CGRC Control Selection Practice Test 3 — 15 Questions

Question 1

A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organization wants to reduce the number of controls that are not applicable due to the cloud provider's inherited controls. Which action should the analyst take FIRST according to NIST SP 800-53?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identify common controls provided by the cloud provider and document them as inherited.. The correct answer is to identify common controls provided by the cloud provider and document them as inherited. This is a key part of tailoring and prevents redundant control implementation. It ensures that the organization focuses on controls not already satisfied by the provider, optimizing resources and maintaining compliance.

Answer

Apply all controls from the high baseline to ensure maximum security.

Answer

Implement all controls from the low baseline and then add controls as needed.

Answer

Conduct a vulnerability assessment to determine which controls are missing.

Question 2

A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premises. The system owner wants to maximize efficiency by reducing duplicate documentation. The organization already has an enterprise-wide access control policy and a centralized identity management system. When developing the system security plan, what is the most appropriate approach for addressing the access control family controls?

Accepted Answer

Document the access control controls as common controls provided by the enterprise identity management system and reference the enterprise policy.. The correct approach is to leverage existing enterprise common controls for access control, as this reduces duplication and ensures consistency with organizational policy. Documenting them as common controls in the system security plan accurately reflects the inheritance and fulfills the requirement to address all applicable controls. This aligns with NIST SP 800-53 guidance on common controls and tailoring.

Answer

Mark all access control controls as not applicable because the enterprise identity management system handles authentication and authorization outside the system boundary.

Answer

Implement all access control controls independently within the payroll system, even if they duplicate enterprise capabilities, to ensure full control.

Answer

Select only the access control controls that are explicitly required by the payroll application vendor's security guide, ignoring the enterprise baseline.

Question 3

You are a security architect for a federal agency. A new system is categorized as LOW impact. The system owner wants to reduce the number of controls to only those that are strictly required. According to NIST SP 800-53B, which of the following is the most appropriate action?

Accepted Answer

Select the LOW baseline from NIST SP 800-53B and apply tailoring to remove controls that are not applicable.. For a LOW-impact system, the correct starting point is the LOW baseline from NIST SP 800-53B. Tailoring is then applied to remove controls that are not applicable, ensuring the final set is appropriate for the system's risk level while maintaining a structured, defensible approach.

Answer

Use the HIGH baseline and tailor it down to low-impact requirements.

Answer

Select the MODERATE baseline and remove controls until only low-impact controls remain.

Answer

Develop a custom set of controls from scratch without using a NIST baseline.

Question 4

A security manager is tailoring a NIST SP 800-53 control baseline for a system that processes sensitive but unclassified information. The system owner proposes to remove a control that requires continuous monitoring because the system is in a low-risk environment. What should the security manager do?

Accepted Answer

Perform a risk assessment to determine if compensating controls can provide equivalent protection.. The correct action is to perform a risk assessment to determine if compensating controls can provide equivalent protection. Tailoring is risk-based, and removing a control requires justification. The assessment ensures that any modification maintains the system's security posture and is documented appropriately.

Answer

Approve the removal because the system is low-risk and continuous monitoring is expensive.

Answer

Deny the removal and require the control to be implemented as written.

Answer

Escalate to the authorizing official for a final decision without further analysis.

Question 5

You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider. The control is documented in the system security plan as 'Inherited'. What is the most critical item to verify during assessment?

Accepted Answer

That the control is implemented correctly and consistently by the common control provider.. When a control is inherited, the system owner depends on the common control provider for its implementation. Therefore, the most critical verification is that the control is implemented correctly and consistently. This ensures the inheritance is valid and the system's security posture is not compromised by relying on an ineffective control.

Answer

That the common control provider has a current authorization to operate.

Answer

That the system owner has signed a memorandum of understanding with the provider.

Answer

That the control is listed in the common control provider's security plan.

Question 6

An organization is selecting controls for a new information system. The system is categorized as low impact. According to NIST SP 800-53B, which baseline should be used as the starting point?

Accepted Answer

Low baseline. The correct answer is the low baseline. NIST SP 800-53B defines baselines for low, moderate, and high impact systems. Starting with the low baseline for a low-impact system ensures that the appropriate minimum controls are selected, which can then be tailored based on specific needs.

Answer

Moderate baseline

Answer

Privacy baseline

Answer

High baseline

Question 7

A security architect is selecting controls for a system that will be deployed in a virtualized environment. The architect notes that many controls in the NIST SP 800-53 baseline assume physical separation. Which tailoring action is most appropriate to address this?

Accepted Answer

Replace physical separation controls with logical separation controls that provide equivalent protection.. The correct action is to replace physical separation controls with logical separation controls that provide equivalent protection. Tailoring permits such substitutions when they meet the security objective. This approach maintains security while accommodating the virtualized environment.

Answer

Remove all controls that reference physical separation as they are not applicable.

Answer

Implement the physical separation controls as written, even if they are not feasible.

Answer

Mark the controls as not applicable and document the justification.

Question 8

You are a risk practitioner for a healthcare organization. You are selecting controls for a system that processes electronic protected health information (ePHI). You need to ensure compliance with the HIPAA Security Rule while using NIST SP 800-53 as a framework. What is the most effective approach?

Accepted Answer

Create a custom overlay that maps HIPAA Security Rule requirements to NIST SP 800-53 controls and apply it to the baseline.. The most effective approach is to create an overlay that maps HIPAA Security Rule requirements to NIST SP 800-53 controls and apply it to an appropriate baseline. This ensures that all HIPAA-specific mandates are addressed while leveraging the comprehensive NIST framework for a risk-based, structured control set.

Answer

Use the NIST SP 800-53 MODERATE baseline as-is, because it is more stringent than HIPAA.

Answer

Select only the controls that are explicitly mentioned in the HIPAA Security Rule and ignore the rest of the NIST baseline.

Answer

Use the NIST SP 800-53 LOW baseline and add controls as needed based on a risk assessment.

Question 9

You are a security analyst at a hospital that must comply with HIPAA and NIST SP 800-53. You are selecting controls for a new patient portal. Your manager asks you to reduce unnecessary duplication by identifying controls that are already provided by the hospital's centralized identity management system. Which type of control should you document for the portal's authentication requirements?

Accepted Answer

Common control. The centralized identity management system provides authentication for the patient portal and other systems, so the portal inherits this capability. Documenting it as a common control accurately reflects that one implementation serves multiple systems, reduces duplication, and clarifies responsibility. This aligns with NIST SP 800-53 guidance on common controls, which are managed by a common provider and inherited by consuming systems.

Answer

Compensating control

Answer

Hybrid control

Answer

System-specific control

Question 10

A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine which controls can be inherited from the cloud provider. Which TWO of the following are appropriate actions to take during this process? (Choose two.)

Accepted Answer

Review the cloud provider's SOC 2 report to identify controls that are implemented and can be inherited.. The correct actions are to review the cloud provider's SOC 2 report to identify inheritable controls and to document inherited controls in the system security plan. These steps ensure that the organization accurately identifies and records which controls are provided by the cloud provider, avoiding duplication and ensuring accountability.

Answer

Conduct a penetration test of the cloud provider's infrastructure to verify inherited controls.

Answer

Assume all controls are inherited because the cloud provider is responsible for security.

Answer

Implement all controls from the baseline regardless of the provider's offerings.

Question 11

You are selecting controls for a federal information system categorized as LOW impact. The system owner wants to use NIST SP 800-53B low baseline but also needs to address a specific threat from a recent vulnerability scan that is not covered by the baseline. What is the most appropriate action?

Accepted Answer

Tailor the low baseline by adding a control or control enhancement that addresses the specific threat.. Tailoring the low baseline by adding a control or enhancement that addresses the specific threat is the most appropriate action. It allows the organization to manage the identified risk without overburdening the system with unnecessary controls. This approach aligns with NIST SP 800-53B and the RMF, where tailoring is used to adjust baselines based on organizational risk assessments and specific threats.

Answer

Request an exception from the authorizing official to ignore the vulnerability, because the baseline does not require a control for it.

Answer

Apply the moderate baseline instead, because it includes more controls that might cover the threat.

Answer

Document the threat as a residual risk and take no action, because the low baseline is sufficient for LOW impact systems.

Question 12

A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organization wants to reduce the number of controls that are not applicable due to the cloud provider's inherited controls. Which action should the analyst take FIRST according to NIST SP 800-53?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the control and document the rationale in the system security plan as a tailored enhancement.. Supplementing a LOW baseline with a control from a higher baseline is a legitimate tailoring action when justified by risk. The control should be added, and the rationale documented in the system security plan. This approach ensures the control set is tailored to the system's specific risk profile while maintaining alignment with NIST SP 800-53 guidance.

Answer

Re-categorize the system as MODERATE impact so that the control can be included without additional documentation.

Answer

Add the control but mark it as not applicable in the system security plan to avoid additional assessment burden.

Answer

Do not add the control because the system is LOW impact and must only use the LOW baseline.

Question 13

You are a security consultant helping a financial institution select controls for a new mobile banking application. The institution must comply with PCI DSS and NIST SP 800-53. During control selection, you identify that a NIST SP 800-53 control has a parameter that must be defined, such as the frequency of reviews. What should you do to ensure the control is properly implemented?

Accepted Answer

Assign a value to the parameter based on organizational risk tolerance and document it in the security plan.. Control parameters, also called assignment statements, require organizations to define specific values such as review frequency or timeout periods. Assigning a value based on risk tolerance and documenting it in the security plan ensures the control is tailored and assessable. This is a required part of the RMF and NIST SP 800-53 tailoring process, and it helps demonstrate compliance with both NIST and PCI DSS requirements.

Answer

Remove the control entirely because it contains a parameter, as parameters indicate the control is not applicable.

Answer

Leave the parameter blank so that the control can be interpreted flexibly during assessment.

Answer

Use the default value provided in NIST SP 800-53 without modification, because defaults are always acceptable.

Question 14

You are a security architect selecting controls for a new federal payroll system categorized as MODERATE impact. The system will be hosted in a government-operated data center. Your organization has already implemented a robust physical security program at the facility, including 24/7 guards, biometric access, and CCTV monitoring. You must select the most appropriate control for physical access authorization. Which action best aligns with NIST SP 800-53 control selection and tailoring guidance?

Accepted Answer

Document the facility's physical access controls as a common control inherited by the payroll system and focus on verifying their adequacy.. The correct approach is to leverage the existing facility physical security as a common control. This aligns with NIST SP 800-53 tailoring guidance, which encourages the use of common controls to reduce redundancy and ensure consistent protection. Documenting the control as inherited and verifying its adequacy satisfies the requirement without unnecessary duplication.

Answer

Implement a new, system-specific physical access control system for the payroll system's server room, duplicating the facility's existing controls.

Answer

Mark the physical access authorization control as 'Not Applicable' because the facility already has physical security, and no further action is needed.

Answer

Select a different control from the PE family that is easier to implement, such as monitoring physical access, and omit the access authorization control.

Question 15

You are selecting controls for a cloud-based system that will be used by a government agency. The cloud service provider (CSP) has a FedRAMP authorization. You need to determine which controls are inherited from the CSP. What should you review to understand the CSP's control implementation and inheritance details?

Accepted Answer

The CSP's FedRAMP authorization package, including the system security plan (SSP) and control assessment results.. The CSP's FedRAMP authorization package, including the system security plan (SSP) and assessment results, is the authoritative source for understanding which controls are implemented and can be inherited. It documents control implementations and provides evidence of effectiveness, allowing the agency to accurately identify inherited, shared, and customer-implemented controls. This ensures proper control selection and avoids duplication or gaps.

Answer

The NIST SP 800-53 catalog of controls, because it lists all possible controls and their inheritance.

Answer

The CSP's marketing materials and service level agreements (SLAs).

Answer

The agency's own security plan from a previous on-premises system.