20+ practice questions focused on Scope OF System — one of the most tested topics on the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Scope OF System PracticeYou are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?
Explanation: Under NIST SP 800-37, the authorization boundary must encompass all components that process, store, or transmit federal information, including supporting infrastructure. For a cloud-hosted application, the CSP's physical security controls for the data center are inherited controls that directly protect the confidentiality, integrity, and availability of the system. Therefore, they must be explicitly included within the boundary to ensure a complete and accurate security assessment.
Which TWO statements regarding FIPS 199 'High Water Mark' are accurate? (Select TWO)
Explanation: Option A is correct because FIPS 199 defines the system's overall security category using the high water mark concept: the system is categorized at the highest impact level among the three security objectives—confidentiality, integrity, and availability—so if any one objective is rated High, the entire system is treated as High. Option E is correct because once the high water mark sets the system's overall categorization, that category drives the baseline selection and application of security controls across the entire system boundary, meaning all controls are applied at the level dictated by the highest-rated objective. Option B is incorrect because the high water mark is a general FIPS 199 rule applicable to any system being categorized, not limited to federal systems handling only High impact data. Option C is incorrect because FIPS 199 explicitly rejects averaging; the overall category is the maximum, not a mean, of the individual objective ratings. Option D is incorrect because the high water mark considers all three objectives—confidentiality, integrity, and availability—not availability alone.
In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)
Explanation: In RMF terms, an information system comprises the people, processes, and technology that support the system within its authorization boundary. Option A (Administrative personnel managing the system) is correct because the personnel who administer, operate, and support the system are part of the information system and fall within the authorization boundary. Option C (Operating systems) is correct because operating systems are core technology components (hardware, software, firmware) that constitute the information system. Option D (Physical security guards at the facility gate) is correct because the personnel and physical protection mechanisms safeguarding the system are part of the information system's boundary. Option B (The local library book catalog) is not part of the system's boundary because it is an unrelated external information resource. Option E (The public social media feed of the organization) is not part of the authorization boundary because it is an external, publicly accessible communication channel outside the system's control.
A security architect is defining the authorization boundary for a new payroll processing system. The system runs on a virtual server hosted in a government cloud, uses a managed database service from the same cloud provider, and connects to an on-premises mainframe for employee records. The architect needs to decide whether the cloud provider's infrastructure should be inside the boundary. According to NIST SP 800-37 Rev. 2, what is the most appropriate action?
Explanation: The authorization boundary should include only the assets the organization owns or directly controls. Cloud infrastructure managed by the provider is typically excluded and addressed through inherited controls from the provider's own authorization, such as a FedRAMP provisional authorization. This approach keeps the boundary realistic and leverages existing assessments.
A security architect is defining the authorization boundary for a new system that will process, store, and transmit controlled unclassified information (CUI). The system will use a shared database service and a separate authentication server. Which TWO components should the architect consider as part of the system boundary? (Choose two.)
Explanation: The authorization boundary should include components that directly process, store, or transmit the system's data, or that provide security services essential to the system. The authentication server and the backup server meet these criteria because they are integral to the system's security and data protection. Shared infrastructure like network switches, shared databases, and provider personnel are typically excluded as they are covered by separate authorizations or common controls.
+15 more Scope OF System questions available
Practice all Scope OF System questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Scope OF System. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Scope OF System questions on the CGRC frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Scope OF System is tested as part of the (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) blueprint. Practicing with targeted Scope OF System questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CGRC practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Scope OF System is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Scope OF System practice session with instant scoring and detailed explanations.
Start Scope OF System Practice →