CGRC System Compliance Practice Test 2 — 15 Questions

Question 1

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

Accepted Answer

A technical justification for the N/A status. A technical justification for the N/A status is required because the system owner must document why a control does not apply to the system, based on the system's characteristics, environment, or scope. This justification supports the authorization decision and provides an audit trail. It is not a waiver of a required control but an explanation of non-applicability.

Answer

A waiver request to the CISO

Answer

A copy of the vendor's warranty

Answer

The procurement contract

Question 2

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The System Security Plan (SSP) documents the system boundary, controls selected and implemented, and how they meet requirements. The Security Assessment Report (SAR) is the output of assessing those controls, evaluating whether the controls described in the SSP are effective. Thus the SAR evaluates the SSP's controls, and both feed the authorization decision.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP

Question 3

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

Accepted Answer

Include security requirements in the contract language. Including security requirements in the contract language is the correct answer because it legally binds the contractor to comply with your organization's security standards. This ensures that the contractor's system meets the necessary controls and allows for enforcement through contractual obligations. It is a proactive measure that integrates security into the procurement process, aligning with NIST SP 800-53 and other frameworks that emphasize contractual security requirements for external providers.

Answer

Grant them access to your internal ATO database

Answer

Perform an audit of the contractor's office

Answer

Trust the contractor's internal IT department

Question 4

What is the primary role of the Security Control Assessor (SCA)?

Accepted Answer

To determine the effectiveness of the security controls. The Security Control Assessor (SCA) is responsible for evaluating the security controls implemented in an information system to determine their effectiveness in meeting the security requirements. This role is defined in NIST SP 800-37, the Risk Management Framework (RMF), where the SCA conducts assessments to produce evidence for the Authorizing Official's risk-based decision. The SCA does not implement controls, remediate vulnerabilities, or accept risk; those are the responsibilities of the system owner, information system security officer, and authorizing official, respectively.

Answer

To implement the security controls

Answer

To remediate vulnerabilities

Answer

To accept the risk on behalf of the agency

Question 5

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Accepted Answer

Monitor. The RMF (Risk Management Framework) Monitor phase (Step 6) is where continuous monitoring of security controls takes place. This phase involves ongoing assessment of control effectiveness, tracking changes to the system, and reporting the security posture to authorizing officials. It ensures that the system remains compliant and that any degradation in controls is detected and addressed.

Answer

Authorize

Answer

Select

Answer

Categorize

Question 6

Which THREE of the following are valid components of an Authorization Package?

Accepted Answer

Security Assessment Report (SAR). The Authorization Package in the RMF (Risk Management Framework) consists of three core documents: the System Security Plan (SSP), the Security Assessment Report (SAR), and the Plan of Action and Milestones (POA&M). Option B (Security Assessment Report) is correct because the SAR documents the results of the security control assessment, including findings, vulnerabilities, and the assessor's recommendations. Option D (System Security Plan) is correct because the SSP describes the system boundary, the security controls implemented or planned, and the environment of operation, serving as the foundational document of the package. Option E (Plan of Action and Milestones) is correct because the POA&M identifies tasks to remediate weaknesses found during assessment, along with resources, milestones, and timelines, and is required for the Authorizing Official's risk decision. Options A (Vendor invoices) and C (User training records) are not components of the Authorization Package; invoices are procurement artifacts, and training records are supporting evidence that may inform the SSP or assessment but are not one of the three required package documents.

Answer

Vendor invoices

Answer

User training records

Question 7

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Accepted Answer

It reduces the level of effort for the security assessment. A FedRAMP-authorized CSP has already undergone an independent, NIST SP 800-53-based security assessment by a Third-Party Assessment Organization (3PAO) and received an Authority to Operate (ATO) from a federal agency. Federal agencies (and organizations leveraging FedRAMP reciprocity) can reuse that assessment package—the SSP, SAR, and POA&M—rather than performing a full independent assessment of the CSP's environment. This reuse dramatically reduces the level of effort, cost, and time required for the customer's own security authorization activities.

Answer

It guarantees the system will never be breached

Answer

It eliminates the need for any internal security oversight

Answer

It allows the organization to bypass the RMF

Question 8

Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?

Accepted Answer

The impact on the security control baseline. When an ISSO evaluates whether a system change triggers re-authorization, the two key factors are the impact on the security control baseline (B) and the scope of the changes made to the system (C). Option B is correct because if a change alters, weakens, or removes controls from the approved baseline, the system's risk posture shifts and the Authorizing Official must reassess whether the existing authorization remains valid. Option C is correct because the extent of the change—whether it is a minor patch or a major architectural modification—determines whether it falls under the existing authorization boundary or requires a new assessment and authorization decision. The remaining options are irrelevant: server casing color (A) and hardware age (E) are cosmetic or lifecycle concerns that do not affect security authorization, and the number of administrative staff (D) is a staffing matter, not a determinant of re-authorization.

Answer

The color of the server casing

Answer

The number of administrative staff

Answer

The age of the hardware

Question 9

Which THREE types of information should be included in a risk acceptance memo?

Accepted Answer

Description of the identified risk. A risk acceptance memo must document what is being accepted, so option C (Description of the identified risk) is correct because it clearly states the specific vulnerability, threat, or weakness being formally accepted. Option D (The impact on the organizational mission) is correct because decision-makers need to understand the potential business consequences, such as mission degradation, financial loss, or operational disruption, to make an informed acceptance decision. Option E (Justification for accepting the risk) is correct because it records the rationale—such as cost-benefit analysis, compensating controls, or low likelihood—that explains why the risk is being accepted rather than mitigated, transferred, or avoided. Options A and B are incorrect because vendor names and server technical specifications are asset or inventory details, not the risk-governance content required in a risk acceptance memo.

Answer

The name of the software vendor

Answer

The technical specifications of the server

Question 10

Which THREE categories of controls are identified in NIST SP 800-53?

Accepted Answer

Operational. NIST SP 800-53 organizes its security and privacy controls into three distinct control categories, and the correct answers reflect exactly those categories. Option B (Operational) is correct because operational controls are the people- and process-driven safeguards, such as awareness and training, configuration management, contingency planning, and incident response, that support day-to-day security operations. Option C (Management) is correct because management controls focus on governance, risk assessment, planning, and oversight activities performed by organizational leadership, such as security planning and risk assessment controls. Option E (Technical) is correct because technical controls are the technology-based safeguards implemented in systems, such as access control mechanisms, identification and authentication, audit logging, and encryption. The unmarked options do not belong: Option A (Financial) is not a NIST SP 800-53 control category, and Option D (Environmental) is not one of the three categories either, though environmental controls such as physical protection appear within other frameworks and as specific control families rather than as a top-level category in SP 800-53.

Answer

Financial

Answer

Environmental

Question 11

Which TWO of the following are responsibilities of the Authorizing Official?

Accepted Answer

Signing the authorization decision. The Authorizing Official (AO) is the senior official who formally accepts the risk of operating a system, so option B, signing the authorization decision, is correct because the AO issues the authorization to operate (ATO) or denial based on the security assessment. Option C, accepting the residual risk, is also correct because after reviewing the Security Assessment Report and Plan of Action and Milestones, the AO formally accepts any remaining risk that cannot be mitigated. The other options do not belong: conducting the scan (A) is a technical task performed by assessors or security personnel, writing the user manual (D) is a documentation task typically done by system owners or technical writers, and updating firewall rules (E) is an operational security administration duty, not an AO responsibility.

Answer

Conducting the scan

Answer

Writing the user manual

Answer

Updating the firewall rules

Question 12

Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?

Accepted Answer

Document the finding in the SAR. Option C is correct because the Security Assessment Report (SAR) is the formal artifact that records assessment results, including any control determined to be ineffective, so documenting the finding there preserves the official record of the deficiency. Option D is correct because an ineffective critical control requires a Plan of Action and Milestones (POA&M) entry to track the weakness, assign responsibility, set milestones, and monitor remediation to closure. Option A is wrong because removing a control from the System Security Plan (SSP) would misrepresent the system's actual security posture rather than address the deficiency. Option B is wrong because changing the system password is an unrelated tactical action that does not remediate or track an ineffective security control. Option E is wrong because immediately disconnecting the system is a drastic operational action not automatically warranted by an assessment finding; the ISSO should document and track remediation through the SAR and POA&M processes.

Answer

Delete the control from the SSP

Answer

Change the system password

Answer

Immediately disconnect the system

Question 13

Which THREE elements are necessary for a compliant continuous monitoring program?

Accepted Answer

Configuration management of the system. A compliant continuous monitoring program requires configuration management of the system (A), because tracking and controlling changes to hardware, software, and firmware baselines is essential to maintaining an accurate security posture and knowing what is being monitored. Regular assessment of security controls (B) is also necessary, since continuous monitoring depends on ongoing evaluation of control effectiveness rather than a one-time authorization review. Status reporting to the AO (D) is required so the Authorizing Official can make risk-based decisions about continued operation based on current security state. Full system replacement every year (C) is not a continuous monitoring requirement and would be impractical and unrelated to monitoring. Daily physical site visits (E) are not mandated; physical security monitoring is typically handled through other controls and frequencies, not daily visits.

Answer

Full system replacement every year

Answer

Daily physical site visits

Question 14

During a system compliance review, the Security Control Assessor (SCA) issues a finding that a critical security control is only partially implemented. The system owner disagrees and wants to proceed with authorization. As the Information System Security Officer (ISSO), what should you do FIRST?

Accepted Answer

Request that the SCA reconsider the finding by providing additional evidence that demonstrates the control is fully implemented.. The ISSO should first attempt to resolve the disagreement by providing additional evidence to the SCA. If the SCA maintains the finding, it becomes a risk that the AO must accept or mitigate. Proceeding directly to a POA&M or AO escalation skips the necessary step of validating the assessment finding.

Answer

Advise the system owner to submit a Plan of Action and Milestones (POA&M) for the partial control and proceed with authorization.

Answer

Escalate the issue to the Authorizing Official (AO) immediately and recommend denying the Authorization to Operate (ATO).

Answer

Document the disagreement in the System Security Plan (SSP) and allow the Authorizing Official (AO) to make the final risk-based decision.

Question 15

You are preparing a continuous monitoring strategy for a federal information system in accordance with NIST SP 800-137. Which TWO activities are essential components of the continuous monitoring program? (Choose two.)

Accepted Answer

Performing ongoing assessments of security control effectiveness.. Continuous monitoring, as defined in NIST SP 800-137, requires ongoing assessment of control effectiveness and the collection and analysis of security-related information. These activities enable real-time risk management. Training, SSP documentation, and full pre-change assessments are important but not core continuous monitoring activities.

Answer

Documenting the results of security assessments in the System Security Plan (SSP).

Answer

Conducting annual security awareness training for all users.

Answer

Conducting a full security assessment before every major system change.