CGRC Hard Questions — 25 Difficult Questions

Question 1

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Accepted Answer

It reduces the level of effort for the security assessment. A FedRAMP-authorized CSP has already undergone an independent, NIST SP 800-53-based security assessment by a Third-Party Assessment Organization (3PAO) and received an Authority to Operate (ATO) from a federal agency. Federal agencies (and organizations leveraging FedRAMP reciprocity) can reuse that assessment package—the SSP, SAR, and POA&M—rather than performing a full independent assessment of the CSP's environment. This reuse dramatically reduces the level of effort, cost, and time required for the customer's own security authorization activities.

Answer

It guarantees the system will never be breached

Answer

It eliminates the need for any internal security oversight

Answer

It allows the organization to bypass the RMF

Question 2

You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a commercial cloud service provider (CSP) for infrastructure as a service (IaaS). The CSP has a FedRAMP authorization at the Moderate impact level. Your system requires additional controls beyond the CSP's baseline. Which action should you take first to address the gap?

Accepted Answer

Implement a control overlay that adds the necessary controls and documents them in the system security plan.. The first step is to implement a control overlay to add the necessary controls to the CSP's Moderate baseline. Overlays are designed to tailor baselines for specific environments or impact levels, enabling the system to meet its security requirements without disrupting the CSP's authorization. This approach is efficient and aligns with NIST guidance.

Answer

Require the CSP to obtain a new FedRAMP authorization at the High impact level before proceeding.

Answer

Document the gap as a risk and accept it without additional controls, since the CSP is already authorized.

Answer

Select a different CSP that already has a FedRAMP High authorization and migrate the system.

Question 3

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Accepted Answer

The on-premises servers are included in the boundary because they are under the agency's direct control and process CUI.. The boundary should include components under the agency's direct control that process CUI, such as on-premises servers. For cloud services with FedRAMP authorizations, the agency can exclude those components if it documents inherited controls and accepts residual risk. This approach aligns with NIST guidance on leveraging external authorizations and focusing on the agency's own responsibilities.

Answer

The boundary must include all cloud components regardless of the provider's authorization status to ensure end-to-end security.

Answer

The boundary should be defined based on the physical location of the servers to ensure data sovereignty requirements are met.

Answer

The PaaS provider's underlying infrastructure is included in the boundary because the agency's applications run on it.

Question 4

A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?

Accepted Answer

FedRAMP Customer Responsibility Matrix (CRM). The FedRAMP Customer Responsibility Matrix (CRM) is the key document that defines which security controls are inherited from the CSP and which the agency must implement and assess. By using the CRM, the agency can avoid duplicating assessments and focus on its own responsibilities. This leverages the FedRAMP authorization to streamline the ATO process while ensuring all controls are covered.

Answer

FedRAMP Authority to Operate (ATO) letter

Answer

FedRAMP Security Assessment Report (SAR)

Answer

FedRAMP Continuous Monitoring (ConMon) plan

Question 5

A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common control provided by a separate organizational unit. The common control's assessment was performed by that unit, and the results are documented in a shared assessment report. What should the Assessor do to support the system's authorization?

Accepted Answer

Review the shared assessment report to determine if it meets the system's assurance requirements and document any inheritance of the control in the system security plan.. Common controls can be leveraged across systems, and their assessment results can be reused if they meet the receiving system's assurance requirements. The Assessor should review the shared report for currency, scope, and relevance, then document the inheritance in the system security plan. Re-assessing or excluding the control would be inefficient or incorrect. This practice aligns with the RMF's goal of reuse and reciprocity.

Answer

Re-assess the common control independently because the system's high-impact level requires a full assessment of all controls.

Answer

Perform a penetration test of the common control to validate the shared assessment report before accepting it.

Answer

Exclude the common control from the system's assessment because it is outside the system's authorization boundary.

Question 6

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

Accepted Answer

Configure an 'Automated Workflow Trigger' based on 'Vendor Tier' and 'Date'.. Configuring an automated workflow trigger based on vendor tier and date ensures that critical vendors are systematically flagged for annual due diligence without manual intervention. This leverages the GRC platform's scheduling and tiering capabilities to enforce policy consistently, generate tasks, and maintain audit trails. It aligns with TPRM best practices by automating recurring assessments and reducing the risk of missed reviews.

Answer

Email all vendors every January to ask if they are ready.

Answer

Hire a full-time employee to manage vendor emails.

Answer

Require vendors to login to the GRC platform daily.

Question 7

You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?

Accepted Answer

An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold.. An automated 'Workflow Trigger' based on a 'Risk Scoring' threshold is correct because it directly enforces the risk appetite statement by initiating a Risk Treatment Plan whenever a score exceeds the defined tolerance. This creates a deterministic, auditable linkage between risk scoring and treatment workflow. It also ensures consistency across all risk records rather than relying on individual action.

Answer

A manual email notification from the risk owner to the CISO.

Answer

A change in the risk rating calculation formula.

Answer

A daily report showing all risks over the appetite.

Question 8

To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?

Accepted Answer

Automated data validation rules for input fields.. Option A is correct because automated data validation rules for input fields enforce integrity at the point of entry, rejecting malformed, out-of-range, or inconsistent values before they can corrupt the GRC system of record. Option C is correct because strict access control and user authorization policies (e.g., role-based access control with least privilege) ensure that only approved users can create or modify records, preventing unauthorized or accidental changes. Option E is correct because comprehensive audit logs of all user actions provide an immutable trail that supports accountability, traceability, and detection of tampering or unauthorized modifications. Option B is incorrect because allowing all users to edit any data at any time destroys integrity by removing authorization boundaries and enabling unauthorized changes. Option D is incorrect because disabling backups removes the ability to restore the system of record after corruption, loss, or ransomware, which is essential for maintaining integrity over time.

Answer

Allowing all users to edit any data at any time.

Answer

Disabling the backup of the GRC database.

Question 9

A security assessor is reviewing a system boundary for a high-impact system. The boundary includes a web server, an application server, and a database server, all located in the same data center. The system also uses an external identity provider for authentication. During the review, the assessor notices that the identity provider is not listed in the boundary diagram. What is the most significant risk of this omission?

Accepted Answer

The identity provider's controls will not be assessed, potentially leaving authentication vulnerabilities unaddressed.. Omitting the external identity provider from the boundary means its security controls may not be assessed or formally inherited, creating a critical gap in authentication. The Authorizing Official needs to understand all dependencies to make an informed risk decision. The most significant risk is that authentication vulnerabilities remain unaddressed, potentially compromising the entire system.

Answer

The boundary diagram will be rejected by the Authorizing Official for formatting errors.

Answer

The system will be automatically categorized as low-impact due to the missing component.

Answer

The external identity provider will be required to undergo a separate full authorization, delaying the project.

Question 10

During a security assessment of a cloud-based system, the Security Control Assessor (SCA) determines that a cryptographic module used for data at rest does not meet FIPS 140-2 validation requirements. The system owner argues that the module is provided by the cloud service provider (CSP) and is therefore outside their control. As the ISSO, what should you do first to address this finding?

Accepted Answer

Document the finding in the Plan of Action and Milestones (POA&M) and consult with the CSP to obtain evidence of FIPS 140-2 validation or an alternative compliant module.. The ISSO should document the finding in the POA&M and collaborate with the CSP to obtain evidence of FIPS 140-2 validation or identify a compliant alternative. This approach aligns with the shared responsibility model and ensures the finding is tracked for remediation. The system owner remains accountable for control compliance even when a service is CSP-managed, and the AO will ultimately decide on risk acceptance.

Answer

Accept the risk because the CSP is responsible for the cryptographic module and the system owner has no control over it.

Answer

Immediately remove the system from the authorization boundary because the cryptographic module is non-compliant.

Answer

Escalate the finding directly to the Authorizing Official (AO) without taking any preliminary action.

Question 11

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

Accepted Answer

Adjust the 'Assessment Trigger' logic based on the 'Criticality' score.. The requirement is to trigger Control Self-Assessments automatically based on control criticality. This is achieved by modifying the 'Assessment Trigger' logic to use the 'Criticality' score as a condition. This ensures that high-criticality controls are assessed more frequently or automatically, aligning with risk-based GRC automation. The other options do not address the trigger mechanism or would undermine the self-assessment process.

Answer

Change the global password policy for GRC users.

Answer

Require the GRC admin to manually assign tasks to users.

Answer

Disable the self-assessment feature to force all audits to be external.

Question 12

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A network topology diagram that shows external service endpoints, connection paths, and system boundaries is the most effective artifact for demonstrating that all system interconnections have been inventoried, because it visually and explicitly maps every connection into and out of the system. The SAP references this diagram to support the interconnection inventory required by NIST 800-53 controls like CA-3 and SA-9. Vulnerability scans, risk registers, and patch lists do not enumerate interconnections.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 13

An organization is using a FedRAMP-authorized cloud service provider (CSP) for a new system. The ISSO must determine how to leverage the CSP's authorization to reduce the assessment burden for the new system. Which approach is most appropriate according to FedRAMP guidance?

Accepted Answer

Inherit the CSP's controls that are within the FedRAMP boundary and assess only the controls that are not inherited or are specific to the new system.. The most appropriate approach is to inherit controls from the CSP's FedRAMP authorization and assess only the controls that are not inherited or are specific to the new system. This leverages the CSP's existing authorization to reduce duplication and cost, while ensuring that all controls are assessed. FedRAMP promotes this reuse through the concept of control inheritance and the use of the CSP's authorization package.

Answer

Conduct a full independent assessment of all controls, ignoring the CSP's FedRAMP authorization to ensure completeness.

Answer

Rely entirely on the CSP's FedRAMP authorization and forego any additional assessment of the new system.

Answer

Request the CSP to modify its FedRAMP authorization to include the new system's specific controls before proceeding.

Question 14

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Accepted Answer

Document the removal and the justification in the SSP.. When a control is marked 'Not Applicable' during tailoring, the correct approach is to document the removal and provide a justification in the System Security Plan (SSP). This ensures transparency and auditability, allowing authorizing officials to understand why the control was excluded. The SSP serves as the primary documentation for control implementation and tailoring decisions.

Answer

Mark the control as 'Implemented' and leave the field blank.

Answer

Request a waiver from the CISO.

Answer

Just delete the control from the system security plan (SSP).

Question 15

A GRC manager is establishing a process to manage exceptions to security policies. The goal is to ensure that exceptions are granted only when justified, have a defined expiration, and are reviewed regularly. Which TWO of the following are essential components of this exception management process? (Choose two.)

Accepted Answer

Automatic expiration of exceptions after a predefined period, with notification to the requester for renewal.. A risk-based approval workflow ensures that exceptions are authorized by the right stakeholders, while automatic expiration with renewal notifications enforces periodic review. Together, these components prevent exceptions from becoming permanent and ensure they are justified at the time of renewal. Other options either create bottlenecks, lack controls, or fail to enforce review.

Answer

Storing all exception requests in a shared spreadsheet that is accessible to the entire IT department.

Answer

Allowing exceptions to remain active indefinitely as long as the requester provides a verbal justification.

Answer

A requirement that all exception requests be approved by the Chief Information Security Officer (CISO) regardless of risk level.

Question 16

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary is defined by the set of components that the authorizing official has authority over — i.e., ownership and control. When data is shared with an external partner, the boundary must be drawn where the organization's control ends and the partner's begins, because the AO can only accept risk for systems they own or control. Cost, physical location, and user count do not determine who is accountable for the risk.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 17

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

Accepted Answer

In Active Directory. Storing the BitLocker recovery key in Active Directory (specifically in the computer object's msFVE-RecoveryInformation attribute) is the recommended enterprise practice because AD provides centralized, access-controlled, and auditable storage. This allows authorized administrators to retrieve the key if the drive is locked, while preventing unauthorized access through AD permissions. It also ensures the key survives hardware failures or user turnover.

Answer

On a local USB drive

Answer

Printed on the side of the PC

Answer

In a text file on the desktop

Question 18

A GRC analyst is supporting the ongoing authorization of a system that has been designated as high-impact. The authorizing official has requested evidence that the continuous monitoring program is providing adequate visibility into the system's security posture. Which of the following activities BEST demonstrates that the program is effectively supporting ongoing authorization?

Accepted Answer

Providing the authorizing official with a dashboard that displays real-time status of key security controls and automated alerts for anomalies.. Providing a real-time dashboard with automated alerts best demonstrates continuous visibility into the security posture. This allows the authorizing official to monitor control effectiveness and respond to anomalies promptly, which is essential for ongoing authorization. It exemplifies the automation and near-real-time data expected in a mature continuous monitoring program under NIST SP 800-137, supporting timely risk decisions.

Answer

Documenting the continuous monitoring strategy in the system security plan and obtaining approval from the authorizing official.

Answer

Conducting an annual security control assessment and providing the results to the authorizing official.

Answer

Submitting a quarterly report that summarizes all security incidents and their resolutions.

Question 19

A healthcare organization's GRC team is defining key risk indicators (KRIs) for its patient data protection program. The CISO wants KRIs that are predictive of potential breaches, not just historical metrics. Which of the following should the GRC practitioner recommend as a leading KRI?

Accepted Answer

Percentage of critical systems with unpatched vulnerabilities older than 30 days.. The correct answer is the percentage of critical systems with unpatched vulnerabilities older than 30 days. This is a leading KRI because it measures a condition that increases the likelihood of a breach before it happens. It is actionable and predictive, enabling the organization to prioritize remediation and reduce risk proactively, which is exactly what the CISO requested.

Answer

Total number of security awareness training completions in the last quarter.

Answer

Number of past data breach incidents involving patient records.

Answer

Average time to detect a security incident after it occurs.

Question 20

During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?

Accepted Answer

Document the finding and develop a POA&M to replace the encryption with a FIPS 140-2 validated module.. When a control is not met, the appropriate action is to document the finding and create a POA&M to bring the system into compliance. In this case, replacing the encryption with a FIPS 140-2 validated module is necessary. The system owner cannot simply accept equivalent encryption without formal approval. Disconnecting the system or misclassifying the control are not standard procedures.

Answer

Mark the control as 'Not Applicable' because the encryption is not required for this system.

Answer

Immediately disconnect the system from the network until the encryption is replaced.

Answer

Accept the encryption as an equivalent control and document the rationale in the SSP.