Knowledge + Practice

CCNA Control Selection Questions

46 questions · Control Selection · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

You are selecting controls for a system that must comply with both NIST SP 800-53 and the Payment Card Industry Data Security Standard (PCI DSS). The system processes credit card transactions. You have identified overlapping controls, but some PCI DSS requirements are more prescriptive than the NIST controls. What is the most effective approach to reconcile these differences during control selection?

A.Create a custom control set that combines the lowest common denominator of both standards to reduce implementation effort.

B.Implement only the PCI DSS controls, as they are more prescriptive and will automatically satisfy NIST requirements.

C.Implement the NIST controls as the primary baseline and add PCI DSS-specific controls as overlays to meet the stricter requirements.

D.Map each PCI DSS requirement to the corresponding NIST control and implement the NIST control as written, ignoring the stricter PCI DSS details.

AnswerC

Using NIST as the primary baseline and adding PCI DSS-specific controls as an overlay allows you to leverage the comprehensive NIST framework while addressing PCI DSS's more prescriptive requirements. This approach avoids duplication and ensures compliance with both. Overlays are designed for such scenarios, enabling the addition of controls to meet specific mandates.

Why this answer

The most effective approach is to use NIST SP 800-53 as the primary baseline and add PCI DSS-specific controls as an overlay. This leverages the comprehensive NIST framework and addresses PCI DSS's stricter requirements without duplication. It ensures compliance with both standards and maintains a structured, defensible control set.

Exam trap

The trap here is assuming that one standard completely covers the other, rather than recognizing the need to augment the baseline with an overlay for stricter requirements.

Practice this question →

2

MCQhard

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

A.Individual systems must override the common control.

B.Common controls cannot be used for password complexity.

C.Individual systems must report their own password status.

D.Individual systems do not need to address password complexity.

AnswerD

A common control is implemented once and inherited by multiple systems, so individual systems inherit password complexity rather than reimplementing it. This satisfies the audit finding by avoiding duplicate controls across systems covered by the common control.

Why this answer

A 'common control' is a control that is implemented once and inherited by multiple systems. If the organization has documented a common control for password complexity, individual systems do not need to address password complexity separately because they inherit the control from the common control provider. This avoids duplication and ensures consistency.

Exam trap

The trap is thinking that individual systems must still address the control or override it, when in fact common controls are inherited and do not require duplication.

How to eliminate wrong answers

Option A is wrong because individual systems do not override common controls; they inherit them. Overriding would defeat the purpose of a common control. Option B is wrong because common controls can absolutely be used for password complexity; in fact, it's a typical example of a common control.

Option C is wrong because individual systems do not need to report their own password status if they inherit the common control; the common control provider is responsible for reporting.

Practice this question →

3

MCQmedium

You are a security architect selecting controls for a new federal payroll system categorized as MODERATE impact. The system will be hosted in a government-operated data center. Your organization has already implemented a robust physical security program at the facility, including 24/7 guards, biometric access, and CCTV monitoring. You must select the most appropriate control for physical access authorization. Which action best aligns with NIST SP 800-53 control selection and tailoring guidance?

A.Implement a new, system-specific physical access control system for the payroll system's server room, duplicating the facility's existing controls.

B.Mark the physical access authorization control as 'Not Applicable' because the facility already has physical security, and no further action is needed.

C.Select a different control from the PE family that is easier to implement, such as monitoring physical access, and omit the access authorization control.

D.Document the facility's physical access controls as a common control inherited by the payroll system and focus on verifying their adequacy.

AnswerD

This approach correctly applies the concept of common controls, which are controls implemented at the organizational level and inherited by multiple systems. By documenting the existing physical controls as common and verifying their adequacy, you avoid duplication and ensure the payroll system meets the physical access authorization requirement through inheritance.

Why this answer

The correct approach is to leverage the existing facility physical security as a common control. This aligns with NIST SP 800-53 tailoring guidance, which encourages the use of common controls to reduce redundancy and ensure consistent protection. Documenting the control as inherited and verifying its adequacy satisfies the requirement without unnecessary duplication.

Exam trap

The trap here is assuming that a system-specific implementation is always required, rather than recognizing that common controls can be inherited and documented.

Practice this question →

4

MCQhard

You are a risk practitioner for a healthcare organization. You are selecting controls for a system that processes electronic protected health information (ePHI). You need to ensure compliance with the HIPAA Security Rule while using NIST SP 800-53 as a framework. What is the most effective approach?

A.Use the NIST SP 800-53 MODERATE baseline as-is, because it is more stringent than HIPAA.

B.Create a custom overlay that maps HIPAA Security Rule requirements to NIST SP 800-53 controls and apply it to the baseline.

C.Select only the controls that are explicitly mentioned in the HIPAA Security Rule and ignore the rest of the NIST baseline.

D.Use the NIST SP 800-53 LOW baseline and add controls as needed based on a risk assessment.

AnswerB

An overlay allows you to incorporate HIPAA-specific requirements into the NIST SP 800-53 baseline. By mapping HIPAA controls to NIST controls, you ensure that all necessary safeguards are included while leveraging the structured NIST framework. This is the most effective approach for achieving compliance.

Why this answer

The most effective approach is to create an overlay that maps HIPAA Security Rule requirements to NIST SP 800-53 controls and apply it to an appropriate baseline. This ensures that all HIPAA-specific mandates are addressed while leveraging the comprehensive NIST framework for a risk-based, structured control set.

Exam trap

The trap here is assuming that a NIST baseline alone will automatically satisfy HIPAA, or that using only HIPAA controls is sufficient, rather than integrating both through an overlay.

Practice this question →

5

MCQhard

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

A.Replace a control with a vendor-provided security feature.

B.Add additional controls to the baseline to address specific threat vectors.

C.Remove controls from the baseline that are technically infeasible.

D.Adjust the parameters of existing controls to lower operational impact.

AnswerB

Supplementing adds controls beyond the NIST SP 800-53 Rev. 5 baseline when the organisation's specific threat environment, mission, or technologies demand extra protection. Adding controls to counter identified threat vectors satisfies the authorization official's tailoring request, distinguishing supplementing from scoping or compensating control selection.

Why this answer

In NIST SP 800-53 Rev. 5 tailoring, 'supplementing' means adding controls to the baseline to address specific threats, technologies, or organizational requirements not covered by the initial baseline. The authorization official's request to supplement therefore means adding additional controls (B).

Exam trap

CGRC often tests the vocabulary of the RMF tailoring process — candidates confuse supplementing (adding) with scoping (removing) or parameterization (adjusting), so reading the definition precisely is critical.

How to eliminate wrong answers

Option A is wrong because replacing a control with a vendor feature is a form of compensating control or substitution, not supplementing. Option C is wrong because removing controls from the baseline is 'scoping' or 'tailoring out' (justified removal), not supplementing. Option D is wrong because adjusting control parameters (e.g., frequency, strength) is 'parameterization' or 'compensating control adjustment', not supplementing.

Practice this question →

6

MCQeasy

You are a security analyst at a hospital that must comply with HIPAA and NIST SP 800-53. You are selecting controls for a new patient portal. Your manager asks you to reduce unnecessary duplication by identifying controls that are already provided by the hospital's centralized identity management system. Which type of control should you document for the portal's authentication requirements?

A.Compensating control

B.Common control

C.Hybrid control

D.System-specific control

AnswerB

A common control is implemented once and inherited by multiple systems. The centralized identity management system provides authentication for the portal along with other systems, so documenting it as a common control correctly captures that the portal inherits this capability. This avoids redundant implementation and assessment, and aligns with NIST SP 800-53 guidance on common controls and inheritance.

Why this answer

The centralized identity management system provides authentication for the patient portal and other systems, so the portal inherits this capability. Documenting it as a common control accurately reflects that one implementation serves multiple systems, reduces duplication, and clarifies responsibility. This aligns with NIST SP 800-53 guidance on common controls, which are managed by a common provider and inherited by consuming systems.

Exam trap

The trap here is assuming that any shared service must be documented as a system-specific control simply because the portal relies on it, rather than recognizing it as a common control inherited by multiple systems.

Practice this question →

7

MCQmedium

You are a security architect for a federal agency. You are selecting controls for a new high-impact system that processes sensitive personnel data. During the initial selection process, you determine that a specific NIST SP 800-53 control is not applicable because the system does not use wireless networking. According to NIST guidance, what is the most appropriate action?

A.Replace the control with a compensating control from a different family to maintain the baseline count.

B.Document the control as not applicable in the system security plan and provide a rationale for its exclusion.

C.Remove the control from the baseline without any documentation because it is not relevant to the system.

D.Implement the control anyway to avoid any potential compliance issues.

AnswerB

When a control is deemed not applicable, NIST SP 800-53 requires documenting the decision in the system security plan (SSP) along with a justification. This ensures transparency and supports the risk management process. Simply removing the control without documentation would violate the requirement to maintain an accurate control baseline and could lead to gaps in the authorization package. Therefore, this is the correct action.

Why this answer

When a control is not applicable, the correct action is to document the decision and rationale in the system security plan. This maintains an accurate record for the authorization process and ensures that the tailoring decision is transparent. Removing without documentation, implementing unnecessarily, or replacing with a different control are not consistent with NIST SP 800-53 tailoring guidance.

Exam trap

The trap here is assuming that a not-applicable control can simply be removed without any formal documentation in the security plan.

Practice this question →

8

MCQmedium

A security architect is selecting controls for a system that will be deployed in a virtualized environment. The architect notes that many controls in the NIST SP 800-53 baseline assume physical separation. Which tailoring action is most appropriate to address this?

A.Remove all controls that reference physical separation as they are not applicable.

B.Replace physical separation controls with logical separation controls that provide equivalent protection.

C.Implement the physical separation controls as written, even if they are not feasible.

D.Mark the controls as not applicable and document the justification.

AnswerB

In virtualized environments, logical separation (e.g., hypervisor-based isolation, VLANs) can provide equivalent protection to physical separation. Tailoring allows for such substitutions when justified by risk assessment. This ensures that the security objective is met without unnecessary physical controls.

Why this answer

The correct action is to replace physical separation controls with logical separation controls that provide equivalent protection. Tailoring permits such substitutions when they meet the security objective. This approach maintains security while accommodating the virtualized environment.

Exam trap

The trap here is assuming that controls must be implemented exactly as written, ignoring the flexibility provided by tailoring to adapt to different environments.

Practice this question →

9

Multi-Selecthard

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Select 3 answers

A.Updating all assignment values daily.

B.Ensuring the assignment value is consistent with organizational policy.

C.Consulting with the NIST publication author.

D.Verifying the assignment is addressed by the control implementation.

E.Defining the assignment value in the system security plan.

AnswersB, D, E

Assignment values must align with organisational policy, otherwise the control's parameters are set inconsistently across the system and the resulting baseline no longer reflects management's intent. This satisfies the stem's requirement that assignments be managed correctly, since policy-consistent values keep the control implementation defensible and auditable.

Why this answer

Option B is correct because NIST 800-53 assignment values (the organization-defined parameters in controls) must reflect and be consistent with the organization's own policies, so the chosen value aligns with governance requirements. Option D is correct because after an assignment value is set, you must verify that the control implementation actually addresses that value; otherwise the control is not truly satisfied. Option E is correct because assignment values must be documented in the system security plan (SSP), which records how controls are implemented, including the specific organization-defined parameters.

Option A is not correct because assignment values are not updated daily; they are reviewed and updated as needed based on changes in policy, risk, or system environment. Option C is not correct because consulting the NIST publication author is not a required management action; organizations use the published guidance directly.

Exam trap

CGRC often tests whether candidates understand that assignment values are organization-defined and must be documented in the SSP, not dictated by NIST or updated on a fixed schedule; choosing 'daily updates' or 'consult NIST' reflects a misunderstanding of the RMF tailoring process.

Practice this question →

10

MCQmedium

You are selecting controls for a federal information system categorized as LOW impact. The system owner wants to use NIST SP 800-53B low baseline but also needs to address a specific threat from a recent vulnerability scan that is not covered by the baseline. What is the most appropriate action?

A.Request an exception from the authorizing official to ignore the vulnerability, because the baseline does not require a control for it.

B.Tailor the low baseline by adding a control or control enhancement that addresses the specific threat.

C.Apply the moderate baseline instead, because it includes more controls that might cover the threat.

D.Document the threat as a residual risk and take no action, because the low baseline is sufficient for LOW impact systems.

AnswerB

Tailoring allows organizations to add, modify, or remove controls based on risk. Since the threat is specific and not covered by the low baseline, adding a relevant control or enhancement directly addresses the risk while maintaining the low baseline's proportionality. This is consistent with NIST SP 800-53B and the RMF step of control selection, where tailoring is used to meet unique organizational needs.

Why this answer

Tailoring the low baseline by adding a control or enhancement that addresses the specific threat is the most appropriate action. It allows the organization to manage the identified risk without overburdening the system with unnecessary controls. This approach aligns with NIST SP 800-53B and the RMF, where tailoring is used to adjust baselines based on organizational risk assessments and specific threats.

Exam trap

The trap here is thinking that any new threat automatically requires moving to a higher baseline, rather than applying targeted tailoring to the existing baseline.

Practice this question →

11

MCQmedium

You are a security architect for a federal agency. A new system is categorized as LOW impact. The system owner wants to reduce the number of controls to only those that are strictly required. According to NIST SP 800-53B, which of the following is the most appropriate action?

A.Use the HIGH baseline and tailor it down to low-impact requirements.

B.Select the MODERATE baseline and remove controls until only low-impact controls remain.

C.Select the LOW baseline from NIST SP 800-53B and apply tailoring to remove controls that are not applicable.

D.Develop a custom set of controls from scratch without using a NIST baseline.

AnswerC

The LOW baseline in NIST SP 800-53B provides a starting set of controls specifically for low-impact systems. Tailoring allows removal of controls that are not applicable to the specific system, which is the correct approach to reduce the control set while maintaining a defensible baseline.

Why this answer

For a LOW-impact system, the correct starting point is the LOW baseline from NIST SP 800-53B. Tailoring is then applied to remove controls that are not applicable, ensuring the final set is appropriate for the system's risk level while maintaining a structured, defensible approach.

Exam trap

The trap here is assuming that any baseline can be tailored down to a lower impact level, rather than starting with the baseline that matches the system's categorization.

Practice this question →

12

Multi-Selectmedium

Which TWO of the following are considered 'common controls'?

Select 2 answers

A.The custom source code of a business logic application.

B.Application-specific encryption keys.

C.Physical building access badges.

D.The specific database schema of a custom app.

E.Network boundary protection (firewall) for the data center.

AnswersC, E

Physical building access badges operate across all systems within a facility, so a single implementation satisfies the security requirement for every system hosted there. This shared, inherited nature is precisely what defines a common control, contrasting with system-specific controls tailored to one information system's particular needs.

Why this answer

In security control categorization, 'common controls' are controls that are inherited by or shared across multiple systems rather than being unique to a single information system. Option C (physical building access badges) is a common control because facility-level physical access mechanisms protect all systems and personnel within the building, not just one application. Option E (network boundary protection/firewall for the data center) is a common control because the firewall at the data center perimeter provides shared network protection for every system hosted behind it.

By contrast, options A (custom source code of a business logic application), B (application-specific encryption keys), and D (the specific database schema of a custom app) are all system-specific controls tied to one particular application, so they are not shared or inherited across systems and therefore are not common controls.

Exam trap

CGRC often tests the misconception that any control implemented at the enterprise level is automatically a common control, when in fact it must be provided by a common control provider and formally inherited by multiple systems.

Practice this question →

13

MCQeasy

You are a security manager for a federal agency. You are selecting controls for a new information system using NIST SP 800-53 Rev. 5. You need to determine which controls are required based on the system's impact level. Which NIST publication provides the control baselines for low, moderate, and high-impact systems?

A.NIST SP 800-30

B.NIST SP 800-53B

C.NIST SP 800-53

D.NIST SP 800-37

AnswerB

NIST SP 800-53B, titled 'Control Baselines for Information Systems and Organizations,' provides the security and privacy control baselines for low, moderate, and high-impact systems. It is the authoritative source for selecting the initial control set based on impact level. Therefore, this is the correct publication.

Why this answer

NIST SP 800-53B provides the control baselines for low, moderate, and high-impact systems. It is a companion to NIST SP 800-53, which contains the control catalog. The other publications listed serve different purposes: SP 800-37 describes the RMF, SP 800-53 is the control catalog, and SP 800-30 covers risk assessment.

Therefore, SP 800-53B is the correct source for baseline controls.

Exam trap

The trap here is confusing the control catalog (NIST SP 800-53) with the baseline document (NIST SP 800-53B).

Practice this question →

14

MCQmedium

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

A.It provides a standardized set of controls for a specific technology stack.

B.It replaces the need for FIPS 199 categorization.

C.It eliminates the need for manual tailoring.

D.It automatically tests the controls for compliance.

AnswerA

A control overlay maps a standardised, reusable control set onto a specific technology stack, so the same controls apply consistently across deployments. This satisfies the stem's cloud scenario by removing the need to author bespoke controls per platform, giving repeatable compliance coverage.

Why this answer

A control overlay is a pre-defined set of controls and control enhancements that can be applied to a baseline to address specific technologies, environments, or mission needs — such as cloud computing. In the NIST RMF context, overlays provide a standardized, reusable way to tailor a baseline for a particular technology stack (e.g., cloud, mobile, industrial control systems) without starting from scratch. The primary benefit is consistency and efficiency: organizations get a vetted set of controls appropriate to the cloud environment, reducing ad hoc tailoring and ensuring coverage of cloud-specific risks.

Exam trap

CGRC often tests the misconception that overlays replace foundational RMF steps like categorization or tailoring, or that they automate compliance; the key is to remember overlays are a tailoring mechanism that standardizes control selection for a specific technology or environment, not a substitute for core RMF activities.

How to eliminate wrong answers

Option B is wrong because FIPS 199 categorization is a mandatory step to determine the security category of an information system based on confidentiality, integrity, and availability impact; an overlay does not replace this legal/regulatory requirement — it is applied after categorization and baseline selection. Option C is wrong because overlays still require tailoring: organizations must review and adapt the overlay to their specific mission, environment, and risk tolerance; overlays provide a starting point, not a substitute for tailoring. Option D is wrong because overlays are documentation and control-selection artifacts, not automated testing tools; they do not perform compliance testing, which is done through assessment procedures and tools like SCAP or manual assessor reviews.

Practice this question →

15

Multi-Selecthard

Which THREE factors should an organization consider when applying control overlays?

Select 3 answers

A.The personal preference of the system administrator.

B.The date the system was originally purchased.

C.The mission or business requirements of the system.

D.The impact level of the underlying system.

E.The existing control baseline of the system.

AnswersC, D, E

Overlays must reflect what the system actually does, so mission or business requirements drive which additional controls are layered onto the baseline. This ensures the overlay supports the system's purpose, satisfying the stem's requirement for a factor considered when applying overlays.

Why this answer

Control overlays are tailored sets of controls applied on top of a baseline, so they must be driven by the system's mission or business requirements (C), since the overlay exists to address specific needs such as privacy, cloud, or industrial control environments that the baseline alone does not cover. The impact level of the underlying system (D) matters because FIPS 199/SP 800-53 baselines are selected by impact (low, moderate, high), and the overlay must be consistent with that categorization and the associated control rigor. The existing control baseline of the system (E) is also essential, because an overlay is applied relative to an already-selected baseline, and knowing which controls are already implemented or inherited prevents duplication and gaps.

By contrast, the personal preference of the system administrator (A) is not a valid factor, since overlays must be justified by mission, risk, and compliance needs rather than individual taste, and the date the system was originally purchased (B) is irrelevant to overlay selection, as age of hardware does not determine which controls are required.

Exam trap

CGRC often tests the criteria for overlays; candidates may select irrelevant factors like administrator preference or purchase date instead of mission, impact, and baseline.

Practice this question →

16

MCQmedium

A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organization wants to reduce the number of controls that are not applicable due to the cloud provider's inherited controls. Which action should the analyst take FIRST according to NIST SP 800-53?

A.Apply all controls from the high baseline to ensure maximum security.

B.Implement all controls from the low baseline and then add controls as needed.

C.Identify common controls provided by the cloud provider and document them as inherited.

D.Conduct a vulnerability assessment to determine which controls are missing.

AnswerC

Common controls are those that can be used by multiple systems and are typically inherited from the provider. Identifying them first prevents unnecessary duplication and ensures the control baseline accurately reflects shared responsibilities. This aligns with NIST SP 800-53 tailoring guidance to leverage inherited controls before selecting additional controls.

Why this answer

The correct answer is to identify common controls provided by the cloud provider and document them as inherited. This is a key part of tailoring and prevents redundant control implementation. It ensures that the organization focuses on controls not already satisfied by the provider, optimizing resources and maintaining compliance.

Exam trap

The trap here is assuming that all cloud provider controls are automatically inherited, when in fact they must be explicitly identified and documented as common controls.

Practice this question →

17

Multi-Selecthard

You are tailoring a NIST SP 800-53 baseline for a new system. The system owner asks you to identify the reasons why a control might be marked as 'Not Applicable' during tailoring. Which two of the following are valid reasons for marking a control as 'Not Applicable'? (Choose two.)

Select 2 answers

A.The control is not relevant to the system's technology or environment.

B.The control is not applicable because the system owner prefers not to implement it.

C.The control is too expensive to implement.

D.The control is already implemented by a common control provider and is inherited.

E.The control is not applicable because the system does not process the type of information the control protects.

AnswersA, E

A control may be marked Not Applicable if it addresses a technology or environment that the system does not use. For example, a control for physical access to a data center is not applicable to a cloud-only system with no physical servers. This is a valid tailoring decision based on the system's characteristics and is documented with justification.

Why this answer

A control can be marked Not Applicable during tailoring when it is not relevant to the system's technology or environment, or when the system does not process the type of information the control protects. These are valid, risk-based justifications that must be documented. Cost, inheritance, and personal preference are not valid reasons; inheritance means the control is still applicable, and cost or preference must be addressed through risk acceptance or compensating controls.

Exam trap

The trap here is confusing 'Not Applicable' with 'inherited' or using cost as a justification, when Not Applicable must be based on irrelevance to the system's technology, environment, or information type.

Practice this question →

18

MCQmedium

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

A.To remove all controls that do not apply to the local network.

B.To define the continuous monitoring strategy for the system.

C.To provide a standardized starting point based on impact level.

D.To identify all system-specific compensations.

AnswerC

NIST SP 800-53B baselines map MODERATE impact systems to a predefined set of controls, giving a standardised starting point before tailoring. This satisfies the stem's objective by ensuring consistent, impact-appropriate coverage rather than selecting controls ad hoc.

Why this answer

NIST SP 800-53B defines control baselines (Low, Moderate, High, Privacy) as standardized sets of controls derived from SP 800-53 that serve as a starting point for any system at a given impact level. For a MODERATE-impact federal system, the initial baseline is the Moderate baseline, which the organization then tailors (scoping, parameterization, compensating controls) to fit the specific system. The baseline's purpose is to give a consistent, defensible foundation rather than a system-specific final control set.

Exam trap

CGRC often tests the distinction between baseline selection (choosing the standardized starting set) and tailoring (customizing it), so candidates who conflate the two pick options about removing or compensating controls.

How to eliminate wrong answers

Option A is wrong because removing non-applicable controls is a tailoring/scoping activity performed after baseline selection, not the objective of baseline selection itself. Option B is wrong because continuous monitoring strategy is defined in SP 800-137/SP 800-53 CA-7 and is a separate phase from baseline selection. Option D is wrong because identifying system-specific compensations is part of the tailoring and assessment process, not the initial baseline selection step.

Practice this question →

19

MCQmedium

You are selecting controls for a cloud-based system that will be used by a government agency. The cloud service provider (CSP) has a FedRAMP authorization. You need to determine which controls are inherited from the CSP. What should you review to understand the CSP's control implementation and inheritance details?

A.The NIST SP 800-53 catalog of controls, because it lists all possible controls and their inheritance.

B.The CSP's marketing materials and service level agreements (SLAs).

C.The CSP's FedRAMP authorization package, including the system security plan (SSP) and control assessment results.

D.The agency's own security plan from a previous on-premises system.

AnswerC

The FedRAMP authorization package contains the CSP's system security plan (SSP), which documents control implementations, and the assessment results, which provide evidence of effectiveness. These are authoritative and specific to NIST SP 800-53 controls. Reviewing them allows the agency to accurately identify which controls are inherited, shared, or customer-implemented, ensuring proper control selection and documentation.

Why this answer

The CSP's FedRAMP authorization package, including the system security plan (SSP) and assessment results, is the authoritative source for understanding which controls are implemented and can be inherited. It documents control implementations and provides evidence of effectiveness, allowing the agency to accurately identify inherited, shared, and customer-implemented controls. This ensures proper control selection and avoids duplication or gaps.

Exam trap

The trap here is relying on marketing materials or the NIST catalog instead of the CSP's FedRAMP authorization package, which contains the specific control implementation details needed for inheritance decisions.

Practice this question →

20

Multi-Selectmedium

You are tailoring the NIST SP 800-53 Rev. 5 Moderate baseline for a system that will be deployed in a tactical edge environment with limited network connectivity. The system processes sensitive but unclassified information. Which TWO of the following actions are appropriate when scoping and tailoring controls for this environment? (Choose two.)

Select 2 answers

A.Identify controls that rely on continuous network connectivity and consider compensating controls that operate offline.

B.Apply an overlay that adds controls for wireless communication and ruggedized hardware.

C.Increase the baseline to High impact to compensate for the lack of connectivity.

D.Remove all controls related to incident response because the environment is disconnected from the enterprise network.

E.Mark the contingency planning controls as Not Applicable because the system is not connected to primary data centers.

AnswersA, B

In a limited-connectivity environment, controls that depend on continuous network access (e.g., real-time monitoring, online authentication) may not function. Tailoring involves identifying such controls and implementing compensating measures, such as local logging and periodic synchronization, to achieve the control objective. This is a valid scoping and tailoring action.

Why this answer

The appropriate actions are to identify controls that require network connectivity and implement compensating controls, and to apply an overlay for wireless and ruggedized hardware. These steps tailor the baseline to the tactical edge environment while maintaining necessary security. Removing incident response or contingency controls, or arbitrarily raising the impact level, are not valid tailoring actions.

Exam trap

The trap here is assuming that disconnected environments allow for removal of controls, rather than adjustment through compensating measures or overlays.

Practice this question →

21

MCQmedium

What is the primary role of the authorization official (AO) during the Control Selection phase?

A.To approve the tailoring decisions.

B.To configure the security appliances.

C.To write the security policy.

D.To perform the technical assessment.

AnswerA

The authorisation official owns risk acceptance, so approving tailoring decisions during Control Selection ensures the resulting control set matches the system's risk tolerance. This satisfies the stem's phase-specific constraint, distinguishing the AO's approval role from the assessor's testing and the system owner's implementation duties.

Why this answer

During the Control Selection phase, the Authorizing Official (AO) is responsible for approving the tailoring decisions made by the system owner and security team, ensuring the selected controls adequately address the system's risk profile. The AO's approval formalizes the agreed-upon control set before it moves into implementation and assessment. This approval is a key governance step that ties control selection to the authorization decision.

Exam trap

CGRC often tests role confusion in the RMF — candidates must distinguish governance roles (AO, system owner, CISO) from technical roles (assessors, engineers), and the AO is consistently the approver, not the doer.

How to eliminate wrong answers

Option B is wrong because configuring security appliances is a hands-on technical implementation task performed by system administrators or engineers, not the AO. Option C is wrong because writing security policy is typically the responsibility of the CISO, policy office, or system owner, not the AO. Option D is wrong because performing the technical assessment is the role of assessors (e.g., 3PAO, SCA, or assessment team), not the AO, who relies on assessment results to make authorization decisions.

Practice this question →

22

MCQhard

A security manager is tailoring a NIST SP 800-53 control baseline for a system that processes sensitive but unclassified information. The system owner proposes to remove a control that requires continuous monitoring because the system is in a low-risk environment. What should the security manager do?

A.Approve the removal because the system is low-risk and continuous monitoring is expensive.

B.Deny the removal and require the control to be implemented as written.

C.Perform a risk assessment to determine if compensating controls can provide equivalent protection.

D.Escalate to the authorizing official for a final decision without further analysis.

AnswerC

Tailoring involves assessing risk and determining if compensating controls can achieve the same security objective. A risk assessment provides the basis for accepting, mitigating, or transferring risk. This approach aligns with NIST guidance to tailor controls based on risk while maintaining an acceptable security posture.

Why this answer

The correct action is to perform a risk assessment to determine if compensating controls can provide equivalent protection. Tailoring is risk-based, and removing a control requires justification. The assessment ensures that any modification maintains the system's security posture and is documented appropriately.

Exam trap

The trap here is thinking that low risk automatically justifies removing a control without a formal risk assessment or compensating controls.

Practice this question →

23

MCQmedium

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

A.The overlay supplements the baseline.

B.The overlay is used only if the system is High impact.

C.The baseline is discarded if an overlay is used.

D.The overlay replaces the entire baseline.

AnswerA

An overlay is applied on top of an existing baseline, adding, tailoring or strengthening controls for a specific technology such as mobile devices. It never replaces the baseline; it extends it, so the baseline remains the foundation.

Why this answer

In NIST SP 800-53, an overlay is a set of additional or modified controls applied to a baseline to address specific technology, environment, or mission needs. The overlay supplements the baseline (Option A) by adding controls or tailoring existing ones; it does not replace or discard the baseline. The baseline remains the foundation, and the overlay enhances it.

Exam trap

CGRC often tests the relationship between baselines and overlays; candidates may incorrectly think an overlay replaces the baseline or is only for high-impact systems.

How to eliminate wrong answers

Option B is wrong because overlays are not limited to High impact systems; they can be applied to any impact level based on specific needs. Option C is wrong because the baseline is not discarded; it is augmented. Option D is wrong because the overlay does not replace the entire baseline; it builds upon it.

Practice this question →

24

Multi-Selecthard

Which THREE of the following are benefits of using the NIST 800-53 control framework?

Select 3 answers

A.It supports a consistent approach to security across the organization.

B.It eliminates the need for any technical expertise.

C.It facilitates risk-based decision-making.

D.It automates all manual security processes.

E.It provides a common language for security controls.

AnswersA, C, E

NIST 800-53 provides a catalogue of controls mapped across baselines, letting different teams, systems and business units apply the same structured control set. This yields repeatable, auditable security practise organisation-wide instead of fragmented, ad hoc measures.

Why this answer

Option A is correct because NIST SP 800-53 provides a standardized catalog of security and privacy controls that organizations can apply uniformly across all systems and business units, ensuring a consistent approach to security across the organization. Option C is correct because the framework is built around the risk management process (per NIST RMF and SP 800-37), allowing organizations to select and tailor controls based on assessed risk, which directly facilitates risk-based decision-making. Option E is correct because the common control identifiers and terminology in SP 800-53 give security teams, auditors, and stakeholders a shared vocabulary, providing a common language for security controls.

Option B is incorrect because implementing and interpreting the framework still requires significant technical and security expertise. Option D is incorrect because NIST 800-53 is a control framework, not an automation tool; it does not automate manual security processes.

Exam trap

CGRC often tests the benefits and limitations of NIST 800-53; candidates may overestimate its capabilities, thinking it automates processes or removes the need for expertise.

Practice this question →

25

MCQhard

You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider. The control is documented in the system security plan as 'Inherited'. What is the most critical item to verify during assessment?

A.That the control is implemented correctly and consistently by the common control provider.

B.That the common control provider has a current authorization to operate.

C.That the system owner has signed a memorandum of understanding with the provider.

D.That the control is listed in the common control provider's security plan.

AnswerA

When a control is inherited, the system owner relies on the common control provider for its implementation. The most critical verification is that the control is actually implemented and effective, as the system's security depends on it. This ensures the inheritance claim is valid and the control meets the system's needs.

Why this answer

When a control is inherited, the system owner depends on the common control provider for its implementation. Therefore, the most critical verification is that the control is implemented correctly and consistently. This ensures the inheritance is valid and the system's security posture is not compromised by relying on an ineffective control.

Exam trap

The trap here is focusing on documentation or agreements rather than verifying the actual implementation and effectiveness of the inherited control.

Practice this question →

26

MCQeasy

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

A.Control priority tag.

B.The assignment statement.

C.Control ID prefix.

D.The control parameter list.

AnswerC

Each NIST 800-53 control identifier begins with a two-letter prefix denoting its family, such as AC for access control or AU for audit. The prefix therefore identifies family membership directly, satisfying the stem's requirement without needing the control title or enhancement fields.

Why this answer

In NIST SP 800-53, controls are identified by a unique control ID that consists of a two-letter family prefix followed by a number (e.g., AC-1 for Access Control). The prefix indicates the control family. Therefore, the control ID prefix (Option C) identifies the specific family to which a control belongs.

Exam trap

CGRC often tests the components of NIST 800-53 controls; candidates may confuse the control ID prefix with other fields like priority tags or parameters.

How to eliminate wrong answers

Option A is wrong because control priority tags (e.g., P1, P2, P3) indicate the priority for implementation, not the family. Option B is wrong because the assignment statement is part of the control text that specifies parameters to be filled in, not the family identifier. Option D is wrong because the control parameter list refers to the organization-defined parameters within a control, not the family.

Practice this question →

27

Multi-Selecthard

Which THREE of the following are components that must be included when documenting a compensating control?

Select 3 answers

A.The identity of the person who approved the control.

B.A detailed explanation of how the compensating control mitigates the risk.

C.A description of the risk the control is intended to mitigate.

D.A list of every user affected by the control.

E.The reason why the original control could not be implemented.

AnswersB, C, E

The documentation must explain how the compensating control actually reduces the identified risk, demonstrating that its mechanism provides equivalent protection to the original control. This justification is required so assessors can verify the control genuinely mitigates the risk rather than merely existing.

Why this answer

Option B is correct because documenting a compensating control must include a detailed explanation of how the control mitigates the identified risk, demonstrating that the alternative measure provides equivalent protection to the original requirement. Option C is correct because the documentation must clearly describe the risk the control is intended to mitigate, establishing the security objective the compensating control addresses. Option E is correct because the documentation must state the reason the original control could not be implemented, justifying why a compensating control is necessary in the first place.

Option A is not required, since the identity of the approving person is not a mandatory element of the compensating control description itself, even though approvals are tracked elsewhere in the risk management process. Option D is not required, as listing every affected user is not a standard component; the documentation focuses on the risk, the mitigation method, and the justification for the alternative control.

Exam trap

CGRC often tests the three required elements of a compensating control, tempting candidates to select approval identity or affected-user lists because those feel like part of formal documentation.

Practice this question →

28

MCQeasy

A security analyst is selecting controls for a new information system based on NIST SP 800-53 Rev. 5. The system has been categorized as LOW impact. The analyst proposes using the LOW baseline but wants to add a control from the MODERATE baseline to address a specific risk identified in the risk assessment. What is the most appropriate action?

A.Add the control and document the rationale in the system security plan as a tailored enhancement.

B.Re-categorize the system as MODERATE impact so that the control can be included without additional documentation.

C.Add the control but mark it as not applicable in the system security plan to avoid additional assessment burden.

D.Do not add the control because the system is LOW impact and must only use the LOW baseline.

AnswerA

Adding a control from a higher baseline to address a specific risk is a valid tailoring action known as supplementation. NIST SP 800-53 allows organizations to add controls beyond the baseline when justified by risk assessment. The rationale must be documented in the system security plan. This ensures the control set is risk-based and appropriate for the system's unique circumstances.

Why this answer

Supplementing a LOW baseline with a control from a higher baseline is a legitimate tailoring action when justified by risk. The control should be added, and the rationale documented in the system security plan. This approach ensures the control set is tailored to the system's specific risk profile while maintaining alignment with NIST SP 800-53 guidance.

Exam trap

The trap here is believing that a LOW impact system must strictly adhere to the LOW baseline and cannot include additional controls, when in fact baselines can be supplemented based on risk.

Practice this question →

29

MCQhard

You are a security consultant helping a financial institution select controls for a new mobile banking application. The institution must comply with PCI DSS and NIST SP 800-53. During control selection, you identify that a NIST SP 800-53 control has a parameter that must be defined, such as the frequency of reviews. What should you do to ensure the control is properly implemented?

A.Assign a value to the parameter based on organizational risk tolerance and document it in the security plan.

B.Remove the control entirely because it contains a parameter, as parameters indicate the control is not applicable.

C.Leave the parameter blank so that the control can be interpreted flexibly during assessment.

D.Use the default value provided in NIST SP 800-53 without modification, because defaults are always acceptable.

AnswerA

Control parameters are assignment statements that require organizations to define specific values, such as review frequency or timeout periods. Assigning a value based on risk tolerance and documenting it in the security plan ensures the control is tailored to the organization's needs and can be assessed objectively. This is a required step in the RMF and NIST SP 800-53 tailoring process.

Why this answer

Control parameters, also called assignment statements, require organizations to define specific values such as review frequency or timeout periods. Assigning a value based on risk tolerance and documenting it in the security plan ensures the control is tailored and assessable. This is a required part of the RMF and NIST SP 800-53 tailoring process, and it helps demonstrate compliance with both NIST and PCI DSS requirements.

Exam trap

The trap here is assuming that parameters can be left blank or that NIST provides default values, when in fact organizations must define them based on risk.

Practice this question →

30

Multi-Selectmedium

Which TWO of the following statements regarding the 'Tailoring' process are accurate?

Select 2 answers

A.Tailoring is performed during the Assess step.

B.Tailoring actions must be documented to justify the risk management decisions.

C.Tailoring is only permitted for High impact systems.

D.Tailoring is used to modify the baseline based on system-specific factors.

E.Tailoring is optional and not required by RMF.

AnswersB, D

Documenting tailoring decisions creates an auditable record explaining why specific controls were adjusted, added or removed, and how residual risk was accepted. This satisfies the requirement for traceable justification of risk management decisions throughout the authorisation process.

Why this answer

Option B is correct because the RMF requires that all tailoring actions be documented in the system security plan (SSP) and supporting artifacts so that the risk management decisions and their rationale are transparent and auditable. Option D is correct because tailoring is precisely the process of adjusting the initial control baseline (from NIST SP 800-53B) to account for system-specific factors such as mission needs, environment of operation, organizational constraints, and risk tolerance, resulting in the system's tailored baseline. Option A is incorrect because tailoring occurs during the Select step (Step 2) of the RMF, not the Assess step (Step 4).

Option C is incorrect because tailoring applies to all systems regardless of impact level (Low, Moderate, or High). Option E is incorrect because tailoring is a required part of the RMF Select step, not an optional activity.

Exam trap

CGRC often tests the misconception that tailoring is optional or only for high-impact systems — the exam expects you to know tailoring is mandatory, occurs in the Select step, and must be documented.

Practice this question →

31

Multi-Selecthard

A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine which controls can be inherited from the cloud provider. Which TWO of the following are appropriate actions to take during this process? (Choose two.)

Select 2 answers

A.Conduct a penetration test of the cloud provider's infrastructure to verify inherited controls.

B.Review the cloud provider's SOC 2 report to identify controls that are implemented and can be inherited.

C.Document inherited controls in the system security plan with clear identification of the provider.

D.Assume all controls are inherited because the cloud provider is responsible for security.

E.Implement all controls from the baseline regardless of the provider's offerings.

AnswersB, C

The SOC 2 report provides an independent assessment of the cloud provider's controls. Reviewing it helps identify which controls are already implemented and can be inherited by the organization. This is a key step in documenting common controls and reducing duplication of effort.

Why this answer

The correct actions are to review the cloud provider's SOC 2 report to identify inheritable controls and to document inherited controls in the system security plan. These steps ensure that the organization accurately identifies and records which controls are provided by the cloud provider, avoiding duplication and ensuring accountability.

Exam trap

The trap here is assuming that all controls are inherited in a cloud environment, or that penetration testing can be used to verify provider controls, which is usually not allowed.

Practice this question →

32

MCQeasy

If a control is determined to be 'system-specific', what does that mean?

A.It is a hybrid control.

B.It is implemented by the system owner for that system only.

C.It must be implemented by the vendor.

D.It is inherited from the enterprise.

AnswerB

A system-specific control is scoped to one system and implemented by that system's owner, rather than inherited from a common control or organisation-wide programme. This distinguishes it from hybrid and common controls in the control allocation taxonomy.

Why this answer

A system-specific control is one that is implemented by the system owner and applies only to that particular system, as opposed to common controls shared across the organization or hybrid controls that combine both. This designation is part of the NIST RMF control inheritance model, where controls are categorized as common, system-specific, or hybrid. The system owner bears responsibility for implementing and documenting system-specific controls in the system security plan.

Exam trap

CGRC often tests the confusion between system-specific, common (inherited), and hybrid controls — candidates must remember that system-specific means implemented by the system owner for that system only, not shared or vendor-provided.

How to eliminate wrong answers

Option A is wrong because a hybrid control is a distinct category that combines common (inherited) and system-specific portions — it is not synonymous with system-specific. Option C is wrong because vendor implementation is not a defining characteristic of system-specific controls; vendors may supply products, but the system owner implements the control. Option D is wrong because inherited controls are common controls provided by the enterprise or another system, which is the opposite of system-specific.

Practice this question →

33

MCQeasy

An organization is selecting controls for a new information system. The system is categorized as low impact. According to NIST SP 800-53B, which baseline should be used as the starting point?

A.Moderate baseline

B.Low baseline

C.Privacy baseline

D.High baseline

AnswerB

NIST SP 800-53B provides low, moderate, and high baselines corresponding to impact levels. For a low-impact system, the low baseline is the appropriate starting point. It includes the minimum set of controls required for that impact level, which can then be tailored as needed.

Why this answer

The correct answer is the low baseline. NIST SP 800-53B defines baselines for low, moderate, and high impact systems. Starting with the low baseline for a low-impact system ensures that the appropriate minimum controls are selected, which can then be tailored based on specific needs.

Exam trap

The trap here is confusing the privacy baseline with the security baselines, or assuming that a higher baseline provides better security regardless of impact level.

Practice this question →

34

MCQmedium

During tailoring, what is the 'Refinement' process?

A.Changing the impact level of the system.

B.Removing controls that are too expensive.

C.Adjusting the control statement to make it more precise.

D.Adding new controls to the baseline.

AnswerC

Refinement adjusts the wording of a control statement so it precisely addresses the system's specific environment, making the control more exact and unambiguous. This differs from scoping, which removes controls entirely, and satisfies tailoring's goal of producing precise, system-specific control language.

Why this answer

Refinement in the RMF tailoring process (NIST SP 800-37 / SP 800-53) is the step where control statements are adjusted — adding specificity, clarifying language, or scoping the control to the system's particular environment — so the control is precise and implementable. It does not change the control's intent or the system's impact level; it makes the wording actionable for the specific system. This is distinct from scoping (removing controls not applicable) and supplementation (adding controls beyond the baseline).

Exam trap

CGRC often tests the distinction between the three tailoring activities — candidates confuse refinement (adjusting wording) with supplementation (adding controls) or scoping (removing controls), and pick 'adding new controls' because it sounds like tailoring.

How to eliminate wrong answers

Option A is wrong because changing the impact level (Low/Moderate/High) is a categorization decision made during the RMF Categorize step (FIPS 199 / SP 800-60), not a tailoring refinement — impact level drives baseline selection, not control wording. Option B is wrong because removing controls solely because they are 'too expensive' is not a valid tailoring rationale — controls can be scoped out only if they are not applicable (e.g., a control for wireless does not apply to a wired-only system), and cost alone is not an accepted justification. Option D is wrong because adding new controls to the baseline is 'supplementation,' a separate tailoring activity — refinement adjusts existing control statements, it does not introduce new controls.

Practice this question →

35

MCQhard

You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?

A.That the control is listed in the system's own configuration guide.

B.That the system owner has full administrative control.

C.That the common control provider provides evidence of compliance.

D.That the control is manually tested by the system team.

AnswerC

An inherited control's compliance depends entirely on the common control provider, so the critical verification is obtaining evidence that the provider actually implements and monitors the control. Without that evidence, the inheriting system cannot claim the control satisfies its own security requirement.

Why this answer

When a control is marked 'Inherited', the system owner is relying on a common control provider (CCP) to implement and assess that control. The most critical verification is that the CCP provides evidence of compliance, such as assessment reports or authorization documentation, to ensure the control is actually effective for the system's scope.

Exam trap

CGRC often tests the misconception that inherited controls require no verification, when in fact the system owner must obtain and review evidence from the common control provider.

How to eliminate wrong answers

Option A is wrong because listing the control in the system's own configuration guide does not verify that the common provider is actually implementing it. Option B is wrong because the system owner having full administrative control is not required for inherited controls and may contradict the inheritance model. Option D is wrong because manual testing by the system team is not necessary for inherited controls; the CCP is responsible for assessment, and the system team relies on the provider's evidence.

Practice this question →

36

MCQhard

You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a commercial cloud service provider (CSP) for infrastructure as a service (IaaS). The CSP has a FedRAMP authorization at the Moderate impact level. Your system requires additional controls beyond the CSP's baseline. Which action should you take first to address the gap?

A.Require the CSP to obtain a new FedRAMP authorization at the High impact level before proceeding.

B.Implement a control overlay that adds the necessary controls and documents them in the system security plan.

C.Document the gap as a risk and accept it without additional controls, since the CSP is already authorized.

D.Select a different CSP that already has a FedRAMP High authorization and migrate the system.

AnswerB

A control overlay is a set of additional controls or control enhancements applied to a baseline to address specific requirements, such as those for high-impact systems or unique technologies. Using an overlay allows you to augment the CSP's Moderate baseline with the needed controls while maintaining a structured approach. This is the correct first step to address the gap.

Why this answer

The first step is to implement a control overlay to add the necessary controls to the CSP's Moderate baseline. Overlays are designed to tailor baselines for specific environments or impact levels, enabling the system to meet its security requirements without disrupting the CSP's authorization. This approach is efficient and aligns with NIST guidance.

Exam trap

The trap here is thinking that the CSP must reauthorize at a higher level, rather than using an overlay to supplement the existing authorization.

Practice this question →

37

MCQmedium

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

A.Replace the family with general security controls.

B.Keep the controls but set them to 'manual' mode.

C.Document the removal of the family with a justification.

D.Implement the controls as high-priority items.

AnswerC

Tailoring permits removal of controls that are not applicable, but the decision must be documented with justification to preserve the audit trail. Since the system processes no PII, the Privacy family can be excluded, provided the rationale is recorded in the tailoring documentation.

Why this answer

NIST SP 800-53B and the RMF allow organizations to tailor the control baseline by removing controls that are not applicable — but any removal must be documented with a justification in the system security plan or tailoring worksheet. Since the system does not process PII, the PRIV family is not applicable, so the correct action is to document the removal with a rationale rather than silently dropping it or implementing it anyway.

Exam trap

CGRC often tests the difference between 'not applicable' (tailored out with justification) and 'not implemented' (a finding) — candidates who think removing a control family is forbidden pick A or D instead of the correct documented-removal answer.

How to eliminate wrong answers

Option A is wrong because you do not replace the PRIV family with unrelated security controls — tailoring is about scoping in/out, not substituting families. Option B is wrong because setting controls to 'manual' mode is an implementation detail, not a tailoring decision, and it does not address the fact that the controls are not applicable. Option D is wrong because implementing non-applicable controls as high-priority items wastes resources and contradicts the purpose of tailoring.

Practice this question →

38

MCQeasy

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

A.NIST SP 800-53B.

B.NIST SP 800-53A.

C.FIPS 199.

D.NIST SP 800-37.

AnswerA

NIST SP 800-53B supplies the actual Low, Moderate and High baseline control selections, derived from the SP 800-53 catalogue, that federal information systems must implement. It satisfies the stem's requirement for a document defining those three baselines, whereas SP 800-53 itself provides the broader control catalogue without baseline allocation.

Why this answer

NIST SP 800-53B, 'Control Baselines for Information Systems and Organizations,' is the document that defines the Low, Moderate, and High security control baselines. It provides the specific control sets that correspond to each FIPS 199 impact category, serving as the starting point for tailoring in the RMF. SP 800-53B is the authoritative source for baseline selection.

Exam trap

CGRC often tests the confusion between NIST SP 800-53B (baselines) and SP 800-53A (assessment procedures), or FIPS 199 (categorization), so candidates must memorize the exact scope of each publication.

How to eliminate wrong answers

Option B is wrong because NIST SP 800-53A provides assessment procedures for verifying controls, not the baselines themselves. Option C is wrong because FIPS 199 defines the security categorization process (impact levels for confidentiality, integrity, availability) but does not list control baselines. Option D is wrong because NIST SP 800-37 describes the Risk Management Framework (RMF) steps, not the specific control baselines; it references 800-53B for baseline selection.

Practice this question →

39

MCQmedium

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

A.Use the default value provided in the appendix.

B.Remove the control since it is not fully defined.

C.Leave the assignment blank.

D.Define the frequency based on organizational policy.

AnswerD

Assignment parameters are deliberately left blank in NIST 800-53 so the organisation fills them in. As system owner, you select the frequency value that matches your organisational policy, risk tolerance and operational context, then document it in the control implementation statement.

Why this answer

In NIST SP 800-53, '[Assignment: organization-defined frequency]' is an explicit placeholder indicating that the organization must fill in the value as part of tailoring the control. The system owner, in coordination with the Authorizing Official and organizational policy, defines the frequency (e.g., annually, quarterly) and documents it in the system security plan. Leaving it blank or removing the control would break the control baseline and fail assessment.

Exam trap

CGRC often tests the misconception that NIST provides default values for assignment parameters — candidates must recognize that the organization (system owner) is responsible for defining them based on policy and risk.

How to eliminate wrong answers

Option A is wrong because NIST 800-53 does not provide default values for assignment parameters — the appendix only lists the parameters, not pre-filled values; defaults would defeat the purpose of tailoring. Option B is wrong because an assignment parameter does not make the control optional; the control remains in the baseline and must be tailored, not deleted. Option C is wrong because leaving the assignment blank means the control is not fully specified, which is a documentation deficiency that would be flagged during assessment.

Practice this question →

40

MCQhard

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

A.Mark the control as 'Implemented' and leave the field blank.

B.Document the removal and the justification in the SSP.

C.Request a waiver from the CISO.

D.Just delete the control from the system security plan (SSP).

AnswerB

Tailoring requires that any control deemed not applicable be removed from the baseline and the rationale recorded. The SSP is the authoritative document capturing the tailored control set, so recording both the removal and its justification there preserves the audit trail and satisfies the traceability constraint.

Why this answer

When a control is marked 'Not Applicable' during tailoring, the correct approach is to document the removal and provide a justification in the System Security Plan (SSP). This ensures transparency and auditability, allowing authorizing officials to understand why the control was excluded. The SSP serves as the primary documentation for control implementation and tailoring decisions.

Exam trap

CGRC often tests the misconception that 'Not Applicable' controls can be simply deleted or marked as implemented, when in fact they must be documented with justification in the SSP.

How to eliminate wrong answers

Option A is wrong because marking a control as 'Implemented' when it is not applicable is inaccurate and misleading; leaving the field blank fails to document the rationale. Option C is wrong because a waiver is typically for controls that cannot be implemented due to constraints, not for controls that are not applicable; waivers involve risk acceptance and are not the standard approach for N/A controls. Option D is wrong because simply deleting the control from the SSP without documentation removes the audit trail and violates the requirement to justify tailoring decisions.

Practice this question →

41

Multi-Selectmedium

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

Select 2 answers

A.The control is not applicable to the system's technology.

B.The system environment requires a specific, more rigorous implementation.

C.The control has a high cost of implementation.

D.The control is too difficult to monitor.

E.The system owner disagrees with the FIPS 199 classification.

AnswersA, B

Tailoring removes controls that cannot be implemented because the system lacks the relevant technology, such as a mainframe-only control in a cloud-native environment. This is a scoping decision documented in the system security plan, satisfying the stem's requirement for a valid, defensible reason to tailor the NIST 800-53 baseline.

Why this answer

Option A is correct because NIST 800-53 baselines are tailored when a control addresses technology that the system does not employ — for example, a wireless access control (AC-18) on a system with no wireless capability — making the control not applicable and eligible for removal or scoping out. Option B is correct because tailoring also includes supplementing or strengthening the baseline with additional controls or more rigorous parameters when the system's environment, threat profile, or mission demands greater assurance than the baseline provides, such as raising an audit frequency parameter. Options C and D are not valid tailoring reasons: cost and monitoring difficulty are not criteria in the NIST RMF tailoring process, which is driven by applicability, risk, and mission/business needs rather than convenience.

Option E is incorrect because the system owner cannot unilaterally disagree with a FIPS 199 categorization; the categorization is based on the impact of loss of confidentiality, integrity, and availability, and disputes are resolved through the formal categorization and approval process, not by tailoring the control baseline.

Exam trap

CGRC often tests the misconception that cost or monitoring difficulty justifies removing controls, when in fact tailoring must be driven by applicability and risk, not convenience.

Practice this question →

42

MCQhard

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

A.Risk Acceptance.

B.Baseline Tailoring.

C.Control Supplementation.

D.Compensating Control.

AnswerD

Legacy hardware prevents the baseline NIST 800-53 control from being met, so an alternative control is applied to reduce the same risk to an acceptable level. That substitution, driven by the implementation constraint, is precisely what defines a compensating control.

Why this answer

This is an example of a compensating control. A compensating control is an alternative control implemented when the original control cannot be applied due to constraints, but it still mitigates the same risk. The system owner is substituting a different control to achieve the same security objective, which is the definition of a compensating control.

Exam trap

CGRC often tests the distinction between compensating controls and risk acceptance; candidates may think that if a control cannot be implemented, the only option is to accept the risk, but compensating controls are the correct answer when an alternative is implemented.

How to eliminate wrong answers

Option A is wrong because risk acceptance means acknowledging the risk and taking no action to mitigate it; here, a control is implemented. Option B is wrong because baseline tailoring involves selecting or customizing controls from a baseline, but not necessarily substituting one for another due to constraints. Option C is wrong because control supplementation refers to adding controls beyond the baseline, not replacing one that cannot be implemented.

Practice this question →

43

MCQhard

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

A.To automate the scanning process.

B.To serve as a comprehensive list of all possible security controls.

C.To mandate the order of implementation.

D.To identify which vendors are compliant.

AnswerB

The Control Catalog enumerates the full set of NIST SP 800-53 controls and their enhancements, giving organisations a baseline reference from which to select and tailor controls for hybrid cloud systems, rather than prescribing implementation or assessment procedures.

Why this answer

The NIST SP 800-53 Control Catalog is a comprehensive list of security and privacy controls that organizations use as a source for selecting controls during the RMF process. Its main purpose is to provide the full set of possible controls from which tailored baselines (Low, Moderate, High) are derived for a given system.

Exam trap

CGRC often tests the misconception that the Control Catalog is a prescriptive implementation guide or a compliance scanner — candidates must recognize it as a comprehensive reference list from which baselines are selected.

How to eliminate wrong answers

Option A is wrong because the Control Catalog does not automate scanning — scanning is performed by tools like Nessus, Qualys, or AWS Config, which map findings to controls. Option C is wrong because the catalog does not mandate an implementation order; it is a reference list, and organizations prioritize based on risk and baselines. Option D is wrong because the catalog does not identify vendor compliance — vendor compliance is assessed via FedRAMP, SOC 2, or similar programs, not by the control catalog itself.

Practice this question →

44

MCQmedium

A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premises. The system owner wants to maximize efficiency by reducing duplicate documentation. The organization already has an enterprise-wide access control policy and a centralized identity management system. When developing the system security plan, what is the most appropriate approach for addressing the access control family controls?

A.Mark all access control controls as not applicable because the enterprise identity management system handles authentication and authorization outside the system boundary.

B.Implement all access control controls independently within the payroll system, even if they duplicate enterprise capabilities, to ensure full control.

C.Document the access control controls as common controls provided by the enterprise identity management system and reference the enterprise policy.

D.Select only the access control controls that are explicitly required by the payroll application vendor's security guide, ignoring the enterprise baseline.

AnswerC

This is correct because the centralized identity management system and enterprise policy provide access control functions that can be inherited by the payroll system. Documenting them as common controls avoids duplication and accurately reflects the shared responsibility. The system security plan should reference the common control provider and describe how the controls meet the system's needs, which is efficient and compliant with NIST SP 800-53 practices.

Why this answer

The correct approach is to leverage existing enterprise common controls for access control, as this reduces duplication and ensures consistency with organizational policy. Documenting them as common controls in the system security plan accurately reflects the inheritance and fulfills the requirement to address all applicable controls. This aligns with NIST SP 800-53 guidance on common controls and tailoring.

Exam trap

The trap here is assuming that because an enterprise system handles access control, the payroll system can mark those controls as not applicable, rather than documenting them as inherited common controls.

Practice this question →

45

MCQmedium

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

A.To define specific parameters for control implementation.

B.To categorize the control by its priority level.

C.To link the control to a regulatory requirement.

D.To assign the control to a specific system administrator.

AnswerA

Assignment statements in NIST 800-53 controls mark organisation-defined values, letting each organisation insert its own specifics such as frequency, roles or thresholds. They parameterise the control so it can be tailored to the organisation's risk context.

Why this answer

In NIST SP 800-53, assignment statements are placeholders within a control that the organization must fill in with specific values or parameters tailored to its environment. For example, a control might say 'the organization reviews audit records [Assignment: organization-defined frequency]' — the organization defines that frequency. This makes controls adaptable rather than one-size-fits-all.

Exam trap

The trap is confusing assignment statements (parameter placeholders) with control ownership or baseline categorization — candidates often assume 'assignment' means assigning a person or priority level.

How to eliminate wrong answers

Option B is wrong because control priority/baseline categorization is handled by the control's baseline designation (Low/Moderate/High) and priority codes (P1/P2/P3) in SP 800-53B, not by assignment statements. Option C is wrong because linkage to regulatory requirements is achieved through control mappings and overlays (e.g., FedRAMP, PCI), not assignment statements. Option D is wrong because assignment statements are not about assigning a control to a person — they define parameters, not ownership; personnel assignment is a separate RMF role activity.

Practice this question →

46

MCQeasy

You are developing a security plan for a system that uses a NIST SP 800-53 control baseline. During control selection, you determine that a particular control is not applicable because the system does not have the relevant technology. How should you document this decision?

A.Replace the control with a different control from the same family that is easier to implement.

B.Mark the control as 'Inherited' from the service provider, even though the system does not use that technology.

C.Remove the control from the security plan entirely to avoid confusion during assessment.

D.Mark the control as 'Not Applicable' and provide a rationale explaining why the control does not apply to the system.

AnswerD

When a control is not applicable, it should be marked as such with a clear rationale. This documentation is essential for transparency and for assessors to understand the decision. NIST guidance requires that tailoring decisions, including Not Applicable determinations, be documented in the security plan.

Why this answer

The correct documentation is to mark the control as Not Applicable and provide a rationale. This maintains the integrity of the security plan and ensures that assessors understand the tailoring decision. It aligns with NIST SP 800-53 requirements for documenting control applicability and tailoring actions.

Exam trap

The trap here is thinking that a control can be removed or replaced without documentation, rather than explicitly marking it Not Applicable with justification.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Control Selection questions.

Start 20-question session