CGRC GRC Program — Timed 20 Questions

Question 1

The organization has adopted a 'Defense-in-Depth' strategy. You are tasked with mapping controls to the NIST CSF framework within the GRC tool. What is the most effective way to manage the relationship between framework sub-categories and existing internal controls?

20 minute time limit — choose an answer to begin.

Accepted Answer

Use 'Control Mapping' functionality to link internal controls to NIST sub-categories.. Control mapping functionality in a GRC tool allows you to link existing internal controls to multiple framework sub-categories without duplicating or renaming them. This preserves the organization's control taxonomy while demonstrating coverage against NIST CSF sub-categories, and it supports reuse across frameworks (e.g., mapping the same control to NIST CSF, ISO 27001, and SOC 2). It is the standard, scalable way to manage framework-to-control relationships.

Answer

Rename all internal controls to match the NIST sub-category names.

Answer

Create separate GRC instances for every framework adopted.

Answer

Hard-code the NIST framework into the GRC platform source code.

Question 2

A GRC manager is establishing a risk treatment plan for identified risks. The organization's risk appetite is low for regulatory compliance risks. Which two of the following actions are appropriate risk treatment options for a risk that exceeds the risk appetite? (Choose two.)

Accepted Answer

Implement additional controls to reduce the likelihood or impact of the risk.. The correct answers are implementing additional controls (mitigation) and transferring the risk (e.g., insurance or outsourcing). These are proactive treatment options that address risks exceeding appetite. Mitigation reduces the risk, while transfer shifts financial impact. Both are appropriate for regulatory compliance risks when the organization has a low risk appetite and needs to act.

Answer

Avoid the risk by discontinuing the business activity that creates the risk.

Answer

Monitor the risk and reassess it quarterly without taking immediate action.

Answer

Accept the risk without further action because it is within the organization's risk tolerance.

Question 3

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Accepted Answer

The percentage reduction in repeat audit findings.. A Board of Directors cares about outcomes that reduce organizational risk and cost while improving compliance posture. A reduction in repeat audit findings demonstrates that the GRC program is not just identifying issues but driving durable remediation — the same problems are not recurring. This metric ties GRC activity directly to improved control effectiveness and lower regulatory exposure, which is the language of the boardroom.

Answer

The number of tickets opened in the GRC helpdesk.

Answer

The total storage space consumed by evidence files.

Answer

The number of users logged into the GRC platform daily.

Question 4

Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?

Accepted Answer

Applying an 'Evidence Lock' or 'Retention Policy' to the record.. An 'Evidence Lock' or 'Retention Policy' is the correct feature because it enforces immutability at the record level, preventing modification or deletion for the defined retention period (three years). This satisfies evidentiary integrity requirements by ensuring the evidence cannot be altered after collection. It also produces an auditable control that maps directly to retention and chain-of-custody obligations.

Answer

Disabling the record deletion permission for all users.

Answer

Setting the record visibility to 'Public'.

Answer

Setting the 'Draft' workflow state to permanent.

Question 5

You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?

Accepted Answer

Set up a Workflow Transition Condition triggered by the 'Severity' field.. To enforce that any finding classified as 'High' severity must be approved by the CISO before transitioning to 'Remediated,' you need a workflow transition condition that evaluates the Severity field and requires CISO approval. This is a conditional workflow rule that gates the state transition based on the finding's severity value, ensuring the approval requirement is applied only to High-severity findings.

Answer

Configure a global Business Rule to auto-close all findings.

Answer

Change the default notification email template for findings.

Answer

Modify the User Permission set for the CISO account.

Question 6

An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?

Accepted Answer

Implement a 'Many-to-Many' relationship mapping between Controls and Regulatory Requirements.. A Common Control Framework (CCF) mapping requires establishing relationships between controls and the regulatory requirements they satisfy, so that one control can be reused across multiple requirements and frameworks. A 'Many-to-Many' relationship mapping is the correct mechanism because a single control can satisfy multiple regulatory requirements, and a single requirement can be met by multiple controls. This relationship structure is what enables control reuse, deduplication, and consistent evidence collection across the integrated GRC program.

Answer

Create manual spreadsheets to reconcile the data outside the GRC platform.

Answer

Force all business units to use identical risk taxonomy naming conventions.

Answer

Disable the Regulatory Requirement module to focus only on Risks.

Question 7

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

Accepted Answer

Implementing 'Data Partitioning' or 'Regional Access Scoping'.. Data residency laws (e.g., GDPR, PIPEDA, Russia's Federal Law No. 242-FZ) require that certain data remain within specific geographic boundaries. Implementing data partitioning or regional access scoping in a GRC platform ensures that data is stored and processed only in approved regions and that access is restricted based on the user's region. This directly addresses the compliance requirement by enforcing logical or physical separation of data.

Answer

Setting all user passwords to match the local language.

Answer

Encrypting the entire GRC database with one key.

Answer

Conducting a system-wide vulnerability scan.

Question 8

The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?

Accepted Answer

Configure a 'Dynamic Link' between Audit Testing Results and Risk Rating calculations.. The problem is that Control Effectiveness scores are static and not linked to the latest audit results, causing residual risk to be miscalculated. The architectural fix is to configure a dynamic link (automated data relationship) between Audit Testing Results and Risk Rating calculations so that when audit results change, the control effectiveness score—and therefore residual risk—updates automatically. This ensures the risk calculation reflects current control performance.

Answer

Update the manual risk assessment survey annually.

Answer

Increase the frequency of full organizational risk assessments.

Answer

Require the CISO to manually approve all risk score changes.

Question 9

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

Accepted Answer

Map Active Directory groups to granular GRC Security Profiles.. Mapping Active Directory groups to granular GRC Security Profiles enforces least privilege by ensuring auditors receive only the permissions their role requires, based on their AD group membership. This leverages existing identity infrastructure (AD) as the source of truth while applying role-based access control within the GRC platform. It is the only option that aligns with least privilege principles.

Answer

Assign Global Administrator rights to the lead auditor.

Answer

Enable Single Sign-On (SSO) for all users globally.

Answer

Configure a shared service account for all audit activities.

Question 10

Which GRC platform component is most critical for ensuring that executive leadership receives accurate, real-time risk posture data?

Accepted Answer

The Executive Dashboard and Reporting module.. The Executive Dashboard and Reporting module is correct because it aggregates risk data from across the GRC platform and presents it in real-time, role-appropriate views for leadership. It provides the visualization, drill-down, and trend analysis executives need to make informed risk decisions. Other components support the data but do not deliver the executive-facing risk posture.

Answer

The system audit log.

Answer

The User Provisioning interface.

Answer

The API integration module.

Question 11

When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?

Accepted Answer

To provide a 'Single Source of Truth' for audit and compliance data.. A System of Record (SoR) in a GRC program establishes a single authoritative source for compliance, audit, and risk data, eliminating conflicting versions across departments. This 'Single Source of Truth' ensures consistency, traceability, and reliable reporting for audits and decision-making. It is foundational to effective GRC because it prevents data silos and reconciliation errors.

Answer

To allow every department to have its own data repository.

Answer

To minimize the cost of software licenses.

Answer

To make the GRC platform run faster.

Question 12

The organization's GRC workflow has a 'Request for Exception' process. The goal is to ensure that temporary risk exceptions are automatically reviewed before they expire. Which mechanism is most appropriate?

Accepted Answer

Configuring a 'Workflow Notification' triggered by a field-based 'Expiration Date'.. A field-based workflow notification tied to the 'Expiration Date' field is the correct mechanism because it leverages the GRC platform's native automation to alert the appropriate stakeholders (e.g., risk owner, reviewer) before the exception lapses. This ensures timely, repeatable, and auditable review without relying on human memory. The trigger is data-driven, so it scales across all exceptions and produces a record of the notification event.

Answer

Requiring the Risk Owner to sign a hard copy document.

Answer

Disallowing all risk exceptions in the system configuration.

Answer

Setting a manual reminder on the CISO's calendar.

Question 13

Which role is typically responsible for defining the 'Risk Appetite' within a GRC governance framework?

Accepted Answer

The Executive Steering Committee.. Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives, which is a strategic business decision rather than a technical or operational one. The Executive Steering Committee (or board-level governance body) owns this decision because it has the authority to balance risk against strategic goals and allocate resources accordingly. GRC frameworks such as COSO ERM and ISO 31000 place risk appetite definition at the top of the governance hierarchy, directly under the board of directors.

Answer

The IT Operations Manager.

Answer

The GRC System Administrator.

Answer

The Internal Audit Manager.

Question 14

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Accepted Answer

Use an established 'Data Connector' or 'API Integration' module.. The most efficient configuration approach for ingesting CSPM data into a GRC tool is to use an established 'Data Connector' or 'API Integration' module. These modules are purpose-built to handle authentication, data mapping, scheduling, and error handling, enabling near real-time, automated, and reliable data flow with minimal custom development. This aligns with continuous monitoring principles by ensuring timely and accurate risk data without manual intervention.

Answer

Build a custom script to write directly to the GRC database tables.

Answer

Manually export and import CSV files every hour.

Answer

Have the CSPM tool email screenshots of security alerts to the GRC team.

Question 15

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

Accepted Answer

Adjust the 'Assessment Trigger' logic based on the 'Criticality' score.. The requirement is to trigger Control Self-Assessments automatically based on control criticality. This is achieved by modifying the 'Assessment Trigger' logic to use the 'Criticality' score as a condition. This ensures that high-criticality controls are assessed more frequently or automatically, aligning with risk-based GRC automation. The other options do not address the trigger mechanism or would undermine the self-assessment process.

Answer

Change the global password policy for GRC users.

Answer

Require the GRC admin to manually assign tasks to users.

Answer

Disable the self-assessment feature to force all audits to be external.

Question 16

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

Accepted Answer

Apply a 'Category Filter' or 'Saved View' to the dashboard widget.. To display only risks associated with 'Cybersecurity' on a Risk Heat Map, you should apply a 'Category Filter' or 'Saved View' to the dashboard widget. This allows the executive to see a filtered subset of risks without altering the underlying data or system configuration. Filters and saved views are standard features in GRC platforms for customizing dashboards based on user needs.

Answer

Change the risk rating scale from 1-5 to 1-10.

Answer

Delete all non-cybersecurity risks from the system.

Answer

Create a new database user for the executive.

Question 17

A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?

Accepted Answer

The 'User Permission' or 'Access Control' report.. A 'User Permission' or 'Access Control' report enumerates which users and groups hold which permissions (read, write, delete) on specific objects or modules, including sensitive compliance evidence. This directly answers the question of who has Write access. It is the only report type designed to surface authorization assignments.

Answer

The System Performance Report.

Answer

The Risk Trend Analysis Report.

Answer

The Audit Finding Closure Report.

Question 18

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

Accepted Answer

Apply a 'Status Filter' to the dashboard widget on 'Verified'.. Applying a status filter to the dashboard widget so it only displays records where Assessment Completion equals 'Verified' ensures the Compliance Dashboard reflects only verified assessments. This is the standard GRC platform pattern: the widget queries the underlying assessment object and filters on the status field, so unverified or in-progress assessments are excluded from the dashboard view.

Answer

Create a separate dashboard for every assessment status.

Answer

Restrict user access to the 'Verified' status.

Answer

Set the report to auto-refresh every minute.

Question 19

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. Configuring an automated workflow trigger based on vendor tier and date ensures that critical vendors are systematically flagged for annual due diligence without manual intervention. This leverages the GRC platform's scheduling and tiering capabilities to enforce policy consistently, generate tasks, and maintain audit trails. It aligns with TPRM best practices by automating recurring assessments and reducing the risk of missed reviews.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 20

The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?

Accepted Answer

Set an 'Expiration Date' and 'Workflow Reminder' on the policy record.. Setting an Expiration Date plus a Workflow Reminder on the policy record is the native GRC mechanism that automatically notifies the policy owner before the review deadline and flags the record as overdue if not completed. This enforces the annual review cadence through the platform's workflow engine rather than relying on human memory or manual tracking.

Answer

Block access to the policy after 365 days.

Answer

Create a recurring meeting for the policy owner.

Answer

Require the administrator to manually reset the policy status.