(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 1–75

A centralised policy library gives the GRC programme one authoritative repository for policies, versions and attestations, so compliance obligations map to controlled, current documents rather than scattered copies. This satisfies the stem's requirement for a critical compliance-management component by enforcing consistency and auditability across the organisation.

Regulatory intelligence feeds provide timely updates on changes across jurisdictions. Integrating them into the GRC platform enables automated mapping to internal controls and obligations, reducing manual effort and ensuring the organization is alerted to relevant changes. This supports continuous monitoring and proactive compliance, which is a core GRC capability.

An inaccurate authorization boundary omits systems, data or interconnections from the assessment scope, so those assets receive no security evaluation and their vulnerabilities remain unaddressed. This directly matches the risk of unprotected assets falling outside assessment scope.

Working papers record the evidence gathered, tests performed and conclusions reached during assessment, forming the audit trail that substantiates every reported finding. They satisfy the assessor's need to demonstrate that conclusions rest on verifiable evidence, enabling independent review and defending findings if challenged.

NIST SP 800-37 Rev. 2 defines the authorization boundary as the set of system components under the organization's direct control. The VMs, managed database, and load balancer are provisioned and managed by the organization, so they are inside. The hypervisor and physical data center are the provider's responsibility and are covered by the provider's own authorization, such as a FedRAMP package.

Three-year-old Security Control Assessment results breach the annual assessment requirement under continuous monitoring, since federal systems must reassess controls at least yearly to maintain authorisation. The stale results mean the organisation cannot demonstrate ongoing control effectiveness, directly violating the mandated annual testing cadence that continuous monitoring demands.

If the continuous monitoring strategy lacks defined frequencies for each control, some controls may be overlooked. A robust strategy specifies how often each control should be assessed based on risk. Without this, assessments become inconsistent, leading to gaps. The analyst should review and update the strategy to include frequencies for all controls.

Account management lifecycle controls govern provisioning, review, and timely deprovisioning of identities. Disabling inactive accounts is a deprovisioning activity within that lifecycle, so failing to disable dormant accounts means the lifecycle control is not operating effectively, directly satisfying the stem's inactive-account constraint.

The control is only partially implemented because effective audit logging requires both generation and review. The SAR should document the gap, explain how the missing review reduces the control's ability to detect incidents, and recommend remediation. This accurate finding supports risk-based decisions and ensures the Authorizing Official understands the true security posture.

A major change alters the system's security posture, invalidating the original authorisation boundary. The authorising official must re-evaluate the ATO, reassessing controls and residual risk, because the existing approval no longer reflects the modified environment.

PCI DSS Requirement 3 mandates protection of stored cardholder data, including backups. Encrypting backup tapes with strong cryptography renders the data unreadable if tapes are lost or stolen, directly satisfying the requirement. This is a standard practice for media containing sensitive data and is explicitly required for backups unless otherwise secured.

A signed change request or maintenance window approval provides documentary evidence that the after-hours access was planned and authorized. This type of evidence directly addresses the question of authorization, linking the activity to a legitimate business need. It is the most reliable way to confirm that the administrative access was not malicious or unauthorized.

The Assessment Trigger determines when a Control Self-Assessment fires; binding it to the Criticality score makes high-criticality controls assessed more frequently. This automates the workflow the stem requires, whereas manual scheduling or notification settings would not respond to criticality.

A SPAN port mirrors traffic from the core distribution switch, so the sensor sees both internal east-west flows and external north-south traffic crossing that choke point. Placing it inline or on an access switch would miss one direction, failing the requirement to monitor both.

The SSP is the primary document that describes the system's security requirements, controls, and their implementation. It provides a comprehensive overview of how the system meets its security requirements. The AO uses the SSP to understand the system's security posture and make an authorization decision. It is a key artifact in the RMF process.

A workflow trigger evaluates the risk score against the defined appetite threshold and automatically launches the Risk Treatment Plan when it is exceeded. This satisfies the requirement that any score above the appetite initiates treatment without manual intervention.

Firewall audit and management logs record configuration commits and administrative changes, so a SIEM parsing them detects the modification itself. Traffic or session logs only show packets traversing the device, which cannot reveal that the rulebase was altered, so they fail the stem's change-detection requirement.

FIPS 199 is the standard that defines the security objectives (confidentiality, integrity, availability) and the potential impact levels (low, moderate, high). It requires agencies to categorize information and information systems based on the potential impact of a security breach. The program manager should use FIPS 199 to assess the financial data and determine the overall security category. This is the correct starting point for the RMF.

The Security Assessment Report documents the assessor's findings on whether implemented controls are effective, giving authorising officials an evidence-based snapshot at a point in time. It supports the authorisation decision by recording control implementation effectiveness rather than prescribing remediation or defining requirements.

The Executive Steering Committee holds the authority to set organisational risk tolerance, translating business strategy into an acceptable risk threshold. This satisfies the stem's requirement for defining risk appetite, since that decision demands executive-level accountability and cross-functional oversight rather than operational or technical input.

This is a test of the access control mechanism. By attempting unauthorized access, you directly verify that the control is effective. PCI DSS assessment procedures often require testing to ensure that access is actually restricted. This provides objective evidence because the result is observable and not dependent on interviews or documentation. It is a key method for validating Requirement 7.

Annualized loss expectancy multiplies single loss expectancy by the annualized rate of occurrence, yielding a dollar figure per year. That figure can be directly compared with the annual cost of a proposed control, enabling a return-on-security-investment comparison. This is precisely the monetary framing the board requested.

Observation and reperformance are direct, objective evidence-gathering techniques. Observing the actual provisioning task confirms the control is performed as described, and reperforming the access review independently verifies the outcome. These techniques provide strong evidence of operating effectiveness because they involve the auditor directly witnessing or executing the control, reducing reliance on management assertions.

Mapping Active Directory groups to granular GRC Security Profiles enforces least privilege by granting auditors only the permissions their role requires, rather than broad access. This group-to-profile mapping satisfies the stem's constraint of integrating with existing Active Directory infrastructure while restricting internal auditors to precisely scoped GRC functions.

Using NIST as the primary baseline and adding PCI DSS-specific controls as an overlay allows you to leverage the comprehensive NIST framework while addressing PCI DSS's more prescriptive requirements. This approach avoids duplication and ensures compliance with both. Overlays are designed for such scenarios, enabling the addition of controls to meet specific mandates.

Defining the system boundary establishes what is included in the system, thereby determining the scope for security control implementation, assessment, and risk management. It ensures that all components processing, storing, or transmitting information are protected and that the authorization decision covers the correct set of assets. This is essential for effective risk management and compliance.

UBA uses machine learning and analytics to establish baselines of normal user activity and detect deviations that may indicate insider threats. It is a detective control that monitors behavior and generates alerts, directly addressing the requirement to flag anomalous activities.

A common control is implemented once and inherited by multiple systems, so individual systems inherit password complexity rather than reimplementing it. This satisfies the audit finding by avoiding duplicate controls across systems covered by the common control.

Least privilege means granting users only the minimum access rights required to perform their tasks. This directly matches the policy requirement. It reduces the risk of insider threats and accidental damage by limiting unnecessary permissions, making it the correct principle.

This approach correctly applies the concept of common controls, which are controls implemented at the organizational level and inherited by multiple systems. By documenting the existing physical controls as common and verifying their adequacy, you avoid duplication and ensure the payroll system meets the physical access authorization requirement through inheritance.

An overlay allows you to incorporate HIPAA-specific requirements into the NIST SP 800-53 baseline. By mapping HIPAA controls to NIST controls, you ensure that all necessary safeguards are included while leveraging the structured NIST framework. This is the most effective approach for achieving compliance.

Compliance determination requires verifying that the control is implemented according to the security plan and that it operates as intended. This includes examining the implementation, testing its functionality, and confirming it meets the stated requirements. Without evidence of correct implementation and effectiveness, the control cannot be deemed compliant, even if documentation exists.

Risk appetite is the broad willingness to accept risk; tolerance translates it into measurable boundaries by category. Setting thresholds for safety and compliance far tighter than for efficiency, and wiring them to escalation triggers, converts the board's qualitative stance into decisions the organization can execute and monitor.

A third-party audit is conducted by an independent external auditor who has no direct interest in the organization. This independence ensures objectivity and provides stakeholders with a high level of assurance regarding the organization's security controls. Common examples include SOC 2 examinations and ISO/IEC 27001 certification audits, which are widely recognized for their credibility and impartiality.

In virtualized environments, the hypervisor is often a shared infrastructure component that provides security controls to multiple systems. It should be treated as a common control, and the system security plan should document which controls are inherited from the hypervisor's authorization. This approach avoids duplicating assessments and ensures that the system relies on the hypervisor's security posture.

The web server directly processes CUI and is dedicated to the system, so it must be included in the authorization boundary. NIST SP 800-37 requires that all components that process, store, or transmit CUI be within the boundary. Including dedicated components ensures that security controls are assessed and authorized for the system, and that the boundary accurately reflects the system's scope.

FIPS 199 requires categorization based on the potential impact to the organization if the information is compromised. The analyst must first identify information types and then assess impact levels (low, moderate, high) for confidentiality, integrity, and availability. This foundational step ensures the security category accurately reflects the system's criticality before any technical controls are selected.

Completion dates are mandatory in a POA&M; without them, milestones cannot be tracked, remediation cannot be scheduled, and progress cannot be measured. Listing weaknesses with no target dates therefore demonstrates an ineffective process, since the plan cannot drive or evidence closure.

Time-stamped logs and recurring automated test results create a continuous evidentiary trail. They show when the control operated, whether it failed, and how failures were remediated, which lets the auditor verify operation across the entire period rather than inferring it. This is the strongest support for a continuous-operation assertion.

FIPS 199 rates each security objective separately at Low, Moderate or High based on the potential impact of loss. Public data means confidentiality and integrity breaches cause limited harm, so both stay Low, but catastrophic loss of availability for a critical government service raises that objective to High.

Automated notification workflows satisfy the real-time alerting constraint by pushing failure events to responsible owners the moment a control drifts, rather than waiting for periodic review. Without this feedback loop, monitoring detects nothing actionable, so remediation stalls and the program degrades into static reporting.

Ongoing security control assessments and reporting to authorizing officials are core to continuous monitoring. NIST SP 800-137 requires that organizations assess controls at a frequency sufficient to make risk-based decisions and report the security status to authorizing officials. This process ensures that control effectiveness is continually evaluated and that decision-makers have current information to accept or mitigate risk.

Without a named owner, no one is accountable for monitoring the risk or deciding on treatment. Ownership also enables escalation, because the GRC team knows whom to contact when a tolerance is breached. Assigning an owner to every entry is foundational to a register that leadership can actually act upon.

An alarm system detects and reports intrusions after they occur, providing awareness rather than blocking access. This satisfies the detective classification: it identifies and records security events, unlike preventive controls such as locks or guards that stop incidents.

A field-based Expiration Date trigger satisfies the stem's requirement for automatic review before expiry. Unlike time-based schedules, which fire regardless of record state, this workflow notification activates only when the exception's own date field approaches, ensuring each temporary exception is reviewed individually before it lapses.

A password manager generates and stores unique, complex credentials per account, eliminating reuse and enabling long, high-entropy passwords that users need not memorise. This directly satisfies the best-practice requirement for uniqueness and complexity, while reducing the cognitive burden that drives weak or recycled passwords across systems.

Anchoring the boundary to services and data flows the sub-system actually owns creates an explicit, verifiable interface contract. This constrains scope to defined responsibilities, preventing adjacent capabilities from being absorbed and satisfying the System of Systems need to avoid scope creep.

Encryption at rest with AES-256 ensures that ePHI stored in the cloud remains unreadable without the decryption keys, directly addressing the risk of media compromise. It is a technical control that protects confidentiality and satisfies HIPAA encryption addressable implementation specifications. This is the most effective control for the stated scenario.

Enterprise-wide programmes accumulate controls, risks and evidence across many business units, so the platform must scale without degrading query performance or reporting latency. This satisfies the selection criterion by ensuring the chosen GRC tool sustains growing data volumes as scope expands.

The authorization boundary defines the set of system components (hardware, software, and firmware) that are authorized to operate as a system. In a cloud environment, the boundary typically includes the resources within the VPC and the supporting infrastructure provided by the cloud service provider (CSP), which may be covered under the CSP's own authorization or a shared responsibility model. This ensures comprehensive coverage of the system.

Supplementing adds controls beyond the NIST SP 800-53 Rev. 5 baseline when the organisation's specific threat environment, mission, or technologies demand extra protection. Adding controls to counter identified threat vectors satisfies the authorization official's tailoring request, distinguishing supplementing from scoping or compensating control selection.

Patches frequently break production workloads, so automated testing in a staging environment validates compatibility before wide deployment. This satisfies the requirement to verify patches against representative systems, catching regressions while preserving availability of critical services.

Assessment Execution requires examining artefacts to verify that documented controls exist and are current. Reviewing system documentation supplies documentary evidence of policies, procedures and configurations, satisfying the phase's need to assess design adequacy before testing whether controls actually operate as described.

Input validation ensures that user-supplied data conforms to expected formats, while parameterized queries separate SQL code from data, preventing attackers from altering query logic. This combination directly mitigates SQL injection and is a standard requirement for PCI DSS compliance.

The authorization boundary defines the components, processes, and personnel that make up the system. It establishes what the organization must protect and assess. This scope ensures that all necessary controls are implemented and that the assessment covers the entire system. Without a clear boundary, the security evaluation would be incomplete or misdirected.

A data classification policy is a documented management directive governing how information is labelled and handled, making it administrative rather than technical or physical. It satisfies the stem's requirement for an example of an administrative security control, since it operates through organisational rules and governance.

A shared identity service sits outside the system's direct control, so it must be documented as an external provider, with its controls inherited rather than re-assessed. This satisfies the boundary constraint by keeping the authorisation boundary accurate and avoiding duplicated control testing.

Confidential computing uses hardware-based memory encryption to protect data in use within a TEE, and remote attestation verifies the TEE's integrity before releasing secrets. This directly addresses the requirement for confidentiality and integrity of data in use, which traditional encryption at rest and in transit cannot cover. It is a primary control for protecting intellectual property during processing.

Operational observations are findings where processes or practices deviate from expected performance without necessarily breaching a control, such as inconsistent log review. They belong in audit reports alongside control deficiencies and compliance violations, capturing issues affecting effectiveness that fall short of outright non-compliance.

Network boundaries define the perimeter across which audit evidence is gathered, directly shaping scope by fixing which systems, segments and interconnections fall inside the review. They satisfy the stem's scope constraint because audit coverage cannot extend beyond the defined boundary, making it a structural determinant of what the assessment examines.

To meet HIPAA audit control requirements, each log entry must include sufficient detail to identify who accessed what and when. The date, time, and user ID are fundamental elements that enable traceability and accountability. Without these, logs are of little value for forensic analysis or compliance audits. This detail supports the required monitoring and review of ePHI access.

Security impact analysis must determine whether a proposed change degrades or bypasses controls already protecting the system. Assessing negative impact on existing controls directly satisfies the stem's requirement, exposing weakened safeguards, altered configurations or removed protections before the change is approved and implemented.

AWS Config Remediation Actions pair a rule with an SSM Automation document, so non-compliant S3 buckets are corrected automatically without manual intervention. This directly satisfies the stem's requirement for automatic remediation, since Config continuously evaluates bucket ACLs and public access settings, then triggers the remediation action whenever a bucket is detected as public.

Automated configuration compliance scans compare live settings against a hardened baseline, detecting drift such as disabled logging or weakened encryption. This directly verifies controls function as intended, satisfying continuous monitoring through repeatable, scheduled evidence collection rather than one-off manual review.

A centralized KMS with automated rotation and secure backup ensures keys are managed consistently, rotated regularly, and recoverable after a disaster. It provides strong access controls and auditing. This practice meets both security and availability requirements, making it the best choice.

The INPUT chain processes packets whose destination is a local socket on the firewall host itself, exactly matching the stem's requirement to filter traffic destined for the local host. FORWARD handles transit traffic, while OUTPUT governs locally generated packets, so INPUT is the only chain that inspects inbound packets addressed to this machine.

A System of Record delivers the authoritative, single source of truth for audit and compliance data, eliminating conflicting evidence across spreadsheets and disconnected tools. This directly satisfies the stem's requirement for a defined GRC program structure, ensuring every control, risk and finding traces to one governed repository that auditors and Microsoft Entra ID access reviews can rely upon.

An Expiration Date marks when the policy falls due for review, while the Workflow Reminder automatically notifies the responsible owner ahead of that date. Together they enforce the annual review cadence within the platform rather than relying on manual tracking, satisfying the stated yearly requirement.

Placing acceptance authority in a board-reporting risk committee separates decision-makers from control operators, which preserves objectivity and avoids the conflict the CISO and CIO represent. The CISO and CIO still supply technical input, but they do not self-approve risk that their own teams create or operate, satisfying the independence requirement in the scenario.

RTO defines the maximum tolerable downtime before availability is deemed unacceptable, directly quantifying the recovery speed the backup solution must deliver. Auditing against RTO verifies the solution meets the business's stated availability constraint, unlike RPO, which addresses only data loss tolerance.

The Availability criterion measures whether systems remain operable and recoverable. Disaster recovery plan test results directly evidence recovery capability and uptime commitments, unlike confidentiality or processing integrity artefacts, making them the most relevant proof for that criterion.

A many-to-many mapping lets one control satisfy multiple regulatory requirements and vice versa, eliminating duplicated entries across the Risk Register and Compliance Control library. This shared relationship model is the mechanism that enables Common Control Framework reuse, resolving the data inconsistency described.

This is correct because persistent unresolved vulnerabilities may indicate a significant change in risk. A security impact analysis evaluates whether the system's security posture has degraded and if the ATO conditions are still met. This analysis informs decisions on risk acceptance, mitigation, or escalation.

A security assessment plan (SAP) is a key document produced during the Assess step. It defines the scope of the assessment, the specific controls and control enhancements to be assessed, the assessment methods (examine, interview, test), and the procedures to be used. Without a SAP, the assessment lacks structure and may miss critical controls, making it impossible to determine overall effectiveness accurately.

SCAP expresses benchmarks as machine-readable checklists, letting tools automatically compare system settings against them and report compliance. This directly satisfies continuous monitoring's need for repeatable, frequent configuration assessment without manual review, which is the protocol's primary function.