(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 1–75

When structuring a GRC program, which THREE components are critical for compliance management?

What is the primary risk of having an inaccurately defined authorization boundary?

What is the primary function of an assessor's 'working papers'?

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

When a system is undergoing a major change, what is the impact on the existing ATO?

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?

You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

What is the purpose of the Security Assessment Report (SAR)?

Which role is typically responsible for defining the 'Risk Appetite' within a GRC governance framework?

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

Which THREE of the following are necessary to establish a 'Continuous Control Monitoring' (CCM) program?

Which type of control is an alarm system installed in a server room?

Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?

The organization's GRC workflow has a 'Request for Exception' process. The goal is to ensure that temporary risk exceptions are automatically reviewed before they expire. Which mechanism is most appropriate?

Which TWO of the following represent best practices for password management?

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

The organization has adopted a 'Defense-in-Depth' strategy. You are tasked with mapping controls to the NIST CSF framework within the GRC tool. What is the most effective way to manage the relationship between framework sub-categories and existing internal controls?

Which TWO of the following should be considered when selecting a GRC platform for an enterprise-wide program?

What document provides the most granular guidance on tailoring security controls for federal systems?

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Which TWO of the following are critical requirements for implementing an effective patch management program?

Which THREE activities are part of the 'Assessment Execution' phase?

Which TWO of the following are examples of administrative security controls?

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

Which THREE types of findings might appear in an audit report?

Which TWO factors contribute to the 'scope' of an information security audit?

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)

When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?

The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?

You are auditing a backup solution. Which metric is most critical for the Availability audit?

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

When conducting an audit, what is 'sampling'?

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Which phase of the RMF includes the 'continuous monitoring' of security controls?

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

Which technique is best to detect 'false negatives' during a security control assessment?

The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?

Which administrative control is essential before deploying a new security tool to production?

Which THREE elements are necessary for a compliant continuous monitoring program?

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Which TWO of the following are considered 'common controls'?

When aligning GRC with business objectives, which THREE of the following represent effective strategic alignment?

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?

What is the physical security control used to prevent piggybacking at an entry point?

Which TWO of the following characterize the 'Select' step in the RMF?

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

When performing vulnerability management, what is the purpose of a 'credentialed scan'?

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

Which THREE factors should an organization consider when applying control overlays?

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

Which TWO methods are commonly used to gather assessment evidence?

Which TWO types of controls are specifically examined during an audit?

To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Which THREE of the following represent common challenges in maintaining an integrated GRC program?

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?