CGRC GRC Program Practice Test 2 — 15 Questions

Question 1

A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?

Accepted Answer

The 'User Permission' or 'Access Control' report.. Access Control or 'User Permission' reports are specifically designed to audit GRC platform access levels.

Answer

The System Performance Report.

Answer

The Risk Trend Analysis Report.

Answer

The Audit Finding Closure Report.

Question 2

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

Accepted Answer

Apply a 'Status Filter' to the dashboard widget on 'Verified'.. Workflow-driven reporting or 'Dashboard Filters' based on record state ensure that reports only reflect validated data.

Answer

Create a separate dashboard for every assessment status.

Answer

Restrict user access to the 'Verified' status.

Answer

Set the report to auto-refresh every minute.

Question 3

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. A 'Scheduled Assessment' or 'Workflow Trigger' based on 'Vendor Criticality' ensures compliance with due diligence timelines.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 4

The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?

Accepted Answer

Set an 'Expiration Date' and 'Workflow Reminder' on the policy record.. Setting a 'Review Date' field and using 'Workflow Reminders' automates the annual policy lifecycle.

Answer

Block access to the policy after 365 days.

Answer

Create a recurring meeting for the policy owner.

Answer

Require the administrator to manually reset the policy status.

Question 5

Which GRC component is used to document the organizational structure, such as business units and departments, to which risks are assigned?

Accepted Answer

The 'Entity' or 'Organization' Manager module.. The 'Organization Hierarchy' or 'Entity Manager' module defines the business structure within the GRC platform.

Answer

The 'Report' generator.

Answer

The 'Policy' library.

Answer

The 'Incident' tracking module.

Question 6

You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?

Accepted Answer

An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold.. A 'Business Rule' or 'Workflow Trigger' that monitors the 'Residual Risk' field against the 'Appetite' threshold is required.

Answer

A manual email notification from the risk owner to the CISO.

Answer

A change in the risk rating calculation formula.

Answer

A daily report showing all risks over the appetite.

Question 7

When setting up a new GRC program, which TWO of the following are essential for ensuring successful adoption across the business?

Accepted Answer

Obtaining formal executive sponsorship for the initiative.. Executive sponsorship and clear ownership are foundational for any governance program.

Answer

Hiring only external consultants to manage the GRC tool.

Answer

Disabling all audit logs to improve system performance.

Answer

Purchasing the most expensive GRC module available.

Question 8

What is the primary benefit of mapping regulatory requirements to internal controls in a GRC platform?

Accepted Answer

It reduces the burden of redundant testing for multiple frameworks.. Mapping eliminates redundant testing by showing how one control satisfies multiple regulatory mandates.

Answer

It reduces the number of employees required to manage the platform.

Answer

It makes the GRC platform look more professional.

Answer

It hides the compliance gaps from external auditors.

Question 9

Which TWO of the following should be considered when selecting a GRC platform for an enterprise-wide program?

Accepted Answer

Scalability of the platform to handle increasing data volumes.. Integration capabilities and scalability are vital for enterprise deployments.

Answer

The vendor's ability to provide free hardware for testing.

Answer

The physical location of the vendor's headquarters.

Answer

The complexity of the vendor's logo design.

Question 10

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Accepted Answer

Explicit assignment of policy ownership and accountability.. Policy statements and ownership are core components for governance and compliance.

Answer

The home address of the CISO.

Answer

A list of all employees' social media handles.

Answer

The exact color scheme of the company website.

Question 11

To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?

Accepted Answer

Automated data validation rules for input fields.. Integrity is managed via audit trails, access controls, and data validation rules.

Answer

Allowing all users to edit any data at any time.

Answer

Disabling the backup of the GRC database.

Question 12

Which THREE of the following roles are typically involved in a GRC Steering Committee?

Accepted Answer

General Counsel.. Senior leadership roles like CISO, CRO, and General Counsel provide the necessary oversight for GRC.

Answer

The lead graphic designer.

Answer

The office maintenance supervisor.

Question 13

Which THREE of the following are necessary to establish a 'Continuous Control Monitoring' (CCM) program?

Accepted Answer

Automated notification workflows for failed controls.. CCM requires automated data feeds, defined thresholds, and notification mechanisms to be effective.

Answer

A physical audit team performing site visits daily.

Answer

A manual spreadsheet that is updated every quarter.

Question 14

In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?

Accepted Answer

Developing treatment plans for risks exceeding appetite.. Risk identification and treatment are the primary functions of risk management within GRC.

Answer

Designing new corporate office layouts.

Answer

Writing marketing brochures for the company.

Answer

Resetting all employee passwords every 30 days.

Question 15

When aligning GRC with business objectives, which THREE of the following represent effective strategic alignment?

Accepted Answer

Mapping risk categories to specific business processes.. Alignment is achieved by mapping risks to objectives, involving stakeholders, and measuring impact.

Answer

Focusing exclusively on technical vulnerability patching.

Answer

Allowing IT teams to ignore GRC policies for speed.