CGRC Hard Questions — 25 Difficult Questions

Question 1

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A System Interconnection Agreement (SIA) or Data Use Agreement (DUA) provides the formal record of cross-boundary data flows.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 2

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Accepted Answer

Add additional controls to the baseline to address specific threat vectors.. Supplementing is the process of adding controls to a baseline to address specific mission or business requirements that are not covered by the standard baseline.

Answer

Replace a control with a vendor-provided security feature.

Answer

Remove controls from the baseline that are technically infeasible.

Answer

Adjust the parameters of existing controls to lower operational impact.

Question 3

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Accepted Answer

Greater reliance on third-party audit reports. In a cloud environment, the provider manages the physical and infrastructure controls (inherited), meaning the assessor focuses on verifying the provider's attestations (like SOC 2 reports).

Answer

POA&M is prohibited for cloud providers

Answer

Physical security is no longer assessed

Answer

Manual testing is mandated for all controls

Question 4

Which THREE of the following are elements of a secure incident response control set?

Accepted Answer

Establishing a dedicated Incident Response Team (IRT). Preparation, identification, and containment are foundational phases of the incident response lifecycle.

Answer

Sharing sensitive server logs on a public forum

Answer

Disabling all security controls during an investigation

Question 5

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

Accepted Answer

Certificate Revocation List (CRL) Distribution Point. A Certificate Revocation List (CRL) is essential for clients to verify if a certificate is still valid.

Answer

OCSP Responder

Answer

Key Archival

Answer

Trust Anchor

Question 6

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Accepted Answer

CMVP validation certificate. A NIST Cryptographic Module Validation Program (CMVP) certificate provides formal verification that a product has met the FIPS 140 requirements.

Answer

Manufacturer's technical specification document

Answer

Internal configuration audit report

Answer

Email from the vendor

Question 7

Which technique is best to detect 'false negatives' during a security control assessment?

Accepted Answer

Reviewing security log correlation. Correlation of logs from multiple sources (e.g., firewall, IPS, host logs) allows an auditor to see if a threat was missed by a single control.

Answer

Interviewing developers

Answer

Checking server physical locks

Answer

Single tool vulnerability scanning

Question 8

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Evidence must be protected from unauthorized changes, be verifiable, and be stored securely to maintain its chain of custody.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper

Question 9

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Accepted Answer

Ensuring the assignment value is consistent with organizational policy.. Effective management of assignments ensures that controls are tailored and that the organization has a clear record of its security obligations.

Answer

Updating all assignment values daily.

Answer

Consulting with the NIST publication author.

Question 10

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 11

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Accepted Answer

Create a Publisher Rule based on the certificate issuer and product name. Publisher rules in AppLocker allow for the most granular control based on digital certificates.

Answer

Create a Path Rule for C:\Program Files\*

Answer

Configure the 'Audit only' mode in Group Policy

Answer

Create a Hash Rule for every existing executable

Question 12

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. A compensating control is an alternate measure used to satisfy the requirement of a security control that cannot be implemented as stated.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 13

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Accepted Answer

Incorporate them into the POA&M and track remediation progress.. Conditions attached to an ATO represent known risks that must be tracked and mitigated through the POA&M to transition to full, unconditioned authorization.

Answer

Document them in the System Security Plan (SSP) as 'accepted risks'.

Answer

Ignore them until the next major system upgrade.

Answer

Submit a request to the AO to remove the conditions without changes.

Question 14

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Accepted Answer

Create a certificate of destruction for audit purposes.. Sanitizing the media, updating the inventory, and documenting the destruction process are all critical steps for classified systems.

Answer

Move the system to a secure storage area for indefinite holding.

Answer

Reformat the drive for reuse in a non-sensitive project.

Question 15

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Accepted Answer

Account management lifecycle. Disabled account management is a critical detective and preventive control to ensure that only authorized, active users have access.

Answer

Audit log retention

Answer

Role-based access control

Answer

Multi-factor authentication

Question 16

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Accepted Answer

Target completion date. A POA&M must define the vulnerability/weakness and the specific milestone/date for remediation.

Answer

Personnel salary data

Answer

Historical audit logs

Answer

Software licensing keys

Question 17

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

Accepted Answer

Exclude known safe processes and signers. Tuning policies to exclude known safe administrative scripts and software reduces noise while maintaining core monitoring.

Answer

Only monitor server logs

Answer

Set to 'Block All' mode

Answer

Disable real-time scanning

Question 18

When implementing an 802.1X environment, what is the role of the RADIUS server?

Accepted Answer

Authenticating the supplicant. The RADIUS server acts as the Authentication Server, validating the credentials provided by the supplicant via the authenticator.

Answer

Encapsulating EAP frames

Answer

Providing the EAP method to the client

Answer

Enforcing the physical port state

Question 19

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

Accepted Answer

The server's TLS configuration file. The web server's SSL/TLS configuration file (e.g., httpd.conf or nginx.conf) defines the supported cipher suites.

Answer

The server's BIOS settings

Answer

The web application's root directory

Answer

The firewall access control list

Question 20

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

Accepted Answer

Access via a Jump Server with MFA. A Bastion Host with MFA ensures that access to production is controlled, logged, and authenticated securely.

Answer

Shared administrative password

Answer

VPN connection to the internal network

Answer

Direct SSH access to the server