CGRC Multiple Select — 20 Questions

Question 1

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)

Accepted Answer

Administrative personnel managing the system.. An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Answer

The local library book catalog.

Answer

The public social media feed of the organization.

Question 2

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Accepted Answer

The cloud service provider (CSP).. Security in the cloud is a shared endeavor where the provider covers the infrastructure and the customer covers the configuration and data.

Answer

The hardware manufacturer.

Answer

The local internet service provider.

Answer

The end-user of the application.

Question 3

Which TWO of the following represent best practices for password management?

Accepted Answer

Using a password manager for unique, complex passwords. Complex, unique passwords and the use of a password manager are foundational security practices.

Answer

Forcing users to change passwords every 30 days

Answer

Allowing password sharing among team members

Answer

Logging passwords in a shared spreadsheet

Question 4

Which TWO types of controls are specifically examined during an audit?

Accepted Answer

Administrative controls. Audits assess both technical controls (logical) and administrative controls (policies/procedures).

Answer

Physical building aesthetics

Answer

HR hiring policies

Answer

Marketing controls

Question 5

Which THREE of the following are elements of a secure incident response control set?

Accepted Answer

Establishing a dedicated Incident Response Team (IRT). Preparation, identification, and containment are foundational phases of the incident response lifecycle.

Answer

Sharing sensitive server logs on a public forum

Answer

Disabling all security controls during an investigation

Question 6

Which TWO of the following are primary components of an effective security control assessment report?

Accepted Answer

Detailed Findings and Supporting Evidence. An assessment report must detail the findings/weaknesses and the evidence that supports those findings.

Answer

Employee performance reviews

Answer

List of all vendor contracts

Answer

Company financial statements

Question 7

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Evidence must be protected from unauthorized changes, be verifiable, and be stored securely to maintain its chain of custody.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper

Question 8

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Accepted Answer

Ensuring the assignment value is consistent with organizational policy.. Effective management of assignments ensures that controls are tailored and that the organization has a clear record of its security obligations.

Answer

Updating all assignment values daily.

Answer

Consulting with the NIST publication author.

Question 9

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. Execution involves interviewing staff, reviewing documentation, and testing technical configuration settings.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 10

Which TWO of the following are critical requirements for implementing an effective patch management program?

Accepted Answer

Automated patch testing in a staging environment. Patch management requires testing to prevent outages and a deployment strategy to ensure coverage.

Answer

Storing all patch files on a public FTP site

Answer

Manual approval for every single update

Answer

Disabling all automatic updates

Question 11

Which TWO of the following are recommended practices for managing firewall rules?

Accepted Answer

Documenting the business justification for each rule. Regular review and documentation of rules help maintain a secure and clean firewall configuration.

Answer

Disabling logging for all rules to improve performance

Answer

Applying rules in random order

Answer

Using 'Any' as the destination for all rules

Question 12

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Accepted Answer

Create a certificate of destruction for audit purposes.. Sanitizing the media, updating the inventory, and documenting the destruction process are all critical steps for classified systems.

Answer

Move the system to a secure storage area for indefinite holding.

Answer

Reformat the drive for reuse in a non-sensitive project.

Question 13

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Accepted Answer

Target completion date. A POA&M must define the vulnerability/weakness and the specific milestone/date for remediation.

Answer

Personnel salary data

Answer

Historical audit logs

Answer

Software licensing keys

Question 14

Which TWO methods are commonly used to gather assessment evidence?

Accepted Answer

Interview. Assessment methods commonly include observing processes and interviewing personnel to understand implementation.

Answer

Budget approval

Answer

Marketing collateral review

Answer

System retirement

Question 15

Which TWO factors contribute to the 'scope' of an information security audit?

Accepted Answer

Network boundaries. The audit scope is driven by the physical and logical boundaries of the system being reviewed.

Answer

External stock prices

Answer

Competitor market analysis

Answer

Employee home addresses

Question 16

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Accepted Answer

High risk of system instability during patch deployment.. Legacy systems often lack support for modern automation tools and are difficult to patch without downtime.

Answer

The system is too new for security researchers to find bugs.

Answer

The system automatically updates its own firmware daily.

Answer

Too much disk space available for logging.

Question 17

Which THREE of the following are components of a secure server hardening process?

Accepted Answer

Applying security patches. Disabling unnecessary services, updating software, and using minimal feature sets are key to reducing the attack surface.

Answer

Installing all available third-party software

Answer

Running the web server as the root user

Question 18

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Accepted Answer

Network architecture diagrams.. The AO needs visual, written, and logical proof of what they are authorizing.

Answer

The janitorial service contract for the building.

Answer

The organization's holiday schedule.

Question 19

Which TWO of the following are examples of physical security controls?

Accepted Answer

Security cameras. Physical controls protect the physical facility and hardware.

Answer

Host-based firewall

Answer

Strong password policy

Answer

Encryption of database tables

Question 20

Which THREE categories of controls are identified in NIST SP 800-53?

Accepted Answer

Operational. NIST categorizes controls into Technical, Management, and Operational families.

Answer

Financial

Answer

Environmental