Courseiva

CCNA Compliance Maintenance Questions

48 questions · Compliance Maintenance · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

A.Failure to perform annual control testing as part of continuous monitoring.
B.The organization failed to report the breach to the US-CERT.
C.The system failed to undergo a full re-accreditation.
D.The System Security Plan (SSP) was not updated in the FISMA database.
AnswerA

Three-year-old Security Control Assessment results breach the annual assessment requirement under continuous monitoring, since federal systems must reassess controls at least yearly to maintain authorisation. The stale results mean the organisation cannot demonstrate ongoing control effectiveness, directly violating the mandated annual testing cadence that continuous monitoring demands.

Why this answer

Under FISMA and NIST SP 800-53 / SP 800-137 continuous monitoring guidance, security controls must be assessed at a frequency sufficient to support ongoing authorization — commonly at least annually for most controls. Assessment results that are three years old indicate the organization failed to perform the required recurring control testing that underpins continuous monitoring and ongoing authorization.

Exam trap

CGRC often tests the shift from legacy triennial re-accreditation to continuous monitoring — the trap is selecting 'full re-accreditation' because it sounds like the formal compliance action, when the actual violation is the failure to perform recurring control assessments.

How to eliminate wrong answers

Option B is wrong because the scenario describes stale assessment results, not an unreported security incident — there is no breach mentioned, so US-CERT reporting obligations are irrelevant. Option C is wrong because FISMA replaced the old triennial re-accreditation model with continuous monitoring and ongoing authorization; a 'full re-accreditation' is not the compliance requirement being violated here. Option D is wrong because the SSP update issue is a documentation/database concern, not the substantive failure to reassess controls that the question describes.

Practice this question →
2
MCQhard

A GRC analyst is evaluating the effectiveness of a continuous monitoring program for a system that has been operational for two years. The analyst notices that several security controls have not been assessed since the initial authorization. Which of the following is the MOST likely cause of this issue?

A.The security assessment report (SAR) from the initial authorization did not include those controls.
B.The continuous monitoring strategy does not define assessment frequencies for all controls.
C.The system owner has not allocated sufficient budget for continuous monitoring activities.
D.The authorizing official has not required reassessment of those controls.
AnswerB

If the continuous monitoring strategy lacks defined frequencies for each control, some controls may be overlooked. A robust strategy specifies how often each control should be assessed based on risk. Without this, assessments become inconsistent, leading to gaps. The analyst should review and update the strategy to include frequencies for all controls.

Why this answer

The most likely cause is that the continuous monitoring strategy does not define assessment frequencies for all controls. A comprehensive strategy specifies how often each control should be assessed, based on risk. Without these frequencies, some controls may not be reassessed after initial authorization.

This leads to gaps in monitoring and potential compliance issues. The GRC analyst should update the strategy to include clear frequencies for all controls and ensure they are followed.

Exam trap

The trap here is attributing the lack of reassessment to budget or AO direction, rather than the absence of defined frequencies in the monitoring strategy.

Practice this question →
3
MCQmedium

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

A.Domain controller event logs.
B.Firewall audit/management logs.
C.DHCP server logs.
D.Endpoint antivirus logs.
AnswerB

Firewall audit and management logs record configuration commits and administrative changes, so a SIEM parsing them detects the modification itself. Traffic or session logs only show packets traversing the device, which cannot reveal that the rulebase was altered, so they fail the stem's change-detection requirement.

Why this answer

Firewall configuration changes are recorded in the firewall's own audit and management logs, which capture administrative actions such as rule additions, deletions, modifications, and policy commits. To alert on configuration changes in a SIEM, the firewall audit/management log is the authoritative source because it directly records who changed what and when on the device itself. Other log sources do not contain firewall configuration change events.

Exam trap

CGRC often tests the distinction between traffic logs and audit/management logs—candidates must recognize that configuration-change monitoring requires the firewall's own audit/management log, not traffic, DHCP, or endpoint logs.

How to eliminate wrong answers

Option A is wrong because domain controller event logs record authentication, directory service, and account management activity—not firewall rule or policy changes. Option C is wrong because DHCP server logs record IP address leases and scope activity, which are unrelated to firewall configuration modifications. Option D is wrong because endpoint antivirus logs record malware detections, scan results, and endpoint security events, not firewall administrative changes.

Practice this question →
4
Multi-Selecthard

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Select 3 answers
A.Whether the change negatively impacts existing security controls.
B.The expected cost savings from the change.
C.The color scheme of the new user interface.
D.Whether additional testing or assessment is required.
E.Whether the system's risk rating will increase.
AnswersA, D, E

Security impact analysis must determine whether a proposed change degrades or bypasses controls already protecting the system. Assessing negative impact on existing controls directly satisfies the stem's requirement, exposing weakened safeguards, altered configurations or removed protections before the change is approved and implemented.

Why this answer

A security impact analysis (SIA) under NIST SP 800-37/800-30 examines how a proposed change affects the system's security posture, so option A is correct: you must determine whether the change degrades, bypasses, or otherwise negatively impacts existing security controls (e.g., firewalls, ACLs, encryption, auditing). Option D is correct because the SIA must identify whether the change introduces new weaknesses requiring additional testing or assessment, such as vulnerability scanning, penetration testing, or reauthorization activities, before the change is approved. Option E is correct because the analysis must determine whether the change alters the system's overall risk rating (likelihood and impact of threats exploiting vulnerabilities), which drives whether the change can proceed or needs mitigation.

Option B is not a security consideration — cost savings belong to a business or financial impact analysis, not the security impact analysis. Option C is irrelevant; user interface color scheme has no bearing on confidentiality, integrity, or availability controls.

Exam trap

CGRC often tests the boundary between security impact analysis and general change management, tempting candidates to include business or cosmetic factors like cost savings or UI color when only control impact, testing needs, and risk rating belong in the security analysis.

Practice this question →
5
MCQmedium

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

A.AWS Config Remediation Actions.
B.AWS CloudTrail Event Selectors.
C.AWS Config Aggregators.
D.AWS Config Conformance Packs.
AnswerA

AWS Config Remediation Actions pair a rule with an SSM Automation document, so non-compliant S3 buckets are corrected automatically without manual intervention. This directly satisfies the stem's requirement for automatic remediation, since Config continuously evaluates bucket ACLs and public access settings, then triggers the remediation action whenever a bucket is detected as public.

Why this answer

AWS Config Remediation Actions allow you to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. You can associate a remediation action with a Config rule that checks for private S3 buckets, so when a bucket is non-compliant, the remediation action automatically applies the necessary changes (e.g., setting the bucket ACL to private).

Exam trap

The trap is confusing Conformance Packs with Remediation Actions — candidates may think Conformance Packs perform remediation, but they are just containers; the actual remediation is done by Remediation Actions.

How to eliminate wrong answers

Option B is wrong because CloudTrail Event Selectors are used to log specific API calls, not to remediate resources. Option C is wrong because Config Aggregators collect compliance data across accounts and regions but do not perform remediation. Option D is wrong because Conformance Packs are collections of Config rules and remediation actions packaged together, but the feature that actually performs the remediation is Remediation Actions, not the pack itself.

Practice this question →
6
Multi-Selecthard

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

Select 3 answers
A.Running automated configuration compliance scans.
B.Interviewing the system users about their productivity.
C.Reviewing system and audit logs.
D.Asking the vendor if the product is secure.
E.Performing physical inspections of the server room.
AnswersA, C, E

Automated configuration compliance scans compare live settings against a hardened baseline, detecting drift such as disabled logging or weakened encryption. This directly verifies controls function as intended, satisfying continuous monitoring through repeatable, scheduled evidence collection rather than one-off manual review.

Why this answer

Option A is correct because automated configuration compliance scans (e.g., using SCAP, CIS-CAT, or Nessus audit policies) directly test whether systems still match the hardened baselines and control settings that were implemented, which is a core continuous-monitoring verification technique. Option C is correct because reviewing system and audit logs (e.g., Windows Event Log, syslog, SIEM correlation) provides evidence that controls such as access enforcement, logging, and intrusion detection are actually operating and generating expected events. Option E is correct because physical inspections of the server room verify that physical and environmental controls (badge access, locks, cameras, HVAC, fire suppression) are present and functioning, which is a legitimate continuous-monitoring activity for the physical domain.

Option B does not belong because user productivity interviews measure business performance, not the operational effectiveness of security controls. Option D does not belong because a vendor's assurance claim is not independent verification that the controls are functioning in the organization's own environment.

Exam trap

CGRC often tests the difference between objective verification evidence (scans, logs, inspections) and subjective or unverified inputs (user interviews, vendor assurances); candidates who pick the latter confuse assurance with assertion.

Practice this question →
7
MCQeasy

A system's continuous monitoring plan requires weekly vulnerability scans. The scans have been consistently showing the same findings for three months, and remediation efforts have been unsuccessful due to vendor delays. What should the GRC analyst do?

A.Escalate the issue to the authorizing official and document the vendor delays as a compensating control.
B.Perform a security impact analysis to determine if the unresolved vulnerabilities constitute a significant change to the system's risk posture.
C.Modify the continuous monitoring plan to remove the weekly scan requirement until the vendor provides a patch.
D.Accept the risk because the vulnerabilities have been present for three months without exploitation.
AnswerB

This is correct because persistent unresolved vulnerabilities may indicate a significant change in risk. A security impact analysis evaluates whether the system's security posture has degraded and if the ATO conditions are still met. This analysis informs decisions on risk acceptance, mitigation, or escalation.

Why this answer

The correct answer is to perform a security impact analysis. When remediation is delayed and findings persist, the system's risk profile may change. A security impact analysis determines if the unresolved vulnerabilities represent a significant change, which could affect the ATO.

This analysis provides a basis for decisions such as risk acceptance, additional controls, or escalation to the authorizing official.

Exam trap

The trap here is assuming that persistent findings can be ignored if not exploited or that monitoring requirements can be relaxed without proper analysis and approval.

Practice this question →
8
MCQeasy

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

A.To provide encrypted tunnels for administrative access.
B.To monitor network traffic for anomalous behavior.
C.To automate the assessment of security configurations against benchmarks.
D.To manage the lifecycle of cryptographic keys.
AnswerC

SCAP expresses benchmarks as machine-readable checklists, letting tools automatically compare system settings against them and report compliance. This directly satisfies continuous monitoring's need for repeatable, frequent configuration assessment without manual review, which is the protocol's primary function.

Why this answer

SCAP (Security Content Automation Protocol) is a NIST-maintained suite of specifications—including CVE, CCE, CPE, CVSS, XCCDF, OVAL, and SWID—that enables automated, standardized assessment of system configurations and vulnerabilities against established benchmarks such as the DISA STIGs or NIST SP 800-53 controls. In a continuous monitoring program (per NIST SP 800-137), SCAP-validated tools scan endpoints, compare findings to a target baseline, and produce machine-readable results that feed ongoing authorization decisions. This makes automated configuration/benchmark assessment its primary function.

Exam trap

CGRC often tests whether candidates confuse SCAP's configuration/vulnerability assessment automation with broader monitoring functions like IDS traffic analysis or key management, so the trap is selecting a plausible-sounding security tool purpose that SCAP does not actually perform.

How to eliminate wrong answers

Option A is wrong because encrypted administrative tunnels are provided by protocols such as SSH, IPsec, or TLS VPNs—SCAP has no cryptographic tunneling function. Option B is wrong because network traffic anomaly detection is the role of IDS/IPS or NDR tools (e.g., Snort, Zeek); SCAP assesses host and configuration state, not live traffic behavior. Option D is wrong because cryptographic key lifecycle management is handled by a KMS or HSM under frameworks like NIST SP 800-57, not by SCAP, which does not manage keys.

Practice this question →
9
MCQmedium

You are the GRC analyst for a system that has an approved Authorization to Operate (ATO). A new vulnerability is discovered in a component that is not part of the system's boundary but is used by the system's administrators. According to continuous monitoring principles, what should you do first?

A.Immediately revoke the ATO until the vulnerability is patched.
B.Report the vulnerability to the authorizing official and wait for further instructions.
C.Assess whether the vulnerability affects the system's security posture and determine if a security impact analysis is needed.
D.Update the system security plan (SSP) to include the component within the boundary.
AnswerC

This is correct because continuous monitoring requires evaluating changes and new threats to determine their potential impact on the system. Even if the component is outside the boundary, its use by administrators could introduce risk. A security impact analysis helps decide if the ATO remains valid or if remediation is necessary.

Why this answer

The correct answer is to assess the vulnerability's impact first. Continuous monitoring involves ongoing assessment of risks, including those from components used by administrators but outside the boundary. A security impact analysis determines whether the vulnerability affects the system's security posture and if the ATO needs adjustment.

This proactive step ensures informed decision-making before escalating or taking drastic actions.

Exam trap

The trap here is assuming that any vulnerability associated with administrators automatically requires immediate ATO revocation or boundary expansion, rather than first evaluating its actual impact on the system.

Practice this question →
10
MCQeasy

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

A.To automate the deployment of new software patches.
B.To document the approved security configuration of a system.
C.To identify all users with administrative privileges.
D.To serve as a temporary backup for system files.
AnswerB

A configuration baseline captures the approved, documented security settings a system must maintain, providing the reference against which actual configurations are compared during compliance audits. This satisfies the need to detect drift from sanctioned hardening standards.

Why this answer

A Configuration Baseline is the documented, approved security configuration of a system — the authoritative reference of how the system should be set up (OS hardening settings, service states, registry values, file permissions). It is the 'known good' state against which ongoing configurations are compared during audits and continuous monitoring, forming the foundation of CM-2 and CM-6 controls in NIST SP 800-53.

Exam trap

CGRC often tests the confusion between a baseline (the approved target configuration) and the tools or activities that enforce or deploy it (patching, backups, access reviews).

How to eliminate wrong answers

Option A is wrong because automating patch deployment is the role of a patch management or configuration management tool (SCCM, Ansible, WSUS), not the baseline itself — the baseline defines the target state, not the deployment mechanism. Option C is wrong because identifying users with administrative privileges is an access-review or account-management activity; while privileged accounts may be documented in a baseline, that is a subset, not the primary purpose. Option D is wrong because a baseline is a persistent, version-controlled specification, not a temporary backup — backups are for recovery, baselines are for compliance comparison.

Practice this question →
11
Multi-Selecthard

A GRC analyst is supporting a system that has been authorized to operate. The continuous monitoring program includes automated configuration scans, annual control assessments, and a plan of action and milestones (POA&M). During a quarterly review, the analyst finds that several POA&M items have exceeded their original completion dates. The system owner wants to know which actions are required to maintain compliance. (Choose two.)

Select 2 answers
A.Report the overdue items to the authorizing official and reassess the risk to determine if the authorization remains valid.
B.Immediately suspend the system's operations until all overdue POA&M items are resolved.
C.Document the delay and update the POA&M with revised milestones and risk mitigation strategies.
D.Wait until the next annual assessment to address the overdue items, as quarterly reviews are not part of the formal authorization process.
E.Remove the overdue items from the POA&M to avoid negative audit findings and maintain a clean compliance record.
AnswersA, C

The AO must be informed of overdue POA&M items because they may affect the risk decision. Reassessing the risk ensures the authorization remains valid. NIST SP 800-37 emphasizes ongoing communication with the AO regarding changes in risk. This action maintains compliance by ensuring the AO can make informed decisions.

Why this answer

Overdue POA&M items must be promptly documented with revised milestones and reported to the AO, along with a reassessment of risk. These actions keep the authorization package current and enable the AO to make informed risk decisions. Ignoring, deleting, or deferring the items undermines continuous monitoring and compliance.

Exam trap

The trap here is thinking that overdue POA&M items can be deferred to the next annual assessment or simply removed, when they actually require immediate documentation and AO notification.

Practice this question →
12
Multi-Selecthard

You are conducting a security impact analysis for a proposed change to a system that has an existing Authority to Operate (ATO). The change involves migrating the database to a new cloud service provider. Which TWO of the following factors are most critical to evaluate in this analysis? (Choose two.)

Select 2 answers
A.The cost difference between the old and new cloud service providers.
B.The migration timeline and project milestones.
C.The new provider's data encryption methods for data at rest and in transit.
D.The number of database administrators employed by the new provider.
E.The new cloud service provider's FedRAMP authorization status and the controls it inherits.
AnswersC, E

Data encryption is a critical security control that must be evaluated during a migration. The new provider's encryption methods must meet the same or stronger standards as the original environment to protect sensitive data. If encryption is weaker or not implemented correctly, it could lead to data exposure and non-compliance. The security impact analysis must verify that encryption controls are equivalent or better, ensuring the system's risk profile remains acceptable.

Why this answer

The most critical factors in a security impact analysis for a cloud migration are the new provider's FedRAMP authorization status and inherited controls, and the provider's encryption methods for data at rest and in transit. These directly affect the system's control baseline and data protection. Cost, staffing, and timeline are not security impact factors and do not determine whether the ATO remains valid.

Exam trap

The trap here is including business or operational factors like cost or timeline in a security impact analysis, when only factors affecting security controls and risk should be considered.

Practice this question →
13
MCQhard

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

A.Clear the file system using a standard OS format command.
B.Destroy the hard drive via shredding or incineration.
C.Overwrite the drive once with zeros.
D.Purge the data using a cryptographic erase (CE) method.
AnswerB

Shredding or incineration physically destroys the platter, so no residual magnetic state remains for laboratory recovery. This satisfies NIST SP 800-88's Purge/Destroy level for PII, exceeding cryptographic erase or degaussing where media reuse is not intended.

Why this answer

NIST SP 800-88 Rev. 1 defines three sanitization categories: Clear, Purge, and Destroy. Destroy—via shredding, incineration, disintegration, or melting—renders the media physically unusable so that data cannot be recovered even with laboratory techniques, which is the highest assurance level. For PII on a legacy drive being decommissioned, destruction is the appropriate method when the media will not be reused.

Exam trap

CGRC often tests the distinction between Clear, Purge, and Destroy levels, so the trap is selecting a Purge-level method (like CE) when the question explicitly demands resistance to laboratory-level recovery, which requires Destroy.

How to eliminate wrong answers

Option A is wrong because a standard OS format (Clear-level) only removes logical access to data and leaves recoverable remnants; it is explicitly insufficient for laboratory-level recovery resistance. Option C is wrong because a single zero overwrite is a Clear-level technique that may leave recoverable data in remapped sectors, bad blocks, or cache areas, and does not meet the Purge/Destroy bar. Option D is wrong because Cryptographic Erase (CE) is a Purge-level technique that is effective only when the data was encrypted with a known key and the key can be reliably destroyed; it does not guarantee laboratory-level irrecoverability if keys are escrowed or the encryption implementation is flawed, and it is not the Destroy category.

Practice this question →
14
Multi-Selectmedium

You are a GRC analyst responsible for continuous monitoring of a federal information system. The system has a current ATO and is in the operations and maintenance phase. Which TWO of the following activities are required to maintain the authorization according to NIST SP 800-37 Rev. 2? (Choose two.)

Select 2 answers
A.Reassess all security controls at the same frequency, regardless of their criticality.
B.Perform a full reauthorization every three years regardless of system changes.
C.Conduct ongoing security control assessments in accordance with the continuous monitoring strategy.
D.Update the system security plan (SSP) only when a major upgrade occurs.
E.Report the security status of the system to the authorizing official on an ongoing basis.
AnswersC, E

Ongoing security control assessments are a core component of continuous monitoring. They verify that controls remain effective over time and provide the authorizing official with the necessary data to maintain authorization. These assessments can be automated or manual and are defined in the continuous monitoring strategy. Without them, the authorizing official cannot rely on the system's security posture.

Why this answer

Maintaining an authorization in the operations and maintenance phase requires ongoing security control assessments and regular reporting to the authorizing official. These activities are part of the continuous monitoring strategy and enable ongoing authorization. They ensure that the authorizing official has current information to determine if the system's risk remains acceptable, allowing the ATO to remain valid without a full reauthorization.

Exam trap

The trap here is believing that a fixed reauthorization cycle (like every three years) is required, when NIST instead relies on continuous monitoring and ongoing authorization to maintain the ATO as long as risk remains acceptable.

Practice this question →
15
MCQhard

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

A.Document them in the System Security Plan (SSP) as 'accepted risks'.
B.Ignore them until the next major system upgrade.
C.Incorporate them into the POA&M and track remediation progress.
D.Submit a request to the AO to remove the conditions without changes.
AnswerC

Conditions attached to an ATO are unresolved weaknesses, so they belong on the Plan of Action and Milestones alongside open findings. Recording each condition with an owner, milestone date and status lets continuous monitoring evidence remediation progress and supports reauthorisation, satisfying the stem's requirement to manage conditions after authorisation.

Why this answer

An ATO with conditions means the Authorizing Official has accepted the system for operation but requires specific actions (e.g., additional controls, mitigations, or monitoring) to be completed. These conditions are documented as weaknesses and must be entered into the Plan of Action and Milestones (POA&M) so they are tracked, resourced, and remediated within agreed timeframes during continuous monitoring. The POA&M is the authoritative mechanism for managing outstanding risk items post-authorization.

Exam trap

The trap is treating conditions as 'accepted risks' (Option A) because both involve the AO acknowledging risk — but conditions are mandatory actions, not accepted residual risk, and the POA&M is the correct tracking vehicle.

How to eliminate wrong answers

Option A is wrong because documenting conditions as 'accepted risks' in the SSP misrepresents them — conditions are requirements the AO imposed, not risks the AO chose to accept without action; accepted risks are formally acknowledged and not scheduled for remediation. Option B is wrong because ignoring conditions until the next upgrade violates continuous monitoring requirements (NIST SP 800-137) and could result in suspension or revocation of the ATO. Option D is wrong because the AO will not remove conditions without evidence that the underlying issues are resolved; submitting a removal request without changes is premature and would be rejected.

Practice this question →
16
MCQmedium

As the GRC analyst, you are reviewing the continuous monitoring program for a financial system that processes transactions. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which of the following is the MOST appropriate action?

A.Escalate the decision to the system owner because the GRC analyst does not have authority to change monitoring frequency.
B.Deny the change outright because continuous monitoring requires weekly scanning for all systems.
C.Approve the change because monthly scanning meets the minimum requirement for continuous monitoring.
D.Conduct a risk assessment to determine if monthly scanning provides adequate coverage for the system's risk profile.
AnswerD

The GRC analyst should perform a risk assessment to evaluate whether monthly scanning adequately addresses the system's risk. Factors include data sensitivity, threat landscape, and regulatory requirements. If the risk is acceptable, the change can be approved with documentation. This aligns with NIST RMF and continuous monitoring principles.

Why this answer

The correct action is to conduct a risk assessment because continuous monitoring frequency must be based on the system's risk profile, not arbitrary cost savings. For a financial system, reducing scan frequency could increase risk if vulnerabilities remain undetected. A risk assessment ensures that any change is justified and documented, maintaining compliance with NIST and organizational policies.

Exam trap

The trap here is assuming that continuous monitoring frequency can be changed without a risk-based justification.

Practice this question →
17
MCQhard

A security engineer is using the NIST Risk Management Framework (RMF) to maintain compliance for a high-impact system. During continuous monitoring, the engineer discovers that a critical security control has been modified without a security impact analysis. Which of the following actions should the engineer take FIRST?

A.Immediately revert the control to its original configuration and document the change in the system security plan.
B.Notify the authorizing official and request a new authorization to operate (ATO) before taking any other action.
C.Conduct a security impact analysis to determine the effect of the change on the system's security posture.
D.Update the continuous monitoring strategy to include more frequent assessments of the modified control.
AnswerC

A security impact analysis is required whenever a change occurs that could affect security. It evaluates whether the change introduces new vulnerabilities, alters risk, or requires updates to controls. This analysis informs subsequent actions, such as reauthorization or control adjustments. It is the first step to ensure the change is properly evaluated before any remediation or acceptance.

Why this answer

The security impact analysis is a systematic process to determine how a change affects the security posture of a system. It is required by NIST SP 800-37 and must be performed before any other actions, as it informs whether the change can be accepted, what controls need updating, and whether reauthorization is necessary. It ensures that risk is properly managed and documented.

Exam trap

The trap here is assuming that any unauthorized change immediately requires reverting the control or notifying the authorizing official for a new ATO, when the first step is always to analyze the impact of the change.

Practice this question →
18
MCQhard

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner wants to use automated tools to collect and analyze security-related data. Which of the following should the analyst ensure is in place to support this automation?

A.A security automation and continuous monitoring (SACM) architecture.
B.An incident response plan that includes automated containment procedures.
C.A manual process for correlating data from multiple sources.
D.A configuration management plan that defines baseline configurations.
AnswerA

A SACM architecture provides the framework for automating data collection, analysis, and reporting. It defines the tools, protocols, and interfaces needed to integrate various security data sources. This enables efficient continuous monitoring. Without a SACM architecture, automation efforts may be fragmented and ineffective. The analyst should ensure this architecture is in place.

Why this answer

To support automated data collection and analysis in continuous monitoring, a SACM architecture is essential. It provides the standards, tools, and processes to automate the monitoring of security controls. This includes data feeds from sensors, scanners, and logs, as well as automated analysis and reporting.

Without such an architecture, automation would be ad hoc and difficult to manage. The GRC analyst should ensure this foundational element is in place.

Exam trap

The trap here is confusing configuration management or incident response with the specific architecture needed for automated continuous monitoring.

Practice this question →
19
MCQeasy

After a system receives an Authority to Operate (ATO), the organization must maintain compliance through continuous monitoring. Which of the following activities is a core component of a continuous monitoring program?

A.Performing penetration testing on an annual basis.
B.Updating the system security plan only when a major change occurs.
C.Conducting a full security control assessment every month.
D.Tracking and reporting the status of security controls on an ongoing basis.
AnswerD

Continuous monitoring requires ongoing tracking and reporting of security control status to ensure they remain effective. This includes automated data feeds, manual reviews, and periodic reporting to Authorizing Officials. It enables timely identification of control failures and risk changes. This is a core component because it provides situational awareness and supports risk-based decisions throughout the system's lifecycle, as described in NIST SP 800-137.

Why this answer

The core of continuous monitoring is the ongoing tracking and reporting of security control status. This ensures that controls remain effective and that any changes in risk are detected and addressed promptly. Full monthly assessments, annual penetration testing, and updating the SSP only for major changes do not fulfill the continuous, ongoing nature of a continuous monitoring program as defined in NIST SP 800-137.

Exam trap

The trap here is equating continuous monitoring with periodic point-in-time assessments like annual penetration testing or monthly full assessments, rather than ongoing tracking and reporting.

Practice this question →
20
MCQmedium

A federal system has received an authorization to operate (ATO) with a continuous monitoring strategy that requires monthly vulnerability scans and annual security assessments. Six months into the authorization, the system owner replaces the primary database server with a newer model running a different operating system version. The security control baseline remains the same. As the GRC analyst supporting the ongoing authorization, what is the MOST appropriate action to maintain compliance?

A.Do nothing because the security control baseline remains the same and the ATO is still valid until the next annual assessment.
B.Immediately revoke the ATO and require a full reauthorization from scratch because any hardware change invalidates the existing authorization.
C.Wait for the next scheduled annual assessment to report the change, since continuous monitoring already covers all modifications through monthly scans.
D.Treat the change as a significant change, reassess the affected controls, and update the security plan and authorization package before the next annual assessment.
AnswerD

Replacing the database server with a different OS version is a significant change that can affect the security posture and the validity of the ATO. NIST SP 800-37 requires reassessing affected controls and updating the security plan and authorization package. This proactive step ensures the AO's risk decision remains based on current information and preserves ongoing authorization.

Why this answer

A significant change, such as replacing a server with a different OS, must be assessed promptly to maintain the authorization. Updating the security plan and reassessing affected controls ensures the AO's risk decision remains valid. Deferring action or overreacting with a full reauthorization both miss the balanced, risk-based approach required by the RMF.

Exam trap

The trap here is assuming that an unchanged control baseline means no action is needed, when in fact implementation changes can affect control effectiveness and must be reassessed.

Practice this question →
21
Multi-Selectmedium

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Select 2 answers
A.The system is too new for security researchers to find bugs.
B.High risk of system instability during patch deployment.
C.Lack of modern API support for automated monitoring tools.
D.The system automatically updates its own firmware daily.
E.Too much disk space available for logging.
AnswersB, C

Legacy systems frequently lack vendor support, rollback capability or redundancy, so applying patches risks outages that continuous monitoring depends upon. This satisfies the stem's legacy constraint: unsupported hardware and tightly coupled applications make patch deployment itself a stability hazard, complicating the monitoring cycle.

Why this answer

Option B is correct because legacy systems often run outdated or unsupported OS and application versions where applying patches can break dependencies, cause downtime, or trigger instability, making continuous monitoring and remediation risky. Option C is correct because legacy environments frequently lack modern REST APIs, agents, or standardized telemetry interfaces (e.g., syslog, SNMP, WMI, or OpenTelemetry support), forcing manual or custom monitoring workarounds. Option A is incorrect because legacy systems are typically old and well-researched, so bugs are more likely to be known, not undiscovered.

Option D is incorrect because legacy systems rarely self-update firmware daily; automatic firmware updates are uncommon and would not represent a monitoring challenge. Option E is incorrect because abundant disk space for logs is not a challenge; insufficient storage or log retention limits would be the actual concern.

Exam trap

CGRC often tests the misconception that legacy systems are easier to monitor because they are stable or simple, when in reality their lack of modern interfaces and patch fragility create significant continuous monitoring hurdles.

Practice this question →
22
MCQeasy

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

A.Plan of Action and Milestones (POA&M).
B.System Security Plan (SSP).
C.Risk Assessment Report (RAR).
D.Authority to Operate (ATO).
AnswerA

The POA&M records identified weaknesses, remediation milestones and status, making it the vehicle for tracking security control changes arising from continuous monitoring. It satisfies the stem's requirement to manage control modifications, unlike authorisation packages or assessment reports, which capture point-in-time results rather than ongoing change tracking.

Why this answer

The Plan of Action and Milestones (POA&M) is the RMF artifact specifically designed to document, track, and manage identified security control weaknesses, including those discovered during continuous monitoring. It records each weakness, the planned remediation action, the responsible party, and the milestone dates for completion. The SSP describes the system and its controls, but the POA&M is the tracking document for changes and deficiencies.

Exam trap

CGRC often tests the confusion between the SSP (describes controls) and the POA&M (tracks weaknesses and remediation)—candidates must remember that the POA&M is the continuous monitoring tracking document for control changes and deficiencies.

How to eliminate wrong answers

Option B is wrong because the System Security Plan (SSP) is a descriptive document that details the system's boundary, environment, and implemented controls—it is not the primary tracking mechanism for control changes or weaknesses. Option C is wrong because the Risk Assessment Report (RAR) documents the results of a point-in-time risk assessment; it informs risk decisions but does not track ongoing control changes or remediation milestones. Option D is wrong because the Authority to Operate (ATO) is a formal authorization decision by an authorizing official; it is an outcome, not a tracking document for control changes.

Practice this question →
23
Multi-Selectmedium

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Select 2 answers
A.The vendor's hardware sales catalog.
B.System Security Plan (SSP).
C.Employee Handbook.
D.Configuration Baseline document.
E.Corporate financial statements.
AnswersB, D

The SSP describes the system's implemented controls and configuration. When a configuration changes during continuous monitoring, the SSP must be updated so its documented control implementation matches reality, satisfying the stem's requirement to revise documents affected by the change.

Why this answer

The System Security Plan (SSP) (B) must be updated because it documents the system's security controls, boundaries, and implementation details; a configuration change can alter how controls are implemented or described, so the SSP must reflect the current state to remain accurate for authorization and continuous monitoring. The Configuration Baseline document (D) must also be updated because it records the approved, documented settings and components of the system; when a configuration changes, the baseline must be revised to capture the new approved state so future comparisons and change detection remain valid. The vendor's hardware sales catalog (A) is a commercial marketing document unrelated to the system's security posture or configuration records.

The Employee Handbook (C) covers general HR policies and is not a system-specific security or configuration artifact. The Corporate financial statements (E) are accounting documents and have no bearing on system configuration management or continuous monitoring.

Exam trap

CGRC often tests which documents are part of the authorization package versus unrelated organizational documents — candidates may overlook the Configuration Baseline because it sounds operational, but it is a core RMF artifact that must stay synchronized with the SSP.

Practice this question →
24
MCQmedium

You are reviewing the continuous monitoring strategy for a system that processes Controlled Unclassified Information (CUI). The system owner proposes reducing the frequency of vulnerability scans from weekly to quarterly to save costs. As the GRC analyst, what is your primary consideration when evaluating this proposal?

A.The potential increase in risk exposure and whether it aligns with the organization's risk tolerance and compliance requirements.
B.The number of vulnerabilities identified in previous scans.
C.The cost savings achieved by reducing scan frequency.
D.The availability of automated tools to perform quarterly scans instead of weekly scans.
AnswerA

The frequency of vulnerability scanning should be based on risk, threat landscape, and compliance mandates. For systems handling CUI, NIST SP 800-171 and other frameworks may require specific scanning frequencies. Reducing from weekly to quarterly could significantly increase the window during which vulnerabilities remain undetected. The GRC analyst must assess whether the increased risk is acceptable and consistent with the organization's risk tolerance and any regulatory or contractual obligations.

Why this answer

The primary consideration when changing vulnerability scan frequency is the impact on risk exposure and whether that risk is acceptable given the organization's risk tolerance and compliance obligations. For CUI, frameworks like NIST SP 800-171 require regular scanning. Cost, tool availability, and historical vulnerability counts are secondary and cannot justify an increase in risk that violates requirements or exceeds tolerance.

Exam trap

The trap here is focusing on cost savings or past scan results instead of the risk-based and compliance-driven need for frequent scanning of CUI.

Practice this question →
25
MCQmedium

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

A.The Nessus scanner plugin needs an update to recognize the patch.
B.The scan policy is set to 'Discovery' instead of 'Audit'.
C.The scan agent was decommissioned prematurely.
D.The vulnerability scan was not performed after the patch was applied.
AnswerD

Tenable.io reports status from its own scan data, not the configuration management database. If no scan ran after the patch was deployed, the vulnerability remains 'open' in Tenable despite the CMDB marking it patched, explaining the mismatch between the two records.

Why this answer

Tenable.io reports vulnerability status based on the most recent scan data it has received. If a patch was applied but no scan was run afterward, the platform has no evidence of remediation and will continue to show the vulnerability as open. The configuration management database reflects the intended state (patch deployed), while the scanner reflects the observed state (last scan result) — the gap is simply the absence of a post-patch verification scan.

Exam trap

The trap here is assuming that updating the CMDB or applying the patch automatically updates the scanner's view; CGRC tests whether you understand that vulnerability status is evidence-based and requires a post-remediation scan to close.

How to eliminate wrong answers

Option A is wrong because a missing plugin update would typically cause the scanner to miss or misidentify a vulnerability, not to persistently report a known high-severity issue as open after a patch. Option B is wrong because a Discovery scan policy affects what hosts and ports are enumerated, not whether patch status is recognized; Audit policies are needed for compliance checks, but the symptom here is stale scan data, not policy type. Option C is wrong because a decommissioned agent would cause the asset to drop out of scanning entirely or show as un-scanned, not to report a specific vulnerability as still open.

Practice this question →
26
MCQhard

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

A.Delete the VM snapshot from the management console.
B.Revoke the access rights of the VM administrator.
C.Shut down the VM and wait for the provider to recycle the hardware.
D.Perform a cryptographic erase by deleting the associated encryption keys.
AnswerD

Cryptographic erasure destroys the keys protecting the VM's encrypted volumes, rendering residual ciphertext unrecoverable even if remnants persist on shared cloud storage. This final step satisfies data privacy regulations requiring data to be irrecoverable after deletion.

Why this answer

Cryptographic erase (crypto-shredding) destroys the encryption keys that protect the data, rendering the ciphertext permanently unrecoverable even if residual bits remain on shared cloud storage. In multi-tenant cloud environments, you cannot physically destroy the underlying media, so key destruction is the only reliable way to guarantee data is unrecoverable. This satisfies data privacy regulations that require demonstrable, irreversible disposal of personal data at decommissioning.

Exam trap

The trap is confusing logical deletion (removing a VM, snapshot, or access) with verifiable, irreversible data destruction — the exam tests whether you know that in cloud environments only key destruction guarantees unrecoverability.

How to eliminate wrong answers

Option A is wrong because deleting a VM snapshot removes a backup copy but does not render the primary data unrecoverable, and other replicas or cached blocks may persist. Option B is wrong because revoking administrator access is an access-control action, not data destruction — the data still exists and could be accessed by other privileged principals. Option C is wrong because shutting down a VM and waiting for hardware recycling provides no guarantee of timely or verifiable erasure, and in cloud environments the hardware is shared and not under your control.

Practice this question →
27
MCQeasy

A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the following should be the PRIMARY focus of the update?

A.Updating the contingency plan to reflect the new system components.
B.Reassessing the security controls to ensure they remain effective with the new boundary.
C.Notifying the authorizing official of the change and requesting a new ATO.
D.Documenting the new hardware and software components added to the system.
AnswerB

The primary focus should be reassessing security controls because a boundary change can introduce new risks or invalidate existing controls. The SSP must document the updated control implementation and any new controls. This ensures that the system remains compliant and secure. Reassessment is critical to maintain an accurate authorization boundary.

Why this answer

The primary focus of updating the SSP after a boundary change is to reassess security controls to ensure they remain effective. A boundary change can affect how controls are implemented and may require new controls. The SSP must reflect these changes accurately to maintain compliance and support ongoing authorization.

Other actions like notifying the AO or updating subordinate plans are important but secondary.

Exam trap

The trap here is assuming that updating the SSP is only about documenting new components, rather than reassessing control effectiveness.

Practice this question →
28
MCQmedium

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

A.Request an exemption from the CISO without providing documentation.
B.Ignore the vulnerability as it cannot be fixed.
C.Implement and document compensating controls.
D.Disconnect the server from the network permanently.
AnswerC

The legacy application's incompatibility prevents patching, so the residual risk must be addressed another way. Compensating controls—such as network segmentation, enhanced monitoring or virtual patching—reduce that risk to an acceptable level, and documenting them provides the audit evidence needed to justify the accepted deviation.

Why this answer

When a required patch cannot be applied due to compatibility issues with a critical legacy application, the correct compliance management action is to implement and document compensating controls. Compensating controls are alternative safeguards that provide equivalent or comparable protection to the original requirement, allowing the organization to manage the residual risk while maintaining compliance. This approach is endorsed by frameworks like NIST SP 800-53 and is a standard part of risk management.

Exam trap

CGRC often tests the confusion between compensating controls and risk acceptance; candidates may think that if a patch cannot be applied, the only option is to accept the risk, but compensating controls are the correct proactive measure.

How to eliminate wrong answers

Option A is wrong because requesting an exemption without documentation is not a proper compliance action; exemptions require justification, risk analysis, and formal approval. Option B is wrong because ignoring the vulnerability is never acceptable; it leaves the organization exposed and violates compliance requirements. Option D is wrong because disconnecting the server permanently is a drastic, business-impacting action that is not a proportionate or practical solution; compensating controls are preferred.

Practice this question →
29
Multi-Selecthard

A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which TWO factors should the analyst consider when evaluating this proposal? (Choose two.)

Select 2 answers
A.The current threat environment and recent vulnerability trends.
B.The availability of automated patching tools.
C.The criticality of the system and the sensitivity of the data it processes.
D.The number of users who access the system daily.
E.The cost savings achieved by reducing the scan frequency.
AnswersA, C

This is correct because the threat landscape and vulnerability trends directly affect the risk of exploitation. If new threats are emerging or vulnerabilities are being actively exploited, more frequent scanning may be necessary. Reducing frequency could leave the system exposed to known threats.

Why this answer

The correct answers are the criticality of the system and the sensitivity of the data it processes, and the current threat environment and recent vulnerability trends. For a high-impact system, monitoring frequency must be based on risk. System criticality and data sensitivity determine the potential impact of a compromise, while the threat environment and vulnerability trends indicate the likelihood of exploitation.

These factors together inform the appropriate frequency.

Exam trap

The trap here is focusing on cost savings or operational convenience rather than risk-based factors that truly determine monitoring frequency for a high-impact system.

Practice this question →
30
MCQeasy

A GRC analyst is reviewing the continuous monitoring results for a system that has been in operation for two years. The analyst notices that a security control for access control (AC-2) has been consistently failing automated checks for the past three months. The system owner argues that the control is not critical and wants to accept the risk. What is the most appropriate action for the analyst to take?

A.Modify the automated check to ignore the control failure and reduce false positives.
B.Document the risk acceptance in the system's risk register and continue monitoring without escalation.
C.Escalate the finding to the authorizing official for a risk-based decision, providing details of the control failure and potential impact.
D.Immediately disable the system until the access control issue is resolved.
AnswerC

Persistent control failures must be escalated to the authorizing official, who is responsible for accepting risk and determining if the ATO remains valid. The analyst's role is to report and provide analysis, not to unilaterally accept risk. This action ensures that the appropriate authority evaluates the impact on the system's security posture and decides on remediation or risk acceptance.

Why this answer

The most appropriate action is to escalate the persistent control failure to the authorizing official. This ensures that a risk-based decision is made by the proper authority, in line with continuous monitoring and RMF processes. The analyst should provide comprehensive details to support the decision, including the control's importance and the duration of the failure.

This maintains compliance and security.

Exam trap

The trap here is assuming that a system owner can accept risk for a failing security control without involvement of the authorizing official, or that the analyst can ignore the issue.

Practice this question →
31
MCQmedium

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

A./etc/hosts.allow
B./etc/shadow
C./etc/passwd
D./etc/ssh/sshd_config
AnswerD

The SSH daemon reads its runtime behaviour from /etc/ssh/sshd_config, where the PermitRootLogin directive controls whether root may authenticate. Auditing this file directly satisfies the requirement to verify that root login is disabled, since ssh_config governs only outbound client connections and cannot affect server-side authentication policy.

Why this answer

The SSH daemon's runtime behavior is controlled by /etc/ssh/sshd_config, which contains directives such as PermitRootLogin. To verify that root login over SSH is disallowed, you must inspect this file for the PermitRootLogin setting (typically set to 'no' or 'prohibit-password'). This is the authoritative configuration file for the SSH server.

Exam trap

CGRC often tests whether candidates know which Linux file governs which function — the trap is confusing account databases (/etc/passwd, /etc/shadow) or TCP wrapper access control (/etc/hosts.allow) with the SSH daemon's own configuration file.

How to eliminate wrong answers

Option A is wrong because /etc/hosts.allow controls TCP wrapper access rules for services, not SSH authentication policy such as root login. Option B is wrong because /etc/shadow stores hashed user passwords and aging information — it has no bearing on whether root can log in via SSH. Option C is wrong because /etc/passwd contains user account information (UID, GID, home directory, shell) but does not govern SSH login permissions for root.

Practice this question →
32
Multi-Selecthard

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Select 3 answers
A.Segmenting the system into a separate, isolated network zone.
B.Providing the system administrator with a larger office.
C.Implementing enhanced logging and monitoring of the affected component.
D.Installing a new air conditioning unit in the server room.
E.Requiring multi-factor authentication for all administrative access.
AnswersA, C, E

Network segmentation isolates the affected system into a separate zone, restricting lateral movement and exposure. This compensates where a required control cannot be implemented exactly, reducing risk through containment rather than the original control mechanism.

Why this answer

Compensating controls are alternative safeguards that provide equivalent risk reduction when the prescribed control cannot be implemented exactly as required. Option A is correct because isolating the system in a separate, segmented network zone (e.g., a VLAN or DMZ with restrictive firewall/ACL rules) reduces the attack surface and lateral-movement risk, compensating for a control that cannot be applied as specified. Option C is correct because enhanced logging and monitoring (e.g., forwarding audit logs to a SIEM, enabling verbose event auditing) provides detective coverage that offsets a missing or weakened preventive control.

Option E is correct because requiring multi-factor authentication for all administrative access adds a strong authentication factor, compensating for weaknesses such as inadequate password policy or missing privileged-access controls. Option B is not a security control at all—a larger office has no bearing on risk mitigation. Option D is a physical environmental control for availability (HVAC/cooling), not a compensating security control for the scenario described.

Exam trap

CGRC often tests the definition of compensating controls by including obviously irrelevant options (office size, air conditioning)—candidates must focus on whether the option provides an alternative security safeguard that addresses the same risk as the missing control.

Practice this question →
33
MCQmedium

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

A.Revert the control to match the SSP because the SSP is the authoritative document.
B.Initiate a security impact analysis to determine if the change is significant.
C.Update the SSP to reflect the actual implementation and document the change in the configuration management process.
D.Take no action because the control is still effective and the discrepancy is minor.
AnswerC

This is correct because the SSP must accurately describe the system's security controls. If the implementation is effective but differs from the documented description, the SSP should be updated to maintain accuracy. This ensures that future assessments and audits reflect the true state of the system.

Why this answer

The correct answer is to update the SSP to reflect the actual implementation. The SSP is a living document that must accurately describe the system's security controls. When an effective control is implemented differently than documented, the SSP should be revised to maintain consistency.

This ensures that continuous monitoring and future assessments are based on accurate information.

Exam trap

The trap here is assuming that any deviation from the SSP requires reverting the control or a formal security impact analysis, rather than simply updating documentation when the control remains effective.

Practice this question →
34
MCQmedium

A GRC officer is preparing for an annual assessment of a system's continuous monitoring program. The officer must ensure that the program's documentation reflects the current state of security controls. Which of the following artifacts is MOST important to review to verify that the continuous monitoring program is effectively tracking control changes?

A.The configuration management plan and change logs.
B.The plan of action and milestones (POA&M) and its status reports.
C.The system security plan (SSP) and its recent updates.
D.The continuous monitoring strategy and the associated metrics and reports.
AnswerD

The continuous monitoring strategy defines the approach, metrics, and reporting for tracking control effectiveness. Associated reports show actual data over time. Reviewing these artifacts directly verifies whether the program is effectively monitoring control changes. This aligns with NIST SP 800-137, which requires a documented strategy and ongoing reporting to support risk management.

Why this answer

The continuous monitoring strategy and its associated metrics and reports are the most important artifacts because they directly document how controls are monitored, what data is collected, and how that data is reported. This provides verifiable evidence that the program is actively tracking control changes and effectiveness, as required by NIST SP 800-137. Other documents support the program but do not replace the core monitoring artifacts.

Exam trap

The trap here is selecting a document that describes intended controls or tracks only weaknesses, rather than the actual ongoing monitoring data and strategy.

Practice this question →
35
MCQeasy

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner asks which document should be updated to reflect changes in the system's security posture resulting from continuous monitoring activities. What is the PRIMARY document that must be kept current?

A.The system security plan (SSP)
B.The privacy impact assessment (PIA)
C.The memorandum of understanding (MOU) with interconnected systems
D.The contingency plan
AnswerA

The SSP is the primary document that describes the system, its boundary, and how security controls are implemented. Continuous monitoring findings, such as new vulnerabilities or configuration changes, must be reflected in the SSP to keep it accurate. An outdated SSP undermines the authorization package and can lead to incorrect risk decisions by the AO.

Why this answer

The system security plan (SSP) is the foundational document that describes the system and its controls. Continuous monitoring results, such as new vulnerabilities or changes in control implementation, must be documented in the SSP to maintain an accurate authorization package. Other documents like the MOU, PIA, or contingency plan serve specific purposes but do not replace the SSP as the primary record of security posture.

Exam trap

The trap here is selecting a document that seems related to a specific aspect of security, such as the contingency plan or PIA, instead of the overarching SSP that captures all control implementations.

Practice this question →
36
Multi-Selectmedium

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Select 2 answers
A.The hardware manufacturer.
B.The local internet service provider.
C.The end-user of the application.
D.The cloud service provider (CSP).
E.The cloud customer.
AnswersD, E

Under the shared responsibility model the cloud service provider secures the underlying infrastructure it operates — physical facilities, hypervisors, host networking and managed service internals — while the customer owns their data, identities and configurations. Compliance maintenance is therefore split, with the CSP accountable for its layer.

Why this answer

Under the shared responsibility model, the cloud service provider (CSP) (D) is responsible for compliance of the cloud itself — the physical datacenters, hardware, hypervisor, and foundational services — while the cloud customer (E) is responsible for compliance in the cloud, including their data, configurations, access controls, and applications they deploy. These two parties split security and compliance duties based on the service model (IaaS, PaaS, SaaS), which is why both are the entities typically accountable. The hardware manufacturer (A) only supplies components and does not bear operational compliance responsibility once equipment is deployed in a CSP's datacenter.

The local internet service provider (B) merely transports connectivity and has no role in cloud compliance obligations. The end-user of the application (C) consumes services but is not a distinct compliance-responsible entity separate from the cloud customer organization.

Exam trap

The trap is including peripheral parties (hardware vendor, ISP, end-user) as compliance owners — the exam expects you to recognize only the CSP and the cloud customer as the two responsible entities.

Practice this question →
37
MCQmedium

You are the GRC lead for a U.S. federal agency. A system has an Authorization to Operate (ATO) that expires in 90 days. The system owner submits a revised System Security Plan (SSP) and a new security assessment report showing all controls are still effective, but no changes have been made to the system since the last authorization. According to NIST SP 800-37 Rev. 2, what is the most appropriate action to maintain the authorization?

A.Update the authorization package with the new SSP and assessment results, and continue ongoing authorization without a new authorization decision.
B.Allow the ATO to expire and operate the system under an interim authority to test (IATT) until a new authorization can be completed.
C.Request a waiver from the authorizing official to extend the ATO indefinitely without any further monitoring or documentation.
D.Initiate a full reauthorization process, including a new security assessment of all controls and a new authorization decision.
AnswerA

Under ongoing authorization, the authorizing official relies on continuous monitoring data to maintain the authorization. When there are no significant changes and controls remain effective, updating the package and continuing ongoing authorization is appropriate. This avoids unnecessary reauthorization while ensuring the authorization remains valid through continuous oversight.

Why this answer

Ongoing authorization allows a system to maintain its ATO through continuous monitoring rather than periodic reauthorization. When no significant changes have occurred and controls are assessed as effective, the authorizing official can continue the authorization based on updated documentation. This approach is risk-based and avoids unnecessary reassessment while ensuring the system remains compliant.

Exam trap

The trap here is assuming that an expiring ATO always requires a full reauthorization, when ongoing authorization can maintain the ATO if continuous monitoring shows controls remain effective and no significant changes occurred.

Practice this question →
38
MCQhard

A GRC analyst is supporting the ongoing authorization of a system that has been designated as high-impact. The authorizing official has requested evidence that the continuous monitoring program is providing adequate visibility into the system's security posture. Which of the following activities BEST demonstrates that the program is effectively supporting ongoing authorization?

A.Documenting the continuous monitoring strategy in the system security plan and obtaining approval from the authorizing official.
B.Conducting an annual security control assessment and providing the results to the authorizing official.
C.Submitting a quarterly report that summarizes all security incidents and their resolutions.
D.Providing the authorizing official with a dashboard that displays real-time status of key security controls and automated alerts for anomalies.
AnswerD

A real-time dashboard with automated alerts directly demonstrates continuous visibility into the security posture. This enables the authorizing official to make timely, risk-based decisions and supports the concept of ongoing authorization. It aligns with NIST SP 800-137's emphasis on automation and near-real-time monitoring to maintain an acceptable risk level.

Why this answer

Providing a real-time dashboard with automated alerts best demonstrates continuous visibility into the security posture. This allows the authorizing official to monitor control effectiveness and respond to anomalies promptly, which is essential for ongoing authorization. It exemplifies the automation and near-real-time data expected in a mature continuous monitoring program under NIST SP 800-137, supporting timely risk decisions.

Exam trap

The trap here is equating periodic reports or documentation with continuous visibility, when ongoing authorization requires real-time or near-real-time monitoring data.

Practice this question →
39
MCQeasy

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

A.Immediately decommission the system.
B.Update the System Security Plan (SSP) and submit for re-certification.
C.Wait until the annual assessment cycle to review the change.
D.Perform a security impact analysis on the change.
AnswerD

NIST SP 800-37 R2 continuous monitoring requires that significant changes be assessed before authorisation continues. A security impact analysis determines whether the software update alters the system's risk posture, controls, or authorisation boundary, informing whether reauthorisation or control updates are needed.

Why this answer

Per NIST SP 800-37 R2, when a significant change occurs during ongoing authorization, the first step is to perform a security impact analysis to determine the extent of the change's effect on the security posture. This analysis informs whether the change is within the already-authorized boundary or requires reauthorization. It is a risk-based approach that ensures the Authorizing Official has the necessary information before deciding on further actions.

Exam trap

CGRC often tests the sequence of continuous monitoring activities — candidates incorrectly jump to documentation updates or reauthorization without first performing the required security impact analysis to inform the decision.

How to eliminate wrong answers

Option A is wrong because immediately decommissioning the system is an extreme overreaction; the change may be benign or mitigable. Option B is wrong because updating the SSP and submitting for re-certification may be necessary, but only after the impact analysis determines the change is significant enough to warrant it; doing so immediately without analysis is premature. Option C is wrong because waiting until the annual assessment cycle ignores the continuous monitoring requirement to assess significant changes as they occur, potentially leaving the system in an unauthorized state.

Practice this question →
40
MCQmedium

A federal information system has an approved Authority to Operate (ATO) with an expiration date of 18 months from now. The system owner asks you, the GRC analyst, what triggers a reauthorization before that date. Which of the following events most clearly requires a reauthorization decision by the Authorizing Official?

A.A minor firmware update to a network switch that does not affect any security controls.
B.A quarterly review of audit logs that shows no anomalies or security incidents.
C.A change in the system's boundary that adds a new interconnection with an external partner system.
D.An annual security awareness training completion report for all system users.
AnswerC

Adding a new interconnection expands the system boundary and introduces new risks that were not assessed in the original authorization. NIST SP 800-37 requires that significant changes, including boundary changes and new interconnections, be assessed through a security impact analysis. If the change is significant, the Authorizing Official must decide whether to reauthorize. This event clearly alters the risk profile and requires a reauthorization decision.

Why this answer

A new interconnection with an external partner system expands the authorization boundary and introduces additional risk that was not evaluated in the original ATO. Under NIST SP 800-37, significant changes such as boundary modifications require a security impact analysis and a reauthorization decision by the Authorizing Official. Routine operational activities like log reviews, training, and minor firmware updates do not meet the threshold for reauthorization.

Exam trap

The trap here is assuming that any change, including routine maintenance or training, requires reauthorization, when only significant changes affecting the security posture do.

Practice this question →
41
MCQhard

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

A.Daily vulnerability scanning of the production environment.
B.Automated security regression testing in the CI/CD pipeline.
C.Annual penetration testing of the application.
D.Manual sign-off by the CISO before every code commit.
AnswerB

Automated security regression testing in the CI/CD pipeline re-verifies controls after each release, satisfying the need to keep the baseline effective despite frequent DevOps changes. It detects control drift continuously rather than at periodic authorisation reviews.

Why this answer

In a Continuous Authorization model (aligned with NIST SP 800-37 Rev. 2 and the DoD's cATO guidance), automated security regression testing in the CI/CD pipeline is critical because it verifies on every build that previously validated security controls remain effective despite frequent code changes. This provides the continuous, automated evidence needed to maintain the authorization baseline without re-authorizing from scratch with each release.

Exam trap

CGRC often tests the difference between detection controls (scanning, pen testing) and verification of control effectiveness, so the trap is choosing frequent scanning or annual pen testing as the mechanism that maintains the baseline under rapid change.

How to eliminate wrong answers

Option A is wrong because daily vulnerability scanning detects known vulnerabilities but does not verify that security controls (e.g., authentication, input validation, encryption) still function correctly after code changes—it is a detection control, not a regression assurance mechanism. Option C is wrong because annual penetration testing is far too infrequent to keep pace with frequent DevOps releases and provides only a point-in-time snapshot. Option D is wrong because manual CISO sign-off on every commit is neither scalable nor a security control verification—it creates a bottleneck and does not test whether controls remain effective.

Practice this question →
42
MCQhard

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

A.The availability of security personnel to perform the tests.
B.The vendor's recommendation for maintenance windows.
C.The criticality of the system and the level of change in the environment.
D.The total number of users accessing the system.
AnswerC

System criticality and environmental change rate directly determine monitoring cadence under NIST continuous monitoring guidance, since high-impact systems with frequent configuration or threat changes require shorter assessment intervals. This satisfies the stem's high-impact constraint by scaling frequency to risk rather than applying a fixed schedule.

Why this answer

NIST SP 800-137 (Information Security Continuous Monitoring) and SP 800-53 CA-7 tie assessment frequency to risk-based factors: the impact level of the system and the rate/volatility of change in the environment. A high-impact system with frequent changes (new code, config drift, new threats) warrants more frequent assessments than a stable low-impact system. This ensures monitoring resources are allocated proportionally to risk rather than to convenience or vendor schedules.

Exam trap

CGRC often tests the distinction between risk-based drivers (system criticality, change rate) and operational conveniences (staffing, vendor windows, user count) — candidates incorrectly pick the most 'practical' answer instead of the NIST-mandated risk-based one.

How to eliminate wrong answers

Option A is wrong because staffing availability is an operational constraint, not a risk-based driver — NIST explicitly warns against letting resource limitations dictate monitoring frequency. Option B is wrong because vendor maintenance windows are a scheduling convenience, not a risk factor; NIST guidance is agnostic to vendor preferences. Option D is wrong because user count alone does not determine impact or change rate — a system with many users but static configuration and low data sensitivity may need less frequent assessment than a small system processing high-value transactions.

Practice this question →
43
Multi-Selectmedium

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Select 2 answers
A.A complete physical audit of all hardware every week.
B.Requiring all users to change passwords daily.
C.Outsourcing all security monitoring to a third party.
D.A formal process for tracking and remediating vulnerabilities.
E.Automated security configuration assessment tools.
AnswersD, E

Continuous monitoring demands a closed-loop mechanism: detection alone leaves risk unaddressed. A formal vulnerability tracking and remediation process supplies the response capability, ensuring identified weaknesses are logged, assigned, and resolved within defined timeframes, which satisfies the program's requirement for ongoing risk reduction rather than periodic snapshot assessment.

Why this answer

Option D is correct because an effective continuous monitoring program requires a formal, repeatable process for tracking identified vulnerabilities and ensuring they are remediated in a timely manner, which is central to maintaining an ongoing risk posture. Option E is correct because automated security configuration assessment tools (e.g., SCAP-validated scanners, CIS-CAT, or Nessus-type configuration audits) provide the continuous, repeatable visibility into system hardening and configuration drift that manual reviews cannot sustain. Option A is not essential because a weekly complete physical audit of all hardware is operationally impractical and does not address logical/configuration monitoring.

Option B is not essential because forcing daily password changes is a poor practice that increases help-desk load and weakens password quality, and it is not a monitoring control. Option C is not essential because outsourcing all monitoring to a third party removes organizational visibility and accountability; continuous monitoring can be performed internally or in hybrid models.

Exam trap

CGRC often tests the misconception that continuous monitoring is purely technical or can be fully outsourced — candidates must recognize that formal processes and organizational oversight are essential, not just tools or third-party contracts.

Practice this question →
44
MCQmedium

A financial services firm operates a system processing customer credit data under an active Authority to Operate (ATO). A quarterly review shows that a recent operating system upgrade altered the configuration of the audit logging service, causing it to stop forwarding events to the central log server. The GRC analyst must determine the correct action to maintain the system's security posture and ATO validity. What should the analyst do FIRST?

A.Initiate a security impact analysis to evaluate the change and determine if the ATO conditions are affected.
B.Update the system security plan to reflect the new configuration and continue operations without further assessment.
C.Immediately revoke the ATO until the logging service is fully restored and verified.
D.Schedule a full security control assessment (SCA) for the next annual review cycle.
AnswerA

A security impact analysis is the prescribed first step when a configuration change potentially affects security controls. Here, the logging service failure could undermine audit and accountability controls, so the analyst must assess the impact before deciding on remediation or reauthorization. This aligns with continuous monitoring and change management requirements under NIST SP 800-37 and maintains the ATO's validity.

Why this answer

A security impact analysis is the correct first step because it systematically evaluates how the configuration change affects the system's security controls and whether the existing ATO remains valid. It ensures that any remediation or reauthorization is based on a documented risk assessment, as required by NIST SP 800-37 and continuous monitoring guidance. This approach balances operational needs with compliance obligations.

Exam trap

The trap here is assuming that any change automatically invalidates the ATO or requires immediate revocation, rather than first performing a security impact analysis to determine the actual risk.

Practice this question →
45
MCQhard

During continuous monitoring, you discover that a security control that was previously assessed as effective is now failing because the responsible team stopped performing the control due to staff turnover. The control is critical for protecting sensitive data. What is the most appropriate immediate action for the GRC analyst to take?

A.Update the system security plan to remove the control and document that it is no longer required.
B.Document the failure in the POA&M and wait for the next scheduled assessment to verify if the control is still failing.
C.Revoke the system's Authority to Operate (ATO) until the control is restored and reassessed.
D.Immediately notify the system owner and ISSO, and initiate a security impact analysis to determine the risk and required remediation.
AnswerD

When a critical control fails, the GRC analyst must ensure the system owner and ISSO are informed so they can assess the risk and take action. A security impact analysis determines the severity and potential impact on the system's authorization. This aligns with continuous monitoring and incident response processes. Immediate notification enables rapid remediation and informed decision-making by the Authorizing Official if the risk is significant.

Why this answer

A failing critical control requires immediate escalation to the system owner and ISSO, followed by a security impact analysis to assess the risk and determine remediation. This ensures timely action and informed decision-making. Waiting, revoking the ATO unilaterally, or removing the control from the SSP are inappropriate because they either delay risk mitigation or bypass proper governance processes.

Exam trap

The trap here is thinking that documenting the failure in a POA&M is sufficient, when immediate notification and risk analysis are required for critical control failures.

Practice this question →
46
MCQmedium

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

A.Configuration Items (CIs).
B.Application Catalog.
C.Client Health Reports.
D.Software Metering.
AnswerA

Configuration Items define the registry key settings to detect and remediate, then deploy them through a baseline to every workstation. This directly satisfies the requirement to verify specific registry keys across all workstations, since CIs are the compliance-rule building block MECM evaluates.

Why this answer

In Microsoft Endpoint Configuration Manager, Configuration Items (CIs) define the settings and rules you want to evaluate — such as specific registry key values — and are paired with Configuration Baselines to assess compliance across collections of workstations. This is the native compliance settings feature designed exactly for verifying registry, file, and script-based configuration state.

Exam trap

CGRC often tests whether candidates can distinguish MECM features by purpose — the trap is confusing client health monitoring or software metering with configuration compliance, when only Configuration Items/Baselines actually evaluate desired-state settings like registry keys.

How to eliminate wrong answers

Option B is wrong because the Application Catalog is a user-facing portal for requesting and installing software, not a compliance assessment mechanism. Option C is wrong because Client Health Reports show whether the MECM client is functioning (checking in, evaluating policies) — they report on client agent health, not on whether registry keys meet a desired configuration. Option D is wrong because Software Metering tracks application usage to inform licensing, not configuration compliance against a desired state.

Practice this question →
47
MCQeasy

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

A.Sanitize the storage media according to an approved standard.
B.Update the asset inventory list.
C.Remove the BIOS password.
D.Format the primary operating system partition.
E.Deactivate the user accounts associated with the system.
AnswerA

Sanitisation removes or destroys residual data on the storage media using an approved method such as cryptographic erase or degaussing, ensuring sensitive information cannot be recovered after the hardware leaves the organisation's control. This satisfies the stem's constraint of protecting stored sensitive data before disposal, which no other decommissioning step addresses.

Why this answer

Before any IT asset holding sensitive information leaves organizational control, the storage media must be sanitized using an approved standard (e.g., NIST SP 800-88 Rev. 1 purge or clear, or physical destruction) to prevent data remanence and unauthorized disclosure. This is the control that directly addresses the confidentiality risk of disposal; all other steps are administrative or operational and do not protect the data itself.

Exam trap

CGRC often tests the misconception that formatting or deleting files removes data — candidates pick the familiar OS-level action instead of the standards-based sanitization control that actually addresses remanence.

How to eliminate wrong answers

Option B is wrong because updating the asset inventory is an administrative record-keeping step that does not prevent data exposure if the media still contains recoverable information. Option C is wrong because removing a BIOS password does not erase data on the disk and is irrelevant to confidentiality of stored information. Option D is wrong because formatting the OS partition is a 'clear' operation at best and leaves recoverable data in slack space, unallocated clusters, and other partitions; it does not meet NIST SP 800-88 sanitization requirements for sensitive data.

Option E is wrong because deactivating user accounts addresses logical access, not the physical media, and does nothing to protect data on a disk being disposed of.

Practice this question →
48
MCQeasy

Which of the following activities is a core component of the 'Ongoing Authorization' process?

A.Periodically reviewing security assessment results.
B.Performing a full system re-installation annually.
C.Changing the system administrator's password every month.
D.Increasing the budget for information security.
AnswerA

Ongoing authorization requires continuous monitoring, so periodically reviewing security assessment results confirms controls remain effective after the initial authority to operate. This recurring review satisfies the continuous-monitoring constraint rather than relying on a one-off assessment.

Why this answer

Ongoing Authorization (formerly Continuous Monitoring under RMF) requires the Authorizing Official to maintain situational awareness of the system's security posture after the initial ATO. Periodically reviewing security assessment results — including updated SCA scans, POA&M status, and control assessment findings — is a core activity that feeds the ongoing authorization decision. This review ensures the AO can determine whether the system's risk level remains acceptable or whether reauthorization or remediation is needed.

Exam trap

CGRC often tests the distinction between routine operational security tasks (password changes, patching) and the formal RMF process steps (Ongoing Authorization), causing candidates to pick a control activity instead of the process-level review.

How to eliminate wrong answers

Option B is wrong because full system re-installation is an operational recovery or refresh activity, not part of the ongoing authorization process; reauthorization does not require reinstalling the system. Option C is wrong because changing an administrator password is a routine account management control (IA-5) that supports security but is not itself a core ongoing authorization activity — it is one small operational task, not a process-level review. Option D is wrong because increasing the security budget is a resource/budgeting decision, not a component of the ongoing authorization process defined in NIST SP 800-37.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Compliance Maintenance questions.

Start 20-question session