls do not proactively enforce access based on these criteria during the design phase, making them incorrect.

Answer

Compensating operational control

Answer

Corrective physical control

Answer

Detective administrative control

Question 14

A financial services firm is implementing a new payment processing system. The security architect must ensure that all changes to the production environment are authorized, tested, and documented before deployment. Which of the following controls best addresses this requirement?

Accepted Answer

Change management process with approval workflows and segregation of duties. The requirement is for a control that ensures changes are authorized, tested, and documented. A change management process with approval workflows and segregation of duties provides this governance by requiring formal requests, reviews, and approvals before deployment. Monitoring, scanning, and RBAC are complementary but do not enforce the change lifecycle, making the change management process the correct choice.

Answer

Continuous security monitoring using a SIEM

Answer

Role-based access control (RBAC) for production systems

Answer

Vulnerability scanning of the production environment

Question 15

A multinational corporation is implementing a new cloud-based ERP system. The GRC analyst must ensure that the control environment aligns with the organization's risk appetite. The CISO asks for a control that provides reasonable assurance that transactions are authorized and recorded accurately. Which type of control is most appropriate?

Accepted Answer

Preventive control. The CISO seeks reasonable assurance that transactions are authorized and recorded accurately. This is best achieved through preventive controls like authorization checks and input validation, which stop errors and fraud at the point of entry. Detective, corrective, and compensating controls operate after the fact or as alternatives, so they do not meet the requirement.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control