20+ practice questions focused on Control Implementation — one of the most tested topics on the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Control Implementation PracticeWhen configuring Cisco ASA firewall rules, you notice that traffic is being dropped despite an 'allow' access-list. What is the most likely cause?
Explanation: Cisco ASA processes access-list entries sequentially from top to bottom and stops at the first match. If a 'deny ip any any' entry appears before the intended 'permit' entry in the same ACL, all matching traffic is dropped before the permit is ever evaluated. The fix is to reorder the ACEs so the permit precedes the deny, or remove the overly broad deny.
You are configuring a SIEM (e.g., Splunk) to monitor failed login attempts. What is the most efficient way to reduce noise while maintaining audit integrity?
Explanation: Applying filters on the Universal Forwarder reduces noise by preventing unnecessary events from being sent to the SIEM indexer, while still allowing relevant failed login events to be captured. This maintains audit integrity because the filtering is done at the source, and the original logs remain on the source system if needed for forensic analysis.
When configuring an email security gateway (e.g., Proofpoint), which record should be added to DNS to prevent domain spoofing?
Explanation: SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers authorized to send email on behalf of a domain. Receiving mail servers check the envelope sender's domain against the SPF record and reject or flag messages from unauthorized senders, directly mitigating domain spoofing. It is the correct DNS-based anti-spoofing control for an email security gateway to enforce.
You are managing access to a file server. You want to ensure that users can read files but not delete them. What is this an example of?
Explanation: Read-Only permission grants users the ability to view and open files but not to modify, delete, or create them, which exactly matches the requirement of reading without deleting. In Windows NTFS, the Read & Execute/Read permissions and the 'Read' basic permission enforce this; in POSIX, read (r) without write (w) on the file or directory achieves the same effect.
A multinational corporation is deploying a new cloud-based customer relationship management (CRM) system. The security team must ensure that data stored in the CRM is protected in accordance with the organization's data classification policy. Which two of the following controls are most appropriate to implement for data at rest in the CRM? (Choose two.)
Explanation: Field-level encryption with AES-256 and role-based access control directly protect data at rest by making it unreadable without keys and restricting who can access it. TLS protects data in transit, FDE addresses physical disk theft but not application-level access, and network segmentation is a perimeter control. Together, encryption and RBAC provide defense in depth for stored data.
+15 more Control Implementation questions available
Practice all Control Implementation questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Control Implementation. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Control Implementation questions on the CGRC frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Control Implementation is tested as part of the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) blueprint. Practicing with targeted Control Implementation questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CGRC practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Control Implementation is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Control Implementation practice session with instant scoring and detailed explanations.
Start Control Implementation Practice →