20+ practice questions focused on Control Selection — one of the most tested topics on the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Control Selection PracticeWhat document provides the most granular guidance on tailoring security controls for federal systems?
Explanation: NIST SP 800-53 is the comprehensive catalog of security and privacy controls for federal information systems, and it provides the most granular guidance on tailoring those controls. It includes detailed control baselines, control enhancements, and explicit tailoring guidance (such as scoping, parameterization, and compensating controls) in Appendixes and supplemental materials. FIPS 200 and SP 800-37 reference SP 800-53 but do not themselves contain the granular tailoring instructions. CNSSI 1253 provides tailoring for national security systems, but it is not the primary federal guidance for general federal systems.
Which of the following is the first step in the RMF that involves the selection of security controls?
Explanation: The Select step is the third step in the Risk Management Framework (RMF).
Which of the following describes a 'Hybrid' control?
Explanation: In the context of security control baselines (e.g., NIST SP 800-53), a 'Hybrid' control refers to a control that can be implemented as either a common control (shared across systems) or a system-specific control, depending on the organization's decision. This shared responsibility means the control may be managed by the organization (common) and inherited by the system, or implemented specifically for the system. Thus, option B best describes a hybrid control.
Which TWO of the following characterize the 'Select' step in the RMF?
Explanation: Option B is correct because the Select step of the NIST RMF is where security and privacy controls are identified and selected based on the system's security categorization, using baselines such as NIST SP 800-53B and tailoring them as needed. Option D is correct because the selected controls and their implementation details are documented in the System Security Plan (SSP), which is a key output of the Select step. Option A is incorrect because verifying that controls operate as expected is part of the Assess step, not Select. Option C is incorrect because determining impact categorization is performed in the Categorize step, which precedes Select. Option E is incorrect because authorizing the system for operation occurs in the Authorize step, after assessment.
A security manager is tailoring the NIST SP 800-53 control baseline for a new human resources system that will be deployed in a public cloud environment. The system will process sensitive employee data but will not interconnect with any other organizational systems. The organization wants to ensure that the selected controls are appropriate and that any unnecessary controls are removed or scoped appropriately. Which TWO of the following actions are appropriate when tailoring the control baseline for this system? (Choose two.)
Explanation: Scoping out non-applicable controls and applying compensating controls are both valid tailoring actions that adapt the baseline to the system's specific environment and constraints. These actions ensure the control set is appropriate and cost-effective while maintaining security. Documentation of these decisions is required but is not itself a tailoring action; it supports the tailoring process.
+15 more Control Selection questions available
Practice all Control Selection questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Control Selection. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Control Selection questions on the CGRC frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Control Selection is tested as part of the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) blueprint. Practicing with targeted Control Selection questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CGRC practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Control Selection is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Control Selection practice session with instant scoring and detailed explanations.
Start Control Selection Practice →