CGRC System Compliance — Timed 20 Questions

Question 1

Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?

Accepted Answer

Information System Security Officer (ISSO). The Information System Security Officer (ISSO) is the role designated in the RMF (NIST SP 800-37) to perform continuous monitoring of security controls after an Authorization to Operate (ATO) is granted. The ISSO maintains the system's security posture by tracking control effectiveness, managing POA&Ms, and reporting status to the Authorizing Official. This ongoing operational responsibility is distinct from the authorization decision itself.

Answer

Authorizing Official

Answer

Chief Information Security Officer (CISO)

Answer

Security Control Assessor (SCA)

Question 2

Which TWO documents are essential for an Authorizing Official to make an informed risk-based decision?

Accepted Answer

Plan of Action and Milestones (POA&M). The Plan of Action and Milestones (POA&M) (C) is essential because it documents known weaknesses, the planned remediation actions, resources required, and milestone dates, giving the Authorizing Official the residual-risk picture needed to decide whether to grant an authorization. The Security Assessment Report (SAR) (D) is essential because it presents the independent assessor's findings on the effectiveness of implemented controls, including the severity of deficiencies, which the AO must weigh against the POA&M and SSP to make a risk-based decision. Together these two artifacts supply the assessment results and the remediation/risk-acceptance data that directly inform the authorization decision. The System Security Plan (A) is important context but describes the control implementation rather than the assessed risk posture, so it is not one of the two essential decision documents here. The Hardware inventory list (B) and Network diagram (E) are supporting artifacts that feed into the SSP and assessment process but do not by themselves provide the risk findings and remediation commitments the AO needs.

Answer

System Security Plan (SSP)

Answer

Hardware inventory list

Answer

Network diagram

Question 3

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

Accepted Answer

Document the compensating control and assess its effectiveness. When a required control (MFA) is absent but an alternative control (physically secured enclave) provides equivalent or compensating protection, the correct action is to document the compensating control and assess whether it effectively mitigates the risk. The SAR should record the gap, the compensating control, the assessment of its effectiveness, and any residual risk so the Authorizing Official can make an informed risk decision.

Answer

Force an upgrade to the application

Answer

Immediately revoke the Authorization to Operate (ATO)

Answer

Mark the control as 'Not Applicable'

Question 4

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

Accepted Answer

Accepting the residual risk associated with the POA&M. The Authorizing Official (AO) is the senior official who formally accepts the residual risk of operating a system, and the POA&M documents known weaknesses and planned mitigations. The AO's primary responsibility is to review the POA&M and decide whether the residual risk is acceptable, granting or denying authorization to operate. This risk-acceptance role is the core of the RMF authorization decision.

Answer

Drafting the mitigation tasks

Answer

Conducting the security controls assessment

Answer

Implementing the technical patches

Question 5

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Accepted Answer

The system must meet specific security requirements to remain authorized. An 'ATO with Conditions' means the Authorizing Official permits the system to operate, but only if the system owner implements and maintains specific security controls, mitigations, or reporting requirements within defined timeframes. Continued authorization is contingent on satisfying those conditions; failure to do so can result in revocation.

Answer

The system is unauthorized for production use

Answer

The system is prohibited from processing sensitive data

Answer

The system is permanently compliant

Question 6

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Accepted Answer

After the 'Assess' step and before the 'Authorize' step. In NIST SP 800-37 R2, the RMF steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The Security Assessment Report (SAR) is produced during the Assess step and is presented to the Authorizing Official as a key input to the Authorize step, where the AO makes the ATO decision. Thus the SAR is delivered after Assess and before Authorize.

Answer

During the 'Categorize' step

Answer

After the 'Monitor' step

Answer

During the 'Prepare' step

Question 7

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary is defined by the set of components that the authorizing official has authority over — i.e., ownership and control. When data is shared with an external partner, the boundary must be drawn where the organization's control ends and the partner's begins, because the AO can only accept risk for systems they own or control. Cost, physical location, and user count do not determine who is accountable for the risk.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 8

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

Accepted Answer

Request a re-assessment using the 'Test' method. Requesting a re-assessment using the 'Test' method is correct because technical controls require objective, hands-on examination (e.g., scanning, configuration review, penetration testing) rather than subjective interviews. An interview alone cannot verify that a technical control is implemented and operating effectively. The assessor must use the appropriate assessment method defined in the assessment plan.

Answer

Accept the findings as-is

Answer

Escalate to the Chief Information Officer (CIO)

Answer

Update the System Security Plan (SSP) to match the interview

Question 9

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Accepted Answer

System boundary and authorization boundary. Before an ISSO can develop a Security Assessment Plan (SAP), the system boundary and authorization boundary must be defined, because they determine which controls, components, and interfaces fall within assessment scope. Without a clearly identified boundary, assessment coverage cannot be judged adequate and controls may be missed or over-scoped.

Answer

Security control baselines

Answer

Contingency plan testing

Answer

Risk acceptance threshold

Question 10

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

Accepted Answer

The cloud provider's System Security Plan (SSP) or Authorization Package. The cloud provider's System Security Plan (SSP) or authorization package is the primary evidence of implemented security controls, because it documents control descriptions, implementation statements, and supporting artifacts mapped to a framework such as NIST SP 800-53 or FedRAMP. It is the authoritative artifact a customer or auditor reviews to determine whether the provider's controls meet compliance requirements.

Answer

The service level agreement (SLA)

Answer

The organization's internal risk register

Answer

The network topology map

Question 11

What is the purpose of the Security Assessment Report (SAR)?

Accepted Answer

To provide a snapshot of the control implementation effectiveness. The Security Assessment Report (SAR) is a key deliverable of the security assessment phase within the Risk Management Framework (RMF). Its primary purpose is to document the findings from assessing the security controls, including whether each control is implemented correctly, operating as intended, and producing the desired outcome. This provides a snapshot of control implementation effectiveness, which decision-makers use to determine residual risk and inform authorization decisions. The SAR does not itself authorize the system; that is the role of the Authorization to Operate (ATO).

Answer

To request funding for security improvements

Answer

To authorize the system for production

Answer

To list all authorized users

Question 12

Which document provides the formal authority to operate a system?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document (also called the Authorization to Operate, ATO, or in NIST RMF terms the authorization package's decision) is the formal artifact in which the Authorizing Official accepts the risk and grants authority to operate the system. It is the official record that the system may be placed into operation based on the assessed controls and residual risk.

Answer

System Security Plan

Answer

Risk Assessment Report

Answer

Security Control Assessment

Question 13

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

Accepted Answer

The POA&M lists items with no completion dates. An ineffective POA&M process is indicated by listing items with no completion dates, because POA&Ms require milestones and estimated completion dates to track remediation progress. Without dates, there is no accountability or timeline for resolving weaknesses, which violates FedRAMP and NIST SP 800-37 requirements. The other options describe positive attributes of an effective POA&M process.

Answer

The POA&M contains vulnerabilities found by automated scans

Answer

The POA&M is stored in a secure repository

Answer

The POA&M is reviewed by the CISO

Question 14

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

Accepted Answer

The potential impact on the organization's mission. The Authorizing Official (AO) is the senior official who accepts risk on behalf of the organization, so the risk acceptance request must articulate the mission/business impact of the unpatched vulnerability. Under NIST RMF (SP 800-37), the AO's decision hinges on how the vulnerability affects organizational operations, assets, and mission/business functions — not on technical severity alone. The potential mission impact is what allows the AO to make an informed, accountable risk decision.

Answer

The estimated cost of an upgrade

Answer

The manufacturer's release notes

Answer

The CVSS score of the vulnerability

Question 15

When a system is undergoing a major change, what is the impact on the existing ATO?

Accepted Answer

The ATO must be re-evaluated. Under NIST RMF (SP 800-37) and FedRAMP continuous monitoring guidance, an ATO is tied to a specific, baselined system configuration and the risk determination made at the time of authorization. A major change—such as new functionality, a new data type, a new interconnection, or a significant architecture shift—invalidates that risk determination because the security posture may have materially changed. The AO must therefore have the change re-assessed (a reauthorization or significant-change review) before the system can continue operating under the existing authorization.

Answer

The ATO is suspended until the next fiscal year

Answer

The ATO remains valid until the expiration date

Answer

The ATO is automatically extended

Question 16

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

Accepted Answer

A technical justification for the N/A status. A technical justification for the N/A status is required because the system owner must document why a control does not apply to the system, based on the system's characteristics, environment, or scope. This justification supports the authorization decision and provides an audit trail. It is not a waiver of a required control but an explanation of non-applicability.

Answer

A waiver request to the CISO

Answer

A copy of the vendor's warranty

Answer

The procurement contract

Question 17

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The System Security Plan (SSP) documents the system boundary, controls selected and implemented, and how they meet requirements. The Security Assessment Report (SAR) is the output of assessing those controls, evaluating whether the controls described in the SSP are effective. Thus the SAR evaluates the SSP's controls, and both feed the authorization decision.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP

Question 18

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

Accepted Answer

Include security requirements in the contract language. Including security requirements in the contract language is the correct answer because it legally binds the contractor to comply with your organization's security standards. This ensures that the contractor's system meets the necessary controls and allows for enforcement through contractual obligations. It is a proactive measure that integrates security into the procurement process, aligning with NIST SP 800-53 and other frameworks that emphasize contractual security requirements for external providers.

Answer

Grant them access to your internal ATO database

Answer

Perform an audit of the contractor's office

Answer

Trust the contractor's internal IT department

Question 19

What is the primary role of the Security Control Assessor (SCA)?

Accepted Answer

To determine the effectiveness of the security controls. The Security Control Assessor (SCA) is responsible for evaluating the security controls implemented in an information system to determine their effectiveness in meeting the security requirements. This role is defined in NIST SP 800-37, the Risk Management Framework (RMF), where the SCA conducts assessments to produce evidence for the Authorizing Official's risk-based decision. The SCA does not implement controls, remediate vulnerabilities, or accept risk; those are the responsibilities of the system owner, information system security officer, and authorizing official, respectively.

Answer

To implement the security controls

Answer

To remediate vulnerabilities

Answer

To accept the risk on behalf of the agency

Question 20

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Accepted Answer

Monitor. The RMF (Risk Management Framework) Monitor phase (Step 6) is where continuous monitoring of security controls takes place. This phase involves ongoing assessment of control effectiveness, tracking changes to the system, and reporting the security posture to authorizing officials. It ensures that the system remains compliant and that any degradation in controls is detected and addressed.

Answer

Authorize

Answer

Select

Answer

Categorize