CGRC System Compliance Practice Test 3 — 15 Questions

Question 1

A system owner is preparing to authorize a system for operation. The Security Assessment Report (SAR) contains a finding that a high-impact security control is not implemented. The Authorizing Official (AO) decides to accept the risk and grant an Authorization to Operate (ATO). What document must the AO sign to formally accept the risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization Decision Document. The Authorization Decision Document is the formal artifact where the AO accepts risk and grants the ATO. It includes any conditions and the authorization termination date. The POA&M, SSP, and SAR are inputs to the decision but do not themselves constitute risk acceptance.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Question 2

You are the Information System Security Officer (ISSO) for a federal system undergoing a periodic security control assessment. During the assessment, the assessor identifies that a high-impact security control is only partially implemented. According to NIST SP 800-37 Rev. 2, what should be your immediate next step?

Accepted Answer

Document the partial implementation as a finding in the Security Assessment Report (SAR) and develop a Plan of Action and Milestones (POA&M) to remediate the control.. According to NIST SP 800-37 Rev. 2, during the Monitor step, assessment findings must be documented in the SAR and addressed through a POA&M. A partially implemented control is a finding that requires remediation planning. The ISSO's role is to ensure proper documentation and follow-up, not to unilaterally suspend operations or misclassify the control. This approach maintains the integrity of the authorization process.

Answer

Update the System Security Plan (SSP) to mark the control as 'Not Applicable' (NA) to avoid a finding.

Answer

Request an exception from the Authorizing Official (AO) to accept the partial implementation without further action.

Answer

Immediately suspend system operations until the control is fully implemented.

Question 3

A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?

Accepted Answer

FedRAMP Customer Responsibility Matrix (CRM). The FedRAMP Customer Responsibility Matrix (CRM) is the key document that defines which security controls are inherited from the CSP and which the agency must implement and assess. By using the CRM, the agency can avoid duplicating assessments and focus on its own responsibilities. This leverages the FedRAMP authorization to streamline the ATO process while ensuring all controls are covered.

Answer

FedRAMP Authority to Operate (ATO) letter

Answer

FedRAMP Security Assessment Report (SAR)

Answer

FedRAMP Continuous Monitoring (ConMon) plan

Question 4

You are the Information System Security Officer (ISSO) for a federal financial system undergoing an annual assessment. The Security Control Assessor (SCA) has completed the assessment and documented several controls as 'Other than Satisfied' in the Security Assessment Report (SAR). According to NIST SP 800-37 Revision 2, what is the primary next step the Authorizing Official (AO) must take before making an authorization decision?

Accepted Answer

Review the Plan of Action and Milestones (POA&M) to ensure all findings are addressed with remediation timelines.. Before making an authorization decision, the Authorizing Official must review the Plan of Action and Milestones (POA&M) to understand how identified weaknesses will be addressed and to assess residual risk. The POA&M is a key component of the authorization package, along with the SAR and SSP. This review enables the AO to make an informed, risk-based decision, which may include granting an authorization with conditions.

Answer

Forward the SAR to the system owner and require them to implement all recommended fixes before the AO reviews the package.

Answer

Immediately deny the Authorization to Operate (ATO) because any 'Other than Satisfied' control is unacceptable.

Answer

Instruct the SCA to re-assess all controls marked 'Other than Satisfied' to verify the findings.

Question 5

You are the Information System Security Officer (ISSO) for a federal system undergoing an annual assessment. The assessor reports that a boundary protection control is only partially implemented: the firewall ruleset is outdated, and several unnecessary ports are open. The system owner asks how this should be reflected in the System Security Plan (SSP). What is the most appropriate action?

Accepted Answer

Record the control as 'Partially Implemented' with a description of the gap, a remediation plan, and a target completion date.. A partially implemented control must be documented as such in the SSP, with a clear description of the gap, remediation steps, and a target date. This preserves an accurate picture of the system's security posture, informs the Authorizing Official's risk decision, and enables effective continuous monitoring. Claiming the control is implemented or not applicable would misrepresent the actual state and could invalidate the authorization.

Answer

Mark the control as 'Implemented' and note the outdated ruleset in the continuous monitoring plan only.

Answer

Document the control as 'Not Applicable' because the firewall is managed by the network team, not the system owner.

Answer

Remove the control from the SSP and rely on the organization's enterprise firewall policy instead.

Question 6

You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)

Accepted Answer

Monitoring security alerts and advisories from vendors and US-CERT. According to NIST SP 800-137, continuous monitoring includes ongoing security control assessments and monitoring of security alerts and advisories. These activities provide situational awareness and ensure controls remain effective. Penetration testing and full reauthorization are not mandatory components, and incident documentation is handled separately from the SSP. The two selected activities are fundamental to maintaining an ongoing authorization.

Answer

Conducting a full reauthorization every six months

Answer

Documenting all security incidents in the System Security Plan (SSP)

Answer

Performing annual penetration testing on all systems

Question 7

During a security assessment of a cloud-based system, the Security Control Assessor (SCA) determines that a cryptographic module used for data at rest does not meet FIPS 140-2 validation requirements. The system owner argues that the module is provided by the cloud service provider (CSP) and is therefore outside their control. As the ISSO, what should you do first to address this finding?

Accepted Answer

Document the finding in the Plan of Action and Milestones (POA&M) and consult with the CSP to obtain evidence of FIPS 140-2 validation or an alternative compliant module.. The ISSO should document the finding in the POA&M and collaborate with the CSP to obtain evidence of FIPS 140-2 validation or identify a compliant alternative. This approach aligns with the shared responsibility model and ensures the finding is tracked for remediation. The system owner remains accountable for control compliance even when a service is CSP-managed, and the AO will ultimately decide on risk acceptance.

Answer

Accept the risk because the CSP is responsible for the cryptographic module and the system owner has no control over it.

Answer

Immediately remove the system from the authorization boundary because the cryptographic module is non-compliant.

Answer

Escalate the finding directly to the Authorizing Official (AO) without taking any preliminary action.

Question 8

You are the Information System Security Officer (ISSO) for a federal payroll system undergoing an annual assessment. The Security Control Assessor (SCA) reports that a firewall rule allowing inbound RDP from any source is in place, contradicting the documented configuration in the System Security Plan (SSP). The system owner argues the rule is temporary for a migration. What is the most appropriate immediate action?

Accepted Answer

Instruct the network team to remove or restrict the rule immediately, then update the SSP and POA&M to reflect the change.. An undocumented firewall rule allowing unrestricted RDP is a critical finding that must be addressed immediately. The correct approach is to restrict or remove the rule to eliminate exposure, then update the SSP to reflect the actual configuration and create a POA&M entry to track root-cause remediation. This restores compliance and ensures the system operates within its authorized security posture.

Answer

Document the discrepancy in the Plan of Action and Milestones (POA&M) and allow the migration to complete.

Answer

Accept the risk because the system owner has authority over the system and can approve temporary deviations.

Answer

Suspend the system's Authorization to Operate (ATO) until the migration is complete and the rule is removed.

Question 9

A system owner is preparing to submit a system for authorization. The system processes sensitive but unclassified information. The Authorizing Official (AO) requires a formal document that describes the system's security controls and how they are implemented. Which document should the system owner provide?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the document that describes the system's security controls and their implementation. It is a key input to the authorization process and is prepared by the system owner. The SAR is an assessment output, the POA&M addresses weaknesses, and the ATO letter is the authorization decision. Therefore, the system owner must provide the SSP.

Answer

Security Assessment Report (SAR)

Answer

Authorization to Operate (ATO) letter

Answer

Plan of Action and Milestones (POA&M)

Question 10

An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)

Accepted Answer

Document the assessment procedures, evidence collected, and findings in a Security Assessment Report (SAR) that can be reviewed and audited.. A reliable and repeatable assessment requires a detailed assessment plan that maps controls to methods and a Security Assessment Report that documents procedures, evidence, and findings. These artifacts ensure consistency, support independent review, and provide a defensible basis for authorization decisions. Relying on a single method or waiting arbitrarily would undermine the assessment's credibility and completeness.

Answer

Use automated tools exclusively for all controls to eliminate human error and ensure consistency.

Answer

Rely solely on interviews with system administrators to verify technical controls because they are the most knowledgeable.

Answer

Conduct the assessment only after the system has been in operation for at least one year to gather sufficient operational data.

Question 11

You are developing a continuous monitoring strategy for a federal information system as part of the Risk Management Framework (RMF) process. According to NIST SP 800-137, which TWO of the following are essential components of an effective continuous monitoring program? (Choose two.)

Accepted Answer

Configuration management and change control processes.. Configuration management and change control processes, along with security control assessments at an organization-defined frequency, are essential components of a continuous monitoring program per NIST SP 800-137. These elements ensure that the system's security posture is maintained and that changes are evaluated for impact. Other activities like training and penetration testing support security but are not core continuous monitoring components.

Answer

Penetration testing of all external interfaces on a quarterly basis.

Answer

A formal risk acceptance memo signed by the system owner.

Answer

Annual security awareness training for all users.

Question 12

A federal agency is preparing for a continuous monitoring assessment of a high-impact system. The Information System Security Officer (ISSO) must ensure that the security assessment plan (SAP) includes appropriate methods for assessing a new encryption control. Which combination of assessment methods should the ISSO verify are included to provide the most reliable evidence?

Accepted Answer

Examine and test. For technical controls such as encryption, the most reliable evidence comes from examination of configurations and testing of the control's operation. Examination verifies that settings, certificates, and key management are correctly implemented, while testing confirms the control functions as intended. Interviews and questionnaires alone are insufficient because they rely on self-reported information and do not provide objective proof of effectiveness.

Answer

Questionnaire and examine

Answer

Interview and test

Answer

Interview and questionnaire

Question 13

During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?

Accepted Answer

Document the finding and develop a POA&M to replace the encryption with a FIPS 140-2 validated module.. When a control is not met, the appropriate action is to document the finding and create a POA&M to bring the system into compliance. In this case, replacing the encryption with a FIPS 140-2 validated module is necessary. The system owner cannot simply accept equivalent encryption without formal approval. Disconnecting the system or misclassifying the control are not standard procedures.

Answer

Mark the control as 'Not Applicable' because the encryption is not required for this system.

Answer

Immediately disconnect the system from the network until the encryption is replaced.

Answer

Accept the encryption as an equivalent control and document the rationale in the SSP.

Question 14

A system owner is preparing to transition a system into the operations and maintenance phase. The Authorizing Official has granted an Authorization to Operate (ATO). What is the primary compliance activity that must continue during this phase?

Accepted Answer

Performing continuous monitoring of security controls and reporting changes that affect the security posture.. During the operations and maintenance phase, continuous monitoring is the key compliance activity. It ensures that security controls remain effective, changes are tracked, and the Authorizing Official is informed of any significant changes that could affect the authorization. This ongoing process is essential for maintaining the ATO and managing risk throughout the system's lifecycle.

Answer

Archiving all system logs and discontinuing active monitoring to reduce operational costs.

Answer

Re-authorizing the system every quarter to maintain the ATO.

Answer

Conducting a full security assessment every month to validate all controls.

Question 15

An organization is using a FedRAMP-authorized cloud service provider (CSP) for a new system. The ISSO must determine how to leverage the CSP's authorization to reduce the assessment burden for the new system. Which approach is most appropriate according to FedRAMP guidance?

Accepted Answer

Inherit the CSP's controls that are within the FedRAMP boundary and assess only the controls that are not inherited or are specific to the new system.. The most appropriate approach is to inherit controls from the CSP's FedRAMP authorization and assess only the controls that are not inherited or are specific to the new system. This leverages the CSP's existing authorization to reduce duplication and cost, while ensuring that all controls are assessed. FedRAMP promotes this reuse through the concept of control inheritance and the use of the CSP's authorization package.

Answer

Conduct a full independent assessment of all controls, ignoring the CSP's FedRAMP authorization to ensure completeness.

Answer

Rely entirely on the CSP's FedRAMP authorization and forego any additional assessment of the new system.

Answer

Request the CSP to modify its FedRAMP authorization to include the new system's specific controls before proceeding.