CGRC Multiple Select — 20 Questions

Question 1

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises servers are included in the boundary because they are under the agency's direct control and process CUI.. The boundary should include components under the agency's direct control that process CUI, such as on-premises servers. For cloud services with FedRAMP authorizations, the agency can exclude those components if it documents inherited controls and accepts residual risk. This approach aligns with NIST guidance on leveraging external authorizations and focusing on the agency's own responsibilities.

Answer

The boundary must include all cloud components regardless of the provider's authorization status to ensure end-to-end security.

Answer

The boundary should be defined based on the physical location of the servers to ensure data sovereignty requirements are met.

Answer

The PaaS provider's underlying infrastructure is included in the boundary because the agency's applications run on it.

Question 2

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Accepted Answer

The cloud service provider (CSP).. Under the shared responsibility model, the cloud service provider (CSP) (D) is responsible for compliance of the cloud itself — the physical datacenters, hardware, hypervisor, and foundational services — while the cloud customer (E) is responsible for compliance in the cloud, including their data, configurations, access controls, and applications they deploy. These two parties split security and compliance duties based on the service model (IaaS, PaaS, SaaS), which is why both are the entities typically accountable. The hardware manufacturer (A) only supplies components and does not bear operational compliance responsibility once equipment is deployed in a CSP's datacenter. The local internet service provider (B) merely transports connectivity and has no role in cloud compliance obligations. The end-user of the application (C) consumes services but is not a distinct compliance-responsible entity separate from the cloud customer organization.

Answer

The hardware manufacturer.

Answer

The local internet service provider.

Answer

The end-user of the application.

Question 3

To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?

Accepted Answer

Automated data validation rules for input fields.. Option A is correct because automated data validation rules for input fields enforce integrity at the point of entry, rejecting malformed, out-of-range, or inconsistent values before they can corrupt the GRC system of record. Option C is correct because strict access control and user authorization policies (e.g., role-based access control with least privilege) ensure that only approved users can create or modify records, preventing unauthorized or accidental changes. Option E is correct because comprehensive audit logs of all user actions provide an immutable trail that supports accountability, traceability, and detection of tampering or unauthorized modifications. Option B is incorrect because allowing all users to edit any data at any time destroys integrity by removing authorization boundaries and enabling unauthorized changes. Option D is incorrect because disabling backups removes the ability to restore the system of record after corruption, loss, or ransomware, which is essential for maintaining integrity over time.

Answer

Allowing all users to edit any data at any time.

Answer

Disabling the backup of the GRC database.

Question 4

An organization is implementing a continuous monitoring program for its information systems in accordance with NIST SP 800-137. Which TWO activities are essential components of this program? (Choose two.)

Accepted Answer

Performing ongoing security control assessments. Continuous monitoring per NIST SP 800-137 requires ongoing security control assessments to verify effectiveness and regular reporting of security status to organizational officials. These activities ensure that the system's security posture is continuously understood and that risk is managed proactively. Other activities like training and categorization are important but are not core continuous monitoring activities.

Answer

Conducting annual security awareness training for all users

Answer

Conducting a full Security Assessment Report (SAR) only at the end of the authorization cycle

Answer

Documenting the system's security categorization

Question 5

Which TWO factors contribute to the 'scope' of an information security audit?

Accepted Answer

Network boundaries. The scope of an information security audit is defined by what will be examined, and option C (Network boundaries) is correct because the audit perimeter—such as internal LAN segments, DMZs, VPN entry points, and internet-facing subnets—determines which systems, traffic flows, and controls fall inside or outside the assessment. Option E (System components and assets) is also correct because the inventory of hardware, software, applications, databases, and data assets directly establishes the breadth of the audit and the controls to be tested. Options A (External stock prices) and B (Competitor market analysis) are financial and competitive-intelligence concerns unrelated to defining an audit's technical scope, and option D (Employee home addresses) is personal data that does not determine which systems or boundaries the audit covers.

Answer

External stock prices

Answer

Competitor market analysis

Answer

Employee home addresses

Question 6

A GRC manager is establishing a process to manage exceptions to security policies. The goal is to ensure that exceptions are granted only when justified, have a defined expiration, and are reviewed regularly. Which TWO of the following are essential components of this exception management process? (Choose two.)

Accepted Answer

Automatic expiration of exceptions after a predefined period, with notification to the requester for renewal.. A risk-based approval workflow ensures that exceptions are authorized by the right stakeholders, while automatic expiration with renewal notifications enforces periodic review. Together, these components prevent exceptions from becoming permanent and ensure they are justified at the time of renewal. Other options either create bottlenecks, lack controls, or fail to enforce review.

Answer

Storing all exception requests in a shared spreadsheet that is accessible to the entire IT department.

Answer

Allowing exceptions to remain active indefinitely as long as the requester provides a verbal justification.

Answer

A requirement that all exception requests be approved by the Chief Information Security Officer (CISO) regardless of risk level.

Question 7

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Option B is correct because automated patch testing in a staging environment lets you validate updates against representative systems before production rollout, catching compatibility, regression, and deployment issues while keeping the process repeatable and scalable. Option E is correct because defined emergency patch procedures are essential for out-of-band critical vulnerabilities (for example, zero-days or actively exploited CVEs), specifying expedited risk assessment, approval, deployment, and rollback steps so urgent fixes are applied without bypassing governance. Option A is wrong because hosting patch files on a public FTP site exposes unauthenticated, unencrypted distribution and risks tampered or spoofed binaries; patches should come from vendor-signed, integrity-verified sources over HTTPS. Option C is wrong because requiring manual approval for every single update does not scale, creates bottlenecks, and delays critical fixes; approval should be risk-based and largely automated for routine patches. Option D is wrong because disabling all automatic updates removes timely delivery of security fixes and increases exposure windows, contradicting the goal of an effective patch management program.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 8

You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)

Accepted Answer

Monitoring security alerts and advisories from vendors and US-CERT. According to NIST SP 800-137, continuous monitoring includes ongoing security control assessments and monitoring of security alerts and advisories. These activities provide situational awareness and ensure controls remain effective. Penetration testing and full reauthorization are not mandatory components, and incident documentation is handled separately from the SSP. The two selected activities are fundamental to maintaining an ongoing authorization.

Answer

Conducting a full reauthorization every six months

Answer

Documenting all security incidents in the System Security Plan (SSP)

Answer

Performing annual penetration testing on all systems

Question 9

An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)

Accepted Answer

Document the assessment procedures, evidence collected, and findings in a Security Assessment Report (SAR) that can be reviewed and audited.. A reliable and repeatable assessment requires a detailed assessment plan that maps controls to methods and a Security Assessment Report that documents procedures, evidence, and findings. These artifacts ensure consistency, support independent review, and provide a defensible basis for authorization decisions. Relying on a single method or waiting arbitrarily would undermine the assessment's credibility and completeness.

Answer

Use automated tools exclusively for all controls to eliminate human error and ensure consistency.

Answer

Rely solely on interviews with system administrators to verify technical controls because they are the most knowledgeable.

Answer

Conduct the assessment only after the system has been in operation for at least one year to gather sufficient operational data.

Question 10

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Accepted Answer

Explicit assignment of policy ownership and accountability.. Option B is correct because effective governance requires that each policy have a clearly identified owner who is accountable for its maintenance, enforcement, and review, ensuring there is no ambiguity about who is responsible. Option D is correct because a GRC policy must contain clear, unambiguous policy statements tied to organizational objectives, so that the controls and requirements directly support the business goals and can be measured and audited. Options A, C, and E are incorrect because a CISO's home address, employees' social media handles, and a website color scheme are irrelevant operational or personal details that do not contribute to policy ownership, accountability, or alignment with organizational objectives.

Answer

The home address of the CISO.

Answer

A list of all employees' social media handles.

Answer

The exact color scheme of the company website.

Question 11

Which TWO of the following are considered 'technical' security controls?

Accepted Answer

Encryption of data in transit. Encryption of data in transit (C) is a technical security control because it is implemented through cryptographic mechanisms and protocols such as TLS to protect data as it moves across networks, directly enforcing protection at the system level. Access Control Lists (ACLs) (D) are also technical controls since they are configured on devices like routers, firewalls, and operating systems to permit or deny traffic and resource access based on defined rules. In contrast, an annual risk assessment (A) is a management/administrative control involving analysis and decision-making rather than a technical mechanism, and security policies (B) are administrative controls that define rules and expectations in documentation. Fencing around the data center (E) is a physical control that deters or blocks physical intrusion, not a technical one.

Answer

Annual risk assessment

Answer

Security policies

Answer

Fencing around the data center

Question 12

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Accepted Answer

Availability.. FIPS 199 defines three security objectives for information types and information systems: confidentiality, integrity, and availability, so the two correct answers here are A (Availability) and E (Confidentiality). Availability (A) is correct because FIPS 199 requires assessing the potential impact of a loss of timely and reliable access to the system and its data, with the resulting categorization of low, moderate, or high. Confidentiality (E) is correct because FIPS 199 requires evaluating the impact of unauthorized disclosure of information, again producing a low, moderate, or high rating. The unmarked options do not belong because authentication, accountability, and non-repudiation are not among the three FIPS 199 impact objectives; they are related security services or controls addressed in other standards such as FIPS 200 and NIST SP 800-53, not the FIPS 199 impact triad.

Answer

Authentication.

Answer

Accountability.

Answer

Non-repudiation.

Question 13

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Option B (Chain of custody documentation) is correct because integrity of audit evidence requires an unbroken, auditable record of who collected, handled, transferred, and stored the evidence, ensuring it has not been tampered with or substituted. Option C (Use of cryptographic hashes for log files) is correct because hashing algorithms such as SHA-256 produce a fixed digest that verifies the log data has not been altered, providing a mathematically verifiable integrity check. Option E (Restricting access to the audit evidence folder) is correct because enforcing least-privilege access controls (e.g., NTFS or POSIX permissions, role-based access) prevents unauthorized modification or deletion, preserving the evidence's integrity. Option A (Publishing evidence to the company website) is not appropriate because public disclosure exposes evidence to alteration and does not preserve integrity. Option D (Printing all evidence on paper) is not essential because paper copies can be forged or altered and do not provide cryptographic verification of the original digital data.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper

Question 14

Which THREE of the following are elements of a secure incident response control set?

Accepted Answer

Establishing a dedicated Incident Response Team (IRT). Option A is correct because a dedicated Incident Response Team (IRT) is a core element of a secure incident response control set, providing defined roles, authority, and accountability for detecting, containing, eradicating, and recovering from security incidents. Option C is correct because a SIEM (Security Information and Event Management) system centralizes log collection, correlation, and alerting, which is essential for timely detection and analysis of incidents. Option D is correct because an updated Incident Response Plan (IRP) documents procedures, communication paths, escalation criteria, and recovery steps, ensuring a consistent and effective response. Option B is incorrect because sharing sensitive server logs on a public forum violates confidentiality and could expose credentials, PII, or exploitable system details. Option E is incorrect because disabling all security controls during an investigation removes visibility and protections, increasing risk and potentially destroying evidence.

Answer

Sharing sensitive server logs on a public forum

Answer

Disabling all security controls during an investigation

Question 15

Which THREE types of information should be included in a risk acceptance memo?

Accepted Answer

Description of the identified risk. A risk acceptance memo must document what is being accepted, so option C (Description of the identified risk) is correct because it clearly states the specific vulnerability, threat, or weakness being formally accepted. Option D (The impact on the organizational mission) is correct because decision-makers need to understand the potential business consequences, such as mission degradation, financial loss, or operational disruption, to make an informed acceptance decision. Option E (Justification for accepting the risk) is correct because it records the rationale—such as cost-benefit analysis, compensating controls, or low likelihood—that explains why the risk is being accepted rather than mitigated, transferred, or avoided. Options A and B are incorrect because vendor names and server technical specifications are asset or inventory details, not the risk-governance content required in a risk acceptance memo.

Answer

The name of the software vendor

Answer

The technical specifications of the server

Question 16

Which TWO of the following are examples of physical security controls?

Accepted Answer

Security cameras. Security cameras (B) are a physical security control because they are hardware devices deployed to monitor and record activity in a physical facility, deterring and detecting intrusions. Key card access systems (D) are also physical controls, as they use tangible badge readers and door hardware to restrict physical entry to authorized personnel. The remaining options are logical/technical controls: a host-based firewall (A) filters network traffic in software, a strong password policy (C) is an administrative control governing authentication, and encryption of database tables (E) is a technical control protecting data at rest.

Answer

Host-based firewall

Answer

Strong password policy

Answer

Encryption of database tables

Question 17

A GRC practitioner is establishing a process for maintaining the compliance program's documented information. The goal is to ensure that policies, standards, and procedures remain current, authorized, and available to the right audiences. Which TWO of the following activities are essential to this process? (Choose two.)

Accepted Answer

Defining a review cycle and assigning document owners who revalidate content. Maintaining documented information requires clear ownership with periodic review and a controlled process for versioning and approval. These two activities ensure documents stay current, authorized, and traceable. Public disclosure, personal storage, and distributed rewriting all undermine control, availability, or consistency, and therefore do not support the stated goal of a reliable documentation process.

Answer

Requiring every employee to rewrite each policy annually in their own words

Answer

Publishing all documents to the public corporate website for transparency

Answer

Storing documents only in the personal drives of the GRC team members who wrote them

Question 18

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

Accepted Answer

Updating the asset inventory database. Option A (Updating the asset inventory database) is correct because decommissioning must be reflected in the configuration management database (CMDB) or asset register so the server is no longer tracked as an active, supported asset and any dependencies, licenses, or monitoring are removed. Option B (Cryptographic erase of the storage media) is correct because crypto-erasure destroys or invalidates the encryption key protecting the data at rest (e.g., SED/self-encrypting drive or BitLocker/LUKS key), rendering the sensitive data unrecoverable in a fast, verifiable manner. Option D (Disconnecting from the network and removing physical identity) is correct because the host must be isolated from the production network to prevent unauthorized access or data exfiltration, and asset tags, hostnames, and rack labels should be removed to prevent misidentification or reuse of a still-sensitive system. Option C is not sufficient because a single reformat only removes the file system references and leaves recoverable data remnants on the platters or cells; secure media sanitization (NIST SP 800-88 purge/destroy) is required. Option E is wrong because leaving the server powered on in the rack keeps the data accessible and the system live, which is the opposite of decommissioning.

Answer

Reformatting the drive once

Answer

Leaving the server powered on in the rack

Question 19

Which THREE roles are typically involved in a security assessment?

Accepted Answer

Assessor / Auditor. The Assessor/Auditor (C) is correct because this role performs the actual evaluation of controls, gathers evidence, and reports findings against a defined framework or scope. The Chief Information Security Officer (D) is correct because the CISO owns the security program, approves the assessment scope and criteria, and receives and acts on the results at an executive level. The System Owner (E) is correct because this role is accountable for the system being assessed, provides access and documentation, and is responsible for remediating identified weaknesses. Customer support agents (A) and an external public relations firm (B) are not typically core roles in a security assessment; they may be interviewed or consulted in specific cases, but they do not own, conduct, or authorize the assessment.

Answer

Customer support agents

Answer

External public relations firm

Question 20

A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine which controls can be inherited from the cloud provider. Which TWO of the following are appropriate actions to take during this process? (Choose two.)

Accepted Answer

Review the cloud provider's SOC 2 report to identify controls that are implemented and can be inherited.. The correct actions are to review the cloud provider's SOC 2 report to identify inheritable controls and to document inherited controls in the system security plan. These steps ensure that the organization accurately identifies and records which controls are provided by the cloud provider, avoiding duplication and ensuring accountability.

Answer

Conduct a penetration test of the cloud provider's infrastructure to verify inherited controls.

Answer

Assume all controls are inherited because the cloud provider is responsible for security.

Answer

Implement all controls from the baseline regardless of the provider's offerings.