CGRC Control Selection Practice Test 2 — 15 Questions

Question 1

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Accepted Answer

The overlay supplements the baseline.. In NIST SP 800-53, an overlay is a set of additional or modified controls applied to a baseline to address specific technology, environment, or mission needs. The overlay supplements the baseline (Option A) by adding controls or tailoring existing ones; it does not replace or discard the baseline. The baseline remains the foundation, and the overlay enhances it.

Answer

The overlay is used only if the system is High impact.

Answer

The baseline is discarded if an overlay is used.

Answer

The overlay replaces the entire baseline.

Question 2

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Accepted Answer

It provides a standardized set of controls for a specific technology stack.. A control overlay is a pre-defined set of controls and control enhancements that can be applied to a baseline to address specific technologies, environments, or mission needs — such as cloud computing. In the NIST RMF context, overlays provide a standardized, reusable way to tailor a baseline for a particular technology stack (e.g., cloud, mobile, industrial control systems) without starting from scratch. The primary benefit is consistency and efficiency: organizations get a vetted set of controls appropriate to the cloud environment, reducing ad hoc tailoring and ensuring coverage of cloud-specific risks.

Answer

It replaces the need for FIPS 199 categorization.

Answer

It eliminates the need for manual tailoring.

Answer

It automatically tests the controls for compliance.

Question 3

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

Accepted Answer

To serve as a comprehensive list of all possible security controls.. The NIST SP 800-53 Control Catalog is a comprehensive list of security and privacy controls that organizations use as a source for selecting controls during the RMF process. Its main purpose is to provide the full set of possible controls from which tailored baselines (Low, Moderate, High) are derived for a given system.

Answer

To automate the scanning process.

Answer

To mandate the order of implementation.

Answer

To identify which vendors are compliant.

Question 4

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

Accepted Answer

Define the frequency based on organizational policy.. In NIST SP 800-53, '[Assignment: organization-defined frequency]' is an explicit placeholder indicating that the organization must fill in the value as part of tailoring the control. The system owner, in coordination with the Authorizing Official and organizational policy, defines the frequency (e.g., annually, quarterly) and documents it in the system security plan. Leaving it blank or removing the control would break the control baseline and fail assessment.

Answer

Use the default value provided in the appendix.

Answer

Remove the control since it is not fully defined.

Answer

Leave the assignment blank.

Question 5

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. During the Control Selection phase, the Authorizing Official (AO) is responsible for approving the tailoring decisions made by the system owner and security team, ensuring the selected controls adequately address the system's risk profile. The AO's approval formalizes the agreed-upon control set before it moves into implementation and assessment. This approval is a key governance step that ties control selection to the authorization decision.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 6

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement in the RMF tailoring process (NIST SP 800-37 / SP 800-53) is the step where control statements are adjusted — adding specificity, clarifying language, or scoping the control to the system's particular environment — so the control is precise and implementable. It does not change the control's intent or the system's impact level; it makes the wording actionable for the specific system. This is distinct from scoping (removing controls not applicable) and supplementation (adding controls beyond the baseline).

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 7

If a control is determined to be 'system-specific', what does that mean?

Accepted Answer

It is implemented by the system owner for that system only.. A system-specific control is one that is implemented by the system owner and applies only to that particular system, as opposed to common controls shared across the organization or hybrid controls that combine both. This designation is part of the NIST RMF control inheritance model, where controls are categorized as common, system-specific, or hybrid. The system owner bears responsibility for implementing and documenting system-specific controls in the system security plan.

Answer

It is a hybrid control.

Answer

It must be implemented by the vendor.

Answer

It is inherited from the enterprise.

Question 8

Which TWO of the following are considered 'common controls'?

Accepted Answer

Physical building access badges.. In security control categorization, 'common controls' are controls that are inherited by or shared across multiple systems rather than being unique to a single information system. Option C (physical building access badges) is a common control because facility-level physical access mechanisms protect all systems and personnel within the building, not just one application. Option E (network boundary protection/firewall for the data center) is a common control because the firewall at the data center perimeter provides shared network protection for every system hosted behind it. By contrast, options A (custom source code of a business logic application), B (application-specific encryption keys), and D (the specific database schema of a custom app) are all system-specific controls tied to one particular application, so they are not shared or inherited across systems and therefore are not common controls.

Answer

The custom source code of a business logic application.

Answer

Application-specific encryption keys.

Answer

The specific database schema of a custom app.

Question 9

You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?

Accepted Answer

That the common control provider provides evidence of compliance.. When a control is marked 'Inherited', the system owner is relying on a common control provider (CCP) to implement and assess that control. The most critical verification is that the CCP provides evidence of compliance, such as assessment reports or authorization documentation, to ensure the control is actually effective for the system's scope.

Answer

That the control is listed in the system's own configuration guide.

Answer

That the system owner has full administrative control.

Answer

That the control is manually tested by the system team.

Question 10

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

Accepted Answer

The control is not applicable to the system's technology.. Option A is correct because NIST 800-53 baselines are tailored when a control addresses technology that the system does not employ — for example, a wireless access control (AC-18) on a system with no wireless capability — making the control not applicable and eligible for removal or scoping out. Option B is correct because tailoring also includes supplementing or strengthening the baseline with additional controls or more rigorous parameters when the system's environment, threat profile, or mission demands greater assurance than the baseline provides, such as raising an audit frequency parameter. Options C and D are not valid tailoring reasons: cost and monitoring difficulty are not criteria in the NIST RMF tailoring process, which is driven by applicability, risk, and mission/business needs rather than convenience. Option E is incorrect because the system owner cannot unilaterally disagree with a FIPS 199 categorization; the categorization is based on the impact of loss of confidentiality, integrity, and availability, and disputes are resolved through the formal categorization and approval process, not by tailoring the control baseline.

Answer

The control has a high cost of implementation.

Answer

The control is too difficult to monitor.

Answer

The system owner disagrees with the FIPS 199 classification.

Question 11

Which THREE of the following are components that must be included when documenting a compensating control?

Accepted Answer

A detailed explanation of how the compensating control mitigates the risk.. Option B is correct because documenting a compensating control must include a detailed explanation of how the control mitigates the identified risk, demonstrating that the alternative measure provides equivalent protection to the original requirement. Option C is correct because the documentation must clearly describe the risk the control is intended to mitigate, establishing the security objective the compensating control addresses. Option E is correct because the documentation must state the reason the original control could not be implemented, justifying why a compensating control is necessary in the first place. Option A is not required, since the identity of the approving person is not a mandatory element of the compensating control description itself, even though approvals are tracked elsewhere in the risk management process. Option D is not required, as listing every affected user is not a standard component; the documentation focuses on the risk, the mitigation method, and the justification for the alternative control.

Answer

The identity of the person who approved the control.

Answer

A list of every user affected by the control.

Question 12

Which THREE factors should an organization consider when applying control overlays?

Accepted Answer

The mission or business requirements of the system.. Control overlays are tailored sets of controls applied on top of a baseline, so they must be driven by the system's mission or business requirements (C), since the overlay exists to address specific needs such as privacy, cloud, or industrial control environments that the baseline alone does not cover. The impact level of the underlying system (D) matters because FIPS 199/SP 800-53 baselines are selected by impact (low, moderate, high), and the overlay must be consistent with that categorization and the associated control rigor. The existing control baseline of the system (E) is also essential, because an overlay is applied relative to an already-selected baseline, and knowing which controls are already implemented or inherited prevents duplication and gaps. By contrast, the personal preference of the system administrator (A) is not a valid factor, since overlays must be justified by mission, risk, and compliance needs rather than individual taste, and the date the system was originally purchased (B) is irrelevant to overlay selection, as age of hardware does not determine which controls are required.

Answer

The personal preference of the system administrator.

Answer

The date the system was originally purchased.

Question 13

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Accepted Answer

Ensuring the assignment value is consistent with organizational policy.. Option B is correct because NIST 800-53 assignment values (the organization-defined parameters in controls) must reflect and be consistent with the organization's own policies, so the chosen value aligns with governance requirements. Option D is correct because after an assignment value is set, you must verify that the control implementation actually addresses that value; otherwise the control is not truly satisfied. Option E is correct because assignment values must be documented in the system security plan (SSP), which records how controls are implemented, including the specific organization-defined parameters. Option A is not correct because assignment values are not updated daily; they are reviewed and updated as needed based on changes in policy, risk, or system environment. Option C is not correct because consulting the NIST publication author is not a required management action; organizations use the published guidance directly.

Answer

Updating all assignment values daily.

Answer

Consulting with the NIST publication author.

Question 14

Which TWO of the following statements regarding the 'Tailoring' process are accurate?

Accepted Answer

Tailoring actions must be documented to justify the risk management decisions.. Option B is correct because the RMF requires that all tailoring actions be documented in the system security plan (SSP) and supporting artifacts so that the risk management decisions and their rationale are transparent and auditable. Option D is correct because tailoring is precisely the process of adjusting the initial control baseline (from NIST SP 800-53B) to account for system-specific factors such as mission needs, environment of operation, organizational constraints, and risk tolerance, resulting in the system's tailored baseline. Option A is incorrect because tailoring occurs during the Select step (Step 2) of the RMF, not the Assess step (Step 4). Option C is incorrect because tailoring applies to all systems regardless of impact level (Low, Moderate, or High). Option E is incorrect because tailoring is a required part of the RMF Select step, not an optional activity.

Answer

Tailoring is performed during the Assess step.

Answer

Tailoring is only permitted for High impact systems.

Answer

Tailoring is optional and not required by RMF.

Question 15

Which THREE of the following are benefits of using the NIST 800-53 control framework?

Accepted Answer

It supports a consistent approach to security across the organization.. Option A is correct because NIST SP 800-53 provides a standardized catalog of security and privacy controls that organizations can apply uniformly across all systems and business units, ensuring a consistent approach to security across the organization. Option C is correct because the framework is built around the risk management process (per NIST RMF and SP 800-37), allowing organizations to select and tailor controls based on assessed risk, which directly facilitates risk-based decision-making. Option E is correct because the common control identifiers and terminology in SP 800-53 give security teams, auditors, and stakeholders a shared vocabulary, providing a common language for security controls. Option B is incorrect because implementing and interpreting the framework still requires significant technical and security expertise. Option D is incorrect because NIST 800-53 is a control framework, not an automation tool; it does not automate manual security processes.

Answer

It eliminates the need for any technical expertise.

Answer

It automates all manual security processes.