CGRC GRC Program Practice Test 2 — 15 Questions

Question 1

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

Accepted Answer

Apply a 'Category Filter' or 'Saved View' to the dashboard widget.. To display only risks associated with 'Cybersecurity' on a Risk Heat Map, you should apply a 'Category Filter' or 'Saved View' to the dashboard widget. This allows the executive to see a filtered subset of risks without altering the underlying data or system configuration. Filters and saved views are standard features in GRC platforms for customizing dashboards based on user needs.

Answer

Change the risk rating scale from 1-5 to 1-10.

Answer

Delete all non-cybersecurity risks from the system.

Answer

Create a new database user for the executive.

Question 2

A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?

Accepted Answer

The 'User Permission' or 'Access Control' report.. A 'User Permission' or 'Access Control' report enumerates which users and groups hold which permissions (read, write, delete) on specific objects or modules, including sensitive compliance evidence. This directly answers the question of who has Write access. It is the only report type designed to surface authorization assignments.

Answer

The System Performance Report.

Answer

The Risk Trend Analysis Report.

Answer

The Audit Finding Closure Report.

Question 3

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

Accepted Answer

Apply a 'Status Filter' to the dashboard widget on 'Verified'.. Applying a status filter to the dashboard widget so it only displays records where Assessment Completion equals 'Verified' ensures the Compliance Dashboard reflects only verified assessments. This is the standard GRC platform pattern: the widget queries the underlying assessment object and filters on the status field, so unverified or in-progress assessments are excluded from the dashboard view.

Answer

Create a separate dashboard for every assessment status.

Answer

Restrict user access to the 'Verified' status.

Answer

Set the report to auto-refresh every minute.

Question 4

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. Configuring an automated workflow trigger based on vendor tier and date ensures that critical vendors are systematically flagged for annual due diligence without manual intervention. This leverages the GRC platform's scheduling and tiering capabilities to enforce policy consistently, generate tasks, and maintain audit trails. It aligns with TPRM best practices by automating recurring assessments and reducing the risk of missed reviews.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 5

The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?

Accepted Answer

Set an 'Expiration Date' and 'Workflow Reminder' on the policy record.. Setting an Expiration Date plus a Workflow Reminder on the policy record is the native GRC mechanism that automatically notifies the policy owner before the review deadline and flags the record as overdue if not completed. This enforces the annual review cadence through the platform's workflow engine rather than relying on human memory or manual tracking.

Answer

Block access to the policy after 365 days.

Answer

Create a recurring meeting for the policy owner.

Answer

Require the administrator to manually reset the policy status.

Question 6

Which GRC component is used to document the organizational structure, such as business units and departments, to which risks are assigned?

Accepted Answer

The 'Entity' or 'Organization' Manager module.. The 'Entity' or 'Organization' Manager module in a GRC platform is used to document the organizational structure, including business units, departments, and other entities to which risks are assigned. This module provides a hierarchical representation of the organization, enabling risk owners to be mapped to specific units and facilitating roll-up reporting.

Answer

The 'Report' generator.

Answer

The 'Policy' library.

Answer

The 'Incident' tracking module.

Question 7

You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?

Accepted Answer

An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold.. An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold is correct because it directly enforces the risk appetite statement by initiating a Risk Treatment Plan whenever a score exceeds the defined tolerance. This creates a deterministic, auditable linkage between risk scoring and treatment workflow. It also ensures consistency across all risk records rather than relying on individual action.

Answer

A manual email notification from the risk owner to the CISO.

Answer

A change in the risk rating calculation formula.

Answer

A daily report showing all risks over the appetite.

Question 8

When setting up a new GRC program, which TWO of the following are essential for ensuring successful adoption across the business?

Accepted Answer

Obtaining formal executive sponsorship for the initiative.. Option B is correct because formal executive sponsorship gives the GRC program the authority, budget, and cross-functional influence needed to drive adoption and enforce accountability across business units. Option D is correct because clearly defining roles and responsibilities ensures every user knows their specific GRC obligations, such as risk owners, control owners, and evidence providers, which prevents gaps and confusion during rollout. The remaining options do not belong: hiring only external consultants (A) creates dependency rather than internal ownership, disabling audit logs (C) destroys the evidence trail required for governance and compliance, and buying the most expensive GRC module (E) is a cost decision unrelated to adoption success.

Answer

Hiring only external consultants to manage the GRC tool.

Answer

Disabling all audit logs to improve system performance.

Answer

Purchasing the most expensive GRC module available.

Question 9

What is the primary benefit of mapping regulatory requirements to internal controls in a GRC platform?

Accepted Answer

It reduces the burden of redundant testing for multiple frameworks.. Mapping regulatory requirements to internal controls creates a many-to-many relationship where a single control can satisfy multiple regulations (e.g., one access-control policy satisfies SOX, PCI DSS, and ISO 27001). This eliminates duplicate testing and evidence collection, reducing the total compliance workload. It is the core value proposition of a GRC platform.

Answer

It reduces the number of employees required to manage the platform.

Answer

It makes the GRC platform look more professional.

Answer

It hides the compliance gaps from external auditors.

Question 10

Which TWO of the following should be considered when selecting a GRC platform for an enterprise-wide program?

Accepted Answer

Scalability of the platform to handle increasing data volumes.. Option C is correct because an enterprise-wide GRC program accumulates large volumes of risk, control, and compliance data across business units, so the platform must scale to handle increasing data volumes without performance degradation. Option D is correct because a GRC platform must integrate with existing IT and security infrastructure (e.g., SIEM, vulnerability scanners, CMDB, identity systems) via APIs or connectors to automate evidence collection and maintain accurate, real-time risk visibility. Options A, B, and E are not valid selection criteria: free testing hardware, vendor headquarters location, and logo design have no bearing on the functional capability, scalability, or integration fitness of a GRC platform.

Answer

The vendor's ability to provide free hardware for testing.

Answer

The physical location of the vendor's headquarters.

Answer

The complexity of the vendor's logo design.

Question 11

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Accepted Answer

Explicit assignment of policy ownership and accountability.. Option B is correct because effective governance requires that each policy have a clearly identified owner who is accountable for its maintenance, enforcement, and review, ensuring there is no ambiguity about who is responsible. Option D is correct because a GRC policy must contain clear, unambiguous policy statements tied to organizational objectives, so that the controls and requirements directly support the business goals and can be measured and audited. Options A, C, and E are incorrect because a CISO's home address, employees' social media handles, and a website color scheme are irrelevant operational or personal details that do not contribute to policy ownership, accountability, or alignment with organizational objectives.

Answer

The home address of the CISO.

Answer

A list of all employees' social media handles.

Answer

The exact color scheme of the company website.

Question 12

To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?

Accepted Answer

Automated data validation rules for input fields.. Option A is correct because automated data validation rules for input fields enforce integrity at the point of entry, rejecting malformed, out-of-range, or inconsistent values before they can corrupt the GRC system of record. Option C is correct because strict access control and user authorization policies (e.g., role-based access control with least privilege) ensure that only approved users can create or modify records, preventing unauthorized or accidental changes. Option E is correct because comprehensive audit logs of all user actions provide an immutable trail that supports accountability, traceability, and detection of tampering or unauthorized modifications. Option B is incorrect because allowing all users to edit any data at any time destroys integrity by removing authorization boundaries and enabling unauthorized changes. Option D is incorrect because disabling backups removes the ability to restore the system of record after corruption, loss, or ransomware, which is essential for maintaining integrity over time.

Answer

Allowing all users to edit any data at any time.

Answer

Disabling the backup of the GRC database.

Question 13

Which THREE of the following roles are typically involved in a GRC Steering Committee?

Accepted Answer

General Counsel.. A GRC (Governance, Risk, and Compliance) Steering Committee requires senior leaders who own governance, risk, and compliance accountability across the enterprise. A, General Counsel, is correct because legal leadership interprets regulatory and contractual obligations, advises on compliance exposure, and ensures governance decisions align with statutory requirements. C, Chief Risk Officer (CRO), is correct because the CRO owns the enterprise risk management framework, aggregates risk appetite decisions, and reports risk posture to the board. D, Chief Information Security Officer (CISO), is correct because the CISO translates security and privacy compliance requirements (e.g., ISO 27001, NIST CSF, GDPR) into controls and provides the committee with cyber-risk visibility. B, the lead graphic designer, and E, the office maintenance supervisor, are not typically committee members because their roles involve creative production and facilities upkeep, respectively, and carry no enterprise governance, risk, or compliance decision-making authority.

Answer

The lead graphic designer.

Answer

The office maintenance supervisor.

Question 14

Which THREE of the following are necessary to establish a 'Continuous Control Monitoring' (CCM) program?

Accepted Answer

Automated notification workflows for failed controls.. Continuous Control Monitoring (CCM) requires automated, near-real-time evaluation of controls, so option A (automated notification workflows for failed controls) is correct because alerts must fire when a control breaches its threshold so remediation can be triggered promptly. Option C (defined thresholds for 'Pass' or 'Fail' conditions) is correct because CCM cannot evaluate a control without explicit, measurable criteria that determine compliance versus non-compliance. Option D (automated data extraction from IT assets) is correct because CCM depends on continuous, machine-driven collection of telemetry and configuration data from systems rather than periodic human sampling. Option B is not required because daily physical site visits are a manual, point-in-time activity that contradicts the continuous, automated nature of CCM, and option E is not required because a quarterly manual spreadsheet is periodic and manual, which is the opposite of continuous monitoring.

Answer

A physical audit team performing site visits daily.

Answer

A manual spreadsheet that is updated every quarter.

Question 15

In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?

Accepted Answer

Developing treatment plans for risks exceeding appetite.. Option D is correct because a core Risk Management activity is developing treatment plans (mitigate, transfer, avoid, or accept) for risks that exceed the organization's defined risk appetite or tolerance. Option E is correct because risk identification — determining which threats and vulnerabilities could affect business objectives — is the foundational step of the risk management process (identification, analysis, evaluation, treatment, monitoring). Options A and B are unrelated to GRC; office layout design and marketing brochure writing are operational/marketing tasks, not risk management activities. Option C, resetting all employee passwords every 30 days, is a technical access-control/identity-management control (an operational security task), not a Risk Management domain activity.

Answer

Designing new corporate office layouts.

Answer

Writing marketing brochures for the company.

Answer

Resetting all employee passwords every 30 days.