20+ practice questions focused on Compliance Maintenance — one of the most tested topics on the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Compliance Maintenance PracticeWhich THREE actions are required when preparing to decommission a system that stored 'Classified' information?
Explanation: Option B is correct because a certificate of destruction provides documented, auditable evidence that Classified media was properly sanitized or destroyed, which is required for compliance and chain-of-custody records. Option C is correct because storage media that held Classified information must be physically destroyed (e.g., degaussing, shredding, incineration) since logical sanitization alone is insufficient for media that stored classified data. Option E is correct because decommissioning requires removing the system from the active asset inventory so it is no longer tracked, maintained, or counted as an operational asset. Option A is incorrect because indefinite secure storage does not complete decommissioning and leaves classified media unaccounted for rather than properly destroyed. Option D is incorrect because reformatting is a logical sanitization method that does not adequately remove Classified data and is not permitted for reuse in a non-sensitive project.
A GRC manager is updating the continuous monitoring strategy for a high-impact federal system after a major change to its boundary. The system now interfaces with an external cloud service. The manager must ensure that the monitoring strategy remains compliant with NIST SP 800-137. Which TWO of the following actions are most critical to include in the updated strategy? (Choose two.)
Explanation: The most critical actions are defining metrics and thresholds for the new interface and establishing a reporting frequency to the authorizing official. These directly align with NIST SP 800-137's requirements for continuous monitoring: measurable indicators of control effectiveness and regular reporting to support risk decisions. They ensure that the new boundary is actively monitored and that leadership remains informed, preserving the system's compliance posture.
A GRC analyst is preparing for an annual assessment of a system's continuous monitoring program. The analyst needs to review the security posture and ensure compliance with NIST SP 800-53A. Which TWO of the following are the most critical artifacts to examine during this review? (Choose two.)
Explanation: The most critical artifacts for reviewing a continuous monitoring program are the security assessment report (SAR) and the plan of action and milestones (POA&M). The SAR provides the results of the last assessment, highlighting weaknesses and their severity. The POA&M tracks the remediation of those weaknesses. Together, they give a comprehensive view of the system's security posture and the effectiveness of continuous monitoring. Other plans like the SSP, BCP, and IRP are important but not as directly tied to the assessment of monitoring activities.
Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?
Explanation: Tenable.io reports vulnerability status based on the most recent scan data it has received. If a patch was applied but no scan was run afterward, the platform has no evidence of remediation and will continue to show the vulnerability as open. The configuration management database reflects the intended state (patch deployed), while the scanner reflects the observed state (last scan result) — the gap is simply the absence of a post-patch verification scan.
You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?
Explanation: Per NIST SP 800-37 R2, when a significant change occurs during ongoing authorization, the first step is to perform a security impact analysis to determine the extent of the change's effect on the security posture. This analysis informs whether the change is within the already-authorized boundary or requires reauthorization. It is a risk-based approach that ensures the Authorizing Official has the necessary information before deciding on further actions.
+15 more Compliance Maintenance questions available
Practice all Compliance Maintenance questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Compliance Maintenance. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Compliance Maintenance questions on the CGRC frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Compliance Maintenance is tested as part of the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) blueprint. Practicing with targeted Compliance Maintenance questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CGRC practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Compliance Maintenance is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Compliance Maintenance practice session with instant scoring and detailed explanations.
Start Compliance Maintenance Practice →