CGRC GRC Program Practice Test 1 — 15 Questions

Question 1

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Accepted Answer

The percentage reduction in repeat audit findings.. 'Reduction in audit findings' directly correlates to lower operational risk and better compliance posture, which resonates with stakeholders.

Answer

The number of tickets opened in the GRC helpdesk.

Answer

The total storage space consumed by evidence files.

Answer

The number of users logged into the GRC platform daily.

Question 2

Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?

Accepted Answer

Applying an 'Evidence Lock' or 'Retention Policy' to the record.. Data retention policies or 'WORM' (Write Once, Read Many) settings on storage repositories ensure compliance with long-term retention requirements.

Answer

Disabling the record deletion permission for all users.

Answer

Setting the record visibility to 'Public'.

Answer

Setting the 'Draft' workflow state to permanent.

Question 3

You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?

Accepted Answer

Set up a Workflow Transition Condition triggered by the 'Severity' field.. Workflow automation engines in GRC platforms use conditional logic transitions to route tasks based on field values like 'Severity'.

Answer

Configure a global Business Rule to auto-close all findings.

Answer

Change the default notification email template for findings.

Answer

Modify the User Permission set for the CISO account.

Question 4

An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?

Accepted Answer

Implement a 'Many-to-Many' relationship mapping between Controls and Regulatory Requirements.. CCF mapping involves linking a single control implementation to multiple regulatory requirements to reduce testing burden.

Answer

Create manual spreadsheets to reconcile the data outside the GRC platform.

Answer

Force all business units to use identical risk taxonomy naming conventions.

Answer

Disable the Regulatory Requirement module to focus only on Risks.

Question 5

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data partitioning or 'Multi-Tenancy/Geographic Segregation' allows GRC platforms to isolate data based on geographic origin.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.

Question 6

The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?

Accepted Answer

Configure a 'Dynamic Link' between Audit Testing Results and Risk Rating calculations.. The calculation engine must be linked to the latest audit evidence object to dynamically update the risk residual score.

Answer

Update the manual risk assessment survey annually.

Answer

Increase the frequency of full organizational risk assessments.

Answer

Require the CISO to manually approve all risk score changes.

Question 7

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

Accepted Answer

Map Active Directory groups to granular GRC Security Profiles.. Mapping specific Active Directory groups to GRC-defined 'Role-Based Access Control' (RBAC) profiles ensures that auditor access is limited to read-only views of evidence repositories.

Answer

Assign Global Administrator rights to the lead auditor.

Answer

Enable Single Sign-On (SSO) for all users globally.

Answer

Configure a shared service account for all audit activities.

Question 8

Which GRC platform component is most critical for ensuring that executive leadership receives accurate, real-time risk posture data?

Accepted Answer

The Executive Dashboard and Reporting module.. Dashboards and reporting widgets are designed to aggregate data from underlying assessment records for executive consumption.

Answer

The system audit log.

Answer

The User Provisioning interface.

Answer

The API integration module.

Question 9

When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?

Accepted Answer

To provide a 'Single Source of Truth' for audit and compliance data.. Defining a single 'System of Record' ensures 'Single Source of Truth' for audit and risk reporting.

Answer

To allow every department to have its own data repository.

Answer

To minimize the cost of software licenses.

Answer

To make the GRC platform run faster.

Question 10

The organization's GRC workflow has a 'Request for Exception' process. The goal is to ensure that temporary risk exceptions are automatically reviewed before they expire. Which mechanism is most appropriate?

Accepted Answer

Configuring a 'Workflow Notification' triggered by a field-based 'Expiration Date'.. Automated workflow notifications tied to the 'Expiration Date' field ensure that exceptions do not remain active indefinitely without review.

Answer

Requiring the Risk Owner to sign a hard copy document.

Answer

Disallowing all risk exceptions in the system configuration.

Answer

Setting a manual reminder on the CISO's calendar.

Question 11

Which role is typically responsible for defining the 'Risk Appetite' within a GRC governance framework?

Accepted Answer

The Executive Steering Committee.. Governance is a top-down function, and the Board or Executive Steering Committee defines risk appetite.

Answer

The IT Operations Manager.

Answer

The GRC System Administrator.

Answer

The Internal Audit Manager.

Question 12

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Accepted Answer

Use an established 'Data Connector' or 'API Integration' module.. Using pre-built API connectors or 'Data Integrators' provided by the GRC platform is the standard way to ingest external security data.

Answer

Build a custom script to write directly to the GRC database tables.

Answer

Manually export and import CSV files every hour.

Answer

Have the CSPM tool email screenshots of security alerts to the GRC team.

Question 13

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

Accepted Answer

Adjust the 'Assessment Trigger' logic based on the 'Criticality' score.. Linking a workflow trigger to a 'Control Criticality' attribute ensures that high-impact controls are assessed more frequently.

Answer

Change the global password policy for GRC users.

Answer

Require the GRC admin to manually assign tasks to users.

Answer

Disable the self-assessment feature to force all audits to be external.

Question 14

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

Accepted Answer

Apply a 'Category Filter' or 'Saved View' to the dashboard widget.. Filtering or 'Reporting View Scoping' allows users to isolate data on dashboards based on attributes like 'Category'.

Answer

Change the risk rating scale from 1-5 to 1-10.

Answer

Delete all non-cybersecurity risks from the system.

Answer

Create a new database user for the executive.

Question 15

The organization has adopted a 'Defense-in-Depth' strategy. You are tasked with mapping controls to the NIST CSF framework within the GRC tool. What is the most effective way to manage the relationship between framework sub-categories and existing internal controls?

Accepted Answer

Use 'Control Mapping' functionality to link internal controls to NIST sub-categories.. The 'Many-to-Many' mapping methodology is the industry standard for reconciling internal controls with external frameworks like NIST CSF.

Answer

Rename all internal controls to match the NIST sub-category names.

Answer

Create separate GRC instances for every framework adopted.

Answer

Hard-code the NIST framework into the GRC platform source code.