CGRC System Compliance Practice Test 1 — 15 Questions

Question 1

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the compensating control and assess its effectiveness. Documenting compensating controls allows the assessor to show how the security objective is met despite the missing control.

Answer

Force an upgrade to the application

Answer

Immediately revoke the Authorization to Operate (ATO)

Answer

Mark the control as 'Not Applicable'

Question 2

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

Accepted Answer

Accepting the residual risk associated with the POA&M. The AO is accountable for the risk the system poses to the organization and must approve the mitigation strategy outlined in the POA&M.

Answer

Drafting the mitigation tasks

Answer

Conducting the security controls assessment

Answer

Implementing the technical patches

Question 3

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Accepted Answer

The system must meet specific security requirements to remain authorized. An ATO with conditions means the system can operate, but specific security gaps must be closed within a defined timeframe to maintain authorization.

Answer

The system is unauthorized for production use

Answer

The system is prohibited from processing sensitive data

Answer

The system is permanently compliant

Question 4

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Accepted Answer

After the 'Assess' step and before the 'Authorize' step. The SAR provides the technical basis for the AO to make the risk-based decision after the assessment is complete.

Answer

During the 'Categorize' step

Answer

After the 'Monitor' step

Answer

During the 'Prepare' step

Question 5

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary defines the scope of the system and everything subject to the security controls, including interconnected systems.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 6

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

Accepted Answer

Request a re-assessment using the 'Test' method. Security assessments must follow NIST SP 800-53A guidance, which specifies appropriate assessment methods (examine, interview, test) for each control.

Answer

Accept the findings as-is

Answer

Escalate to the Chief Information Officer (CIO)

Answer

Update the System Security Plan (SSP) to match the interview

Question 7

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Accepted Answer

System boundary and authorization boundary. Identifying the scope and boundaries of the system is the prerequisite for developing a SAP to ensure all components under the authorization boundary are evaluated.

Answer

Security control baselines

Answer

Contingency plan testing

Answer

Risk acceptance threshold

Question 8

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

Accepted Answer

The cloud provider's System Security Plan (SSP) or Authorization Package. A FedRAMP Authorization Package or a third-party audit report (like SOC 2) is the standard evidence for cloud compliance.

Answer

The service level agreement (SLA)

Answer

The organization's internal risk register

Answer

The network topology map

Question 9

What is the purpose of the Security Assessment Report (SAR)?

Accepted Answer

To provide a snapshot of the control implementation effectiveness. The SAR documents the results of the control assessment, including findings and recommendations.

Answer

To request funding for security improvements

Answer

To authorize the system for production

Answer

To list all authorized users

Question 10

Which document provides the formal authority to operate a system?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document (ADD) or ATO letter is the formal record of the AO's decision.

Answer

System Security Plan

Answer

Risk Assessment Report

Answer

Security Control Assessment

Question 11

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

Accepted Answer

The POA&M lists items with no completion dates. POA&Ms must include completion dates. Without them, there is no accountability for remediation.

Answer

The POA&M contains vulnerabilities found by automated scans

Answer

The POA&M is stored in a secure repository

Answer

The POA&M is reviewed by the CISO

Question 12

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

Accepted Answer

The potential impact on the organization's mission. The AO needs to understand the impact of the risk on the organizational mission to make an informed decision.

Answer

The estimated cost of an upgrade

Answer

The manufacturer's release notes

Answer

The CVSS score of the vulnerability

Question 13

When a system is undergoing a major change, what is the impact on the existing ATO?

Accepted Answer

The ATO must be re-evaluated. A major change invalidates the existing ATO because the security posture has fundamentally changed, requiring a re-assessment.

Answer

The ATO is suspended until the next fiscal year

Answer

The ATO remains valid until the expiration date

Answer

The ATO is automatically extended

Question 14

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

Accepted Answer

A technical justification for the N/A status. For a control to be N/A, there must be a valid justification based on the system's architecture or operational environment.

Answer

A waiver request to the CISO

Answer

A copy of the vendor's warranty

Answer

The procurement contract

Question 15

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The SSP describes the controls that *should* be in place, and the SAR reports on whether those controls are actually effective.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP