CGRC System Compliance — 20 Questions

Question 1

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the compensating control and assess its effectiveness. Documenting compensating controls allows the assessor to show how the security objective is met despite the missing control.

Answer

Force an upgrade to the application

Answer

Immediately revoke the Authorization to Operate (ATO)

Answer

Mark the control as 'Not Applicable'

Question 2

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

Accepted Answer

Accepting the residual risk associated with the POA&M. The AO is accountable for the risk the system poses to the organization and must approve the mitigation strategy outlined in the POA&M.

Answer

Drafting the mitigation tasks

Answer

Conducting the security controls assessment

Answer

Implementing the technical patches

Question 3

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Accepted Answer

The system must meet specific security requirements to remain authorized. An ATO with conditions means the system can operate, but specific security gaps must be closed within a defined timeframe to maintain authorization.

Answer

The system is unauthorized for production use

Answer

The system is prohibited from processing sensitive data

Answer

The system is permanently compliant

Question 4

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Accepted Answer

After the 'Assess' step and before the 'Authorize' step. The SAR provides the technical basis for the AO to make the risk-based decision after the assessment is complete.

Answer

During the 'Categorize' step

Answer

After the 'Monitor' step

Answer

During the 'Prepare' step

Question 5

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary defines the scope of the system and everything subject to the security controls, including interconnected systems.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 6

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

Accepted Answer

Request a re-assessment using the 'Test' method. Security assessments must follow NIST SP 800-53A guidance, which specifies appropriate assessment methods (examine, interview, test) for each control.

Answer

Accept the findings as-is

Answer

Escalate to the Chief Information Officer (CIO)

Answer

Update the System Security Plan (SSP) to match the interview

Question 7

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Accepted Answer

System boundary and authorization boundary. Identifying the scope and boundaries of the system is the prerequisite for developing a SAP to ensure all components under the authorization boundary are evaluated.

Answer

Security control baselines

Answer

Contingency plan testing

Answer

Risk acceptance threshold

Question 8

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

Accepted Answer

The cloud provider's System Security Plan (SSP) or Authorization Package. A FedRAMP Authorization Package or a third-party audit report (like SOC 2) is the standard evidence for cloud compliance.

Answer

The service level agreement (SLA)

Answer

The organization's internal risk register

Answer

The network topology map

Question 9

What is the purpose of the Security Assessment Report (SAR)?

Accepted Answer

To provide a snapshot of the control implementation effectiveness. The SAR documents the results of the control assessment, including findings and recommendations.

Answer

To request funding for security improvements

Answer

To authorize the system for production

Answer

To list all authorized users

Question 10

Which document provides the formal authority to operate a system?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document (ADD) or ATO letter is the formal record of the AO's decision.

Answer

System Security Plan

Answer

Risk Assessment Report

Answer

Security Control Assessment

Question 11

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

Accepted Answer

The POA&M lists items with no completion dates. POA&Ms must include completion dates. Without them, there is no accountability for remediation.

Answer

The POA&M contains vulnerabilities found by automated scans

Answer

The POA&M is stored in a secure repository

Answer

The POA&M is reviewed by the CISO

Question 12

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

Accepted Answer

The potential impact on the organization's mission. The AO needs to understand the impact of the risk on the organizational mission to make an informed decision.

Answer

The estimated cost of an upgrade

Answer

The manufacturer's release notes

Answer

The CVSS score of the vulnerability

Question 13

When a system is undergoing a major change, what is the impact on the existing ATO?

Accepted Answer

The ATO must be re-evaluated. A major change invalidates the existing ATO because the security posture has fundamentally changed, requiring a re-assessment.

Answer

The ATO is suspended until the next fiscal year

Answer

The ATO remains valid until the expiration date

Answer

The ATO is automatically extended

Question 14

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

Accepted Answer

A technical justification for the N/A status. For a control to be N/A, there must be a valid justification based on the system's architecture or operational environment.

Answer

A waiver request to the CISO

Answer

A copy of the vendor's warranty

Answer

The procurement contract

Question 15

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The SSP describes the controls that *should* be in place, and the SAR reports on whether those controls are actually effective.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP

Question 16

Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?

Accepted Answer

Information System Security Officer (ISSO). The ISSO is responsible for the day-to-day management and monitoring of the security controls.

Answer

Authorizing Official

Answer

Chief Information Security Officer (CISO)

Answer

Security Control Assessor (SCA)

Question 17

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

Accepted Answer

Include security requirements in the contract language. Incorporating security requirements into the contract (like FAR/DFARS clauses) ensures the contractor is legally bound to meet security standards.

Answer

Grant them access to your internal ATO database

Answer

Perform an audit of the contractor's office

Answer

Trust the contractor's internal IT department

Question 18

What is the primary role of the Security Control Assessor (SCA)?

Accepted Answer

To determine the effectiveness of the security controls. The SCA provides an objective, third-party assessment of the security controls to support the authorization decision.

Answer

To implement the security controls

Answer

To remediate vulnerabilities

Answer

To accept the risk on behalf of the agency

Question 19

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Accepted Answer

Monitor. The 'Monitor' step is the final phase of the RMF, focused on ongoing compliance.

Answer

Authorize

Answer

Select

Answer

Categorize

Question 20

Which THREE of the following are valid components of an Authorization Package?

Accepted Answer

Security Assessment Report (SAR). The Authorization Package consists of the SSP, SAR, and POA&M as the core elements for the AO.

Answer

Vendor invoices

Answer

User training records