scenario questions

When structuring a GRC program, which THREE components are critical for compliance management?

A GRC analyst is designing a process to continuously identify changes in the external regulatory environment that could affect the organization's compliance posture. The organization operates in multiple jurisdictions and wants to avoid manual, ad-hoc tracking. Which approach best supports this requirement?

What is the primary risk of having an inaccurately defined authorization boundary?

What is the primary function of an assessor's 'working papers'?

A security analyst is defining the authorization boundary for a new financial system hosted entirely within a commercial cloud Infrastructure as a Service (IaaS) environment. The system consists of virtual machines, a managed database service, and a load balancer, all provisioned by the organization's cloud team. The cloud provider's physical data center and hypervisor layer are outside the organization's direct control. According to NIST SP 800-37 Rev. 2, which statement best describes how the authorization boundary should be defined?

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

A GRC analyst is evaluating the effectiveness of a continuous monitoring program for a system that has been operational for two years. The analyst notices that several security controls have not been assessed since the initial authorization. Which of the following is the MOST likely cause of this issue?

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

During a security assessment, the assessor discovers that a system's audit logging control is implemented but the logs are not being reviewed regularly. The control is technically configured correctly. How should the assessor document this finding in the Security Assessment Report (SAR)?

When a system is undergoing a major change, what is the impact on the existing ATO?

A retail company is implementing controls to comply with the Payment Card Industry Data Security Standard (PCI DSS). The security manager needs to ensure that cardholder data is protected when stored on backup tapes. Which control should be implemented to meet PCI DSS Requirement 3?

A security assessor is reviewing audit logs from a critical server. The logs show that a user account with administrative privileges was used to access sensitive files outside of normal business hours. The assessor needs to determine whether this activity was authorized. Which type of evidence would BEST support this determination?

To ensure that GRC controls remain effective, the organization requires a 'Control Self-Assessment' (CSA) workflow that triggers automatically based on control criticality. Which setting should be modified?

You are setting up an IDS/IPS (e.g., Snort). Where should you place the sensor to monitor both internal and external traffic?

A system owner is preparing to submit a system for authorization. The system processes sensitive but unclassified information. The Authorizing Official (AO) requires a formal document that describes the system's security controls and how they are implemented. Which document should the system owner provide?

You are configuring a 'Risk Appetite Statement'. The requirement is that any risk score exceeding the appetite must automatically trigger a 'Risk Treatment Plan' workflow. What needs to be configured?

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

A program manager is preparing to categorize a new information system under FIPS 199. The system will handle financial data, and the program manager wants to ensure the categorization is accurate. Which document should the program manager reference to identify the potential impact levels for confidentiality, integrity, and availability?

What is the purpose of the Security Assessment Report (SAR)?

Which role is typically responsible for defining the 'Risk Appetite' within a GRC governance framework?

You are assessing an organization's compliance with the Payment Card Industry Data Security Standard (PCI DSS). As part of the assessment, you need to verify that the organization has implemented proper access control measures for its cardholder data environment (CDE). Which of the following assessment activities would best provide objective evidence of compliance with PCI DSS Requirement 7 (Restrict access to cardholder data by business need to know)?

A financial services firm is embedding risk management into its GRC program. The CISO wants a technique that expresses risk in monetary terms so that the board can compare a database breach scenario against the cost of additional controls. Which approach should the GRC practitioner recommend?

You are the lead auditor for a CGRC assessment of a government agency's financial system. The system owner claims that a new access control mechanism has been implemented and is operating effectively. You need to gather sufficient appropriate evidence to support your conclusion. Which evidence-gathering technique provides the MOST reliable evidence regarding the operating effectiveness of this control?

An organization is integrating its GRC platform with an existing Active Directory infrastructure. To enforce the Principle of Least Privilege for internal auditors, which configuration step should be prioritized?

You are selecting controls for a system that must comply with both NIST SP 800-53 and the Payment Card Industry Data Security Standard (PCI DSS). The system processes credit card transactions. You have identified overlapping controls, but some PCI DSS requirements are more prescriptive than the NIST controls. What is the most effective approach to reconcile these differences during control selection?

A federal agency is initiating the authorization process for a new information system. The system owner is working with the information system security officer (ISSO) to define the system boundary. Which of the following best describes the purpose of defining the system boundary?

A financial institution is implementing a new system to detect and respond to insider threats. The security team wants to monitor user behavior and flag anomalous activities, such as accessing large amounts of data outside normal working hours. Which type of control is being implemented?

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

A government agency is implementing a new case management system. The security policy requires that all users be granted only the minimum access necessary to perform their job functions. Which principle is being applied?

You are a security architect selecting controls for a new federal payroll system categorized as MODERATE impact. The system will be hosted in a government-operated data center. Your organization has already implemented a robust physical security program at the facility, including 24/7 guards, biometric access, and CCTV monitoring. You must select the most appropriate control for physical access authorization. Which action best aligns with NIST SP 800-53 control selection and tailoring guidance?

You are a risk practitioner for a healthcare organization. You are selecting controls for a system that processes electronic protected health information (ePHI). You need to ensure compliance with the HIPAA Security Rule while using NIST SP 800-53 as a framework. What is the most effective approach?

You are the Information System Security Officer (ISSO) for a system undergoing a security control assessment. The assessor has completed testing and provided results. As part of the compliance determination process, you must review the assessment findings and determine the overall compliance status. Which TWO factors are most critical when determining whether a security control is compliant? (Choose two.)

An energy utility is defining its risk appetite. The board states that it will accept moderate risk in pursuit of operational efficiency but will tolerate almost no risk to safety or regulatory compliance. Which action should the GRC practitioner take to translate this statement into an operational instrument?

As an ISC2 CGRC candidate, you are asked to distinguish between different types of audits. Which type of audit is characterized by an independent external party evaluating an organization's security controls to provide assurance to stakeholders?

A security manager is leading an effort to define the authorization boundary for a system that uses a virtualized environment. The system consists of multiple virtual machines (VMs) on a hypervisor that also hosts VMs for other systems. How should the security manager address the hypervisor when defining the boundary?

A security manager is defining the authorization boundary for a system that processes Controlled Unclassified Information (CUI). The system consists of a web server, an application server, and a database server, all hosted on-premises. The system also uses a shared network switch and a shared firewall that are used by other systems in the same data center. Which two components should be included in the authorization boundary? (Choose two.)

A security analyst is preparing to categorize a new human resources system that will store PII for 5,000 employees. The system will be hosted in a government cloud environment. According to FIPS 199, what is the FIRST step the analyst should take to determine the security category?

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

A global retailer's GRC team is preparing for an external audit and must demonstrate that a specific regulatory requirement has been satisfied over the past twelve months, not merely at a point in time. Which evidence-collection strategy best supports this assertion?

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

Which THREE of the following are necessary to establish a 'Continuous Control Monitoring' (CCM) program?

A security assessor is evaluating an organization's continuous monitoring program as part of a NIST SP 800-137 assessment. The assessor must verify that the program includes the essential elements required for effective ongoing situational awareness. Which TWO elements are essential components of a continuous monitoring program? (Choose two.)

A GRC analyst at a software company is building the organization's risk register for the first time. The CISO asks which two attributes are essential for every entry so that leadership can prioritize treatment and assign accountability. (Choose two.)

Which type of control is an alarm system installed in a server room?

The organization's GRC workflow has a 'Request for Exception' process. The goal is to ensure that temporary risk exceptions are automatically reviewed before they expire. Which mechanism is most appropriate?

Which TWO of the following represent best practices for password management?

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

A healthcare organization must protect electronic protected health information (ePHI) in a new cloud-based patient portal. The security team decides to implement a control that renders data unreadable to unauthorized parties even if the storage media is compromised. Which of the following best describes this type of control?

Which TWO of the following should be considered when selecting a GRC platform for an enterprise-wide program?

A federal agency is deploying a new cloud-based case management system. The system consists of a web front end, an application server, and a database, all hosted in a single virtual private cloud (VPC). The system owner must define the authorization boundary for the system. Which of the following best describes the authorization boundary in this context?

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Which TWO of the following are critical requirements for implementing an effective patch management program?

Which THREE activities are part of the 'Assessment Execution' phase?

A security manager is reviewing the controls for a new web application that processes credit card payments. The manager must ensure that the application complies with PCI DSS requirement 6.5.1, which addresses injection flaws. Which control should be implemented to mitigate SQL injection attacks?

An organization is beginning the RMF process for a new human resources system. The Information System Owner (ISO) needs to identify the system boundary. Which of the following best describes the purpose of defining the authorization boundary?

Which TWO of the following are examples of administrative security controls?

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

A multinational corporation is implementing controls to protect sensitive intellectual property stored in a hybrid cloud environment. The GRC team must ensure that data remains confidential and integrity-protected both at rest and in use within a trusted execution environment (TEE). Which TWO controls are MOST appropriate to achieve these objectives? (Choose two.)

Which THREE types of findings might appear in an audit report?

Which TWO factors contribute to the 'scope' of an information security audit?

A healthcare organization is implementing controls to comply with HIPAA Security Rule. The security team is configuring audit logging for a new electronic health record (EHR) system. Which two of the following are essential elements to include in the audit log configuration to meet HIPAA's audit control requirements? (Choose two.)

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

A multinational corporation is deploying a new encryption solution for data at rest across its global data centers. The security team must ensure that encryption keys are managed securely and can be recovered in case of disaster. Which of the following is the most appropriate key management practice?

You are configuring a Linux firewall using 'iptables'. Which chain should you use to filter traffic destined for the local host?

When establishing a GRC program structure, what is the primary purpose of defining a 'System of Record'?

The GRC program requires that all policies are reviewed annually. What is the most effective way to enforce this within the GRC platform?

A mid-size healthcare insurer is standing up a GRC program and must decide where the authority to approve enterprise risk acceptance thresholds should reside. The CISO argues it belongs in the security operations team, while the CIO argues it belongs with IT leadership. The GRC lead needs to recommend a governance structure that keeps risk decisions independent from those who own and operate the controls. Which arrangement best satisfies that requirement?

You are auditing a backup solution. Which metric is most critical for the Availability audit?

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

An organization is transitioning from a siloed risk management approach to an integrated GRC program. During the initial implementation, data inconsistency between the Risk Register and the Compliance Control library is observed. Which action best facilitates 'Common Control Framework' (CCF) mapping?

A system's continuous monitoring plan requires weekly vulnerability scans. The scans have been consistently showing the same findings for three months, and remediation efforts have been unsuccessful due to vendor delays. What should the GRC analyst do?

You are leading a security assessment team using the NIST Risk Management Framework (RMF). During the 'Assess' step, your team must determine the overall effectiveness of the security controls implemented in a new system. The system owner asks which activities are essential to complete this assessment step. (Choose two.)

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

You are the GRC analyst for a system that has an approved Authorization to Operate (ATO). A new vulnerability is discovered in a component that is not part of the system's boundary but is used by the system's administrators. According to continuous monitoring principles, what should you do first?

You are a security analyst at a hospital that must comply with HIPAA and NIST SP 800-53. You are selecting controls for a new patient portal. Your manager asks you to reduce unnecessary duplication by identifying controls that are already provided by the hospital's centralized identity management system. Which type of control should you document for the portal's authentication requirements?

You are a security architect for a federal agency. You are selecting controls for a new high-impact system that processes sensitive personnel data. During the initial selection process, you determine that a specific NIST SP 800-53 control is not applicable because the system does not use wireless networking. According to NIST guidance, what is the most appropriate action?

When conducting an audit, what is 'sampling'?

You are the Information System Security Officer (ISSO) for a federal system undergoing an annual assessment. The assessor reports that a boundary protection control is only partially implemented: the firewall ruleset is outdated, and several unnecessary ports are open. The system owner asks how this should be reflected in the System Security Plan (SSP). What is the most appropriate action?

A security architect is selecting controls for a system that will be deployed in a virtualized environment. The architect notes that many controls in the NIST SP 800-53 baseline assume physical separation. Which tailoring action is most appropriate to address this?

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

You are the Information System Security Officer (ISSO) for a federal system that has just completed a security control assessment. The assessor identified several findings, and you are now preparing the Plan of Action and Milestones (POA&M). The system owner asks you to explain the primary purpose of the POA&M in the context of continuous monitoring. What should you say?

You are selecting controls for a federal information system categorized as LOW impact. The system owner wants to use NIST SP 800-53B low baseline but also needs to address a specific threat from a recent vulnerability scan that is not covered by the baseline. What is the most appropriate action?

Which phase of the RMF includes the 'continuous monitoring' of security controls?

A retail company is implementing a new point-of-sale (POS) system that must comply with PCI-DSS. The security manager is reviewing the network architecture and wants to ensure that the POS systems are isolated from the corporate network. Which of the following controls best achieves this isolation while allowing necessary communication with the payment processor?

A retail company has just hired its first GRC analyst. The analyst is asked to explain why the organization needs a formal governance framework rather than relying on the informal practices each department currently uses. Which statement best describes the primary purpose of GRC governance in this context?

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

A federal agency is deploying a cloud-based case management system. The system uses a virtual private cloud (VPC) for compute, a managed database service, and an external identity provider for authentication. The security team must define the authorization boundary. Which approach best aligns with NIST SP 800-37 and FIPS 199?

Which technique is best to detect 'false negatives' during a security control assessment?

A healthcare payer's GRC team is building a new compliance program for a recently acquired subsidiary that processes protected health information. Executive leadership wants assurance that the program's scope, authority, and reporting lines are formally documented and approved before any control testing begins. Which artifact should the GRC practitioner produce FIRST to satisfy this expectation?

The GRC team has determined that 'Residual Risk' is being calculated incorrectly because the 'Control Effectiveness' score is not reflecting the latest audit results. Which architectural fix is required?

Which administrative control is essential before deploying a new security tool to production?

You are a security architect for a federal agency. A new system is categorized as LOW impact. The system owner wants to reduce the number of controls to only those that are strictly required. According to NIST SP 800-53B, which of the following is the most appropriate action?

Which THREE elements are necessary for a compliant continuous monitoring program?

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Which TWO of the following are considered 'common controls'?

A GRC analyst is supporting a system that has been authorized to operate. The continuous monitoring program includes automated configuration scans, annual control assessments, and a plan of action and milestones (POA&M). During a quarterly review, the analyst finds that several POA&M items have exceeded their original completion dates. The system owner wants to know which actions are required to maintain compliance. (Choose two.)

You are an assessor for a cloud service provider (CSP) undergoing a FedRAMP Moderate baseline assessment. During the assessment, you discover that a required control (AC-2 Account Management) is not fully implemented. According to the FedRAMP assessment process, what is the next step you must take?

When aligning GRC with business objectives, which THREE of the following represent effective strategic alignment?

A security administrator at a financial firm is hardening a new Windows Server 2022 domain controller. The administrator must ensure that the server meets the organization's requirement to enforce a minimum password length of 14 characters and account lockout after 5 invalid attempts. Which control type best describes the configuration of these settings?

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

A financial services firm is implementing a new credit-scoring application that processes consumer PII. The CISO mandates that the application must enforce a control that restricts access based on the sensitivity of the data and the user's role, and that the control must be evaluated during the design phase. Which type of control is the CISO requiring?

In a mature GRC program, which TWO of the following activities are typical for the 'Risk Management' domain?

What is the physical security control used to prevent piggybacking at an entry point?

You are a security manager for a federal agency. You are selecting controls for a new information system using NIST SP 800-53 Rev. 5. You need to determine which controls are required based on the system's impact level. Which NIST publication provides the control baselines for low, moderate, and high-impact systems?

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

You are conducting a security impact analysis for a proposed change to a system that has an existing Authority to Operate (ATO). The change involves migrating the database to a new cloud service provider. Which TWO of the following factors are most critical to evaluate in this analysis? (Choose two.)

When performing vulnerability management, what is the purpose of a 'credentialed scan'?

Which THREE of the following are steps required to properly decommission a server containing sensitive data?

You are reviewing the audit documentation of a junior assessor who tested a contingency planning control. The assessor noted that the control was 'effective' based on a tabletop exercise conducted six months ago. The system has undergone a major architecture change since then. According to CGRC assessment principles, what is the MOST significant deficiency in the assessor's conclusion?

Which THREE factors should an organization consider when applying control overlays?

A financial services firm is expanding its GRC program and needs to establish a formal governance structure. The Chief Information Security Officer (CISO) has been asked to define the roles and responsibilities for overseeing risk decisions across business units. Which of the following is the MOST appropriate first step to ensure accountability and alignment with organizational objectives?

A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organization wants to reduce the number of controls that are not applicable due to the cloud provider's inherited controls. Which action should the analyst take FIRST according to NIST SP 800-53?

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

Which TWO methods are commonly used to gather assessment evidence?

You are tailoring a NIST SP 800-53 baseline for a new system. The system owner asks you to identify the reasons why a control might be marked as 'Not Applicable' during tailoring. Which two of the following are valid reasons for marking a control as 'Not Applicable'? (Choose two.)

A large federal agency is modernizing its benefits processing system. The new architecture will integrate a legacy mainframe system, a commercial off-the-shelf (COTS) case management product hosted on-premises, and a new cloud-based document repository. The legacy mainframe and the COTS product are owned by the agency, while the cloud repository is provided by a FedRAMP-authorized cloud service provider. The agency's Information System Owner (ISO) must define the authorization boundary for the overall benefits processing capability. Which approach is most appropriate?

To ensure compliance with PCI-DSS for a database, you must implement FDE (Full Disk Encryption). Which tool is appropriate for a Linux-based server?

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

An Information System Owner (ISO) is defining the authorization boundary for a system that will be deployed in a government cloud environment. The cloud provider offers infrastructure as a service (IaaS). Which of the following should the ISO consider as part of the system boundary?

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

A federal agency is preparing for a continuous monitoring assessment of a high-impact system. The Information System Security Officer (ISSO) must ensure that the security assessment plan (SAP) includes appropriate methods for assessing a new encryption control. Which combination of assessment methods should the ISSO verify are included to provide the most reliable evidence?

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Which THREE of the following represent common challenges in maintaining an integrated GRC program?

During a security control assessment of a U.S. federal information system, the assessment team must verify that the system's boundary protection controls meet the requirements of NIST SP 800-53 Rev. 5. The team has already collected the system security plan and the most recent security assessment report. Which action should the team take NEXT to obtain independent evidence of the implemented controls?

You are a GRC analyst responsible for continuous monitoring of a federal information system. The system has a current ATO and is in the operations and maintenance phase. Which TWO of the following activities are required to maintain the authorization according to NIST SP 800-37 Rev. 2? (Choose two.)

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

As the GRC analyst, you are reviewing the continuous monitoring program for a financial system that processes transactions. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which of the following is the MOST appropriate action?

A security engineer is using the NIST Risk Management Framework (RMF) to maintain compliance for a high-impact system. During continuous monitoring, the engineer discovers that a critical security control has been modified without a security impact analysis. Which of the following actions should the engineer take FIRST?

A retail company is deploying a new point-of-sale (POS) system. The GRC analyst is asked to recommend a control that will reduce the risk of card skimming and tampering. Which type of control is most appropriate?

A GRC analyst is reviewing the organization's risk register and notices that a risk related to third-party data storage has a high inherent risk score but a low residual risk score. The analyst needs to explain to management why the residual risk is low. Which factor should the analyst cite as the primary reason?

A multinational corporation is implementing a GRC program to manage compliance with GDPR, CCPA, and other privacy regulations. The GRC manager needs to ensure that data subject access requests (DSARs) are handled within regulatory timeframes. Which of the following is the MOST effective way to integrate DSAR processing into the GRC program?

You are developing a continuous monitoring strategy for a federal information system as part of the Risk Management Framework (RMF) process. According to NIST SP 800-137, which TWO of the following are essential components of an effective continuous monitoring program? (Choose two.)

When implementing an 802.1X environment, what is the role of the RADIUS server?

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

You are selecting controls for a cloud-based system that will be used by a government agency. The cloud service provider (CSP) has a FedRAMP authorization. You need to determine which controls are inherited from the CSP. What should you review to understand the CSP's control implementation and inheritance details?

A multinational corporation is implementing controls to comply with the General Data Protection Regulation (GDPR). The security team must ensure that personal data of EU citizens is protected during processing. Which control best addresses the GDPR principle of data protection by design and by default?

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner wants to use automated tools to collect and analyze security-related data. Which of the following should the analyst ensure is in place to support this automation?

Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?

A GRC analyst is designing a key risk indicator (KRI) dashboard for the executive committee. The goal is to provide early warning signals for risks that could impact strategic objectives. Which TWO of the following characteristics are MOST important for effective KRIs? (Choose two.)

A program manager is working with the Information System Owner (ISO) to determine the scope of a new payroll system. The system will interface with an external banking system for direct deposits. What should the ISO do regarding the external banking system when defining the authorization boundary?

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

You are an ISSO preparing for an upcoming CGRC assessment of a major information system. The auditor has requested a kickoff meeting to discuss the scope, objectives, and logistics of the assessment. What is the PRIMARY purpose of this kickoff meeting?

After a system receives an Authority to Operate (ATO), the organization must maintain compliance through continuous monitoring. Which of the following activities is a core component of a continuous monitoring program?

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

A federal system has received an authorization to operate (ATO) with a continuous monitoring strategy that requires monthly vulnerability scans and annual security assessments. Six months into the authorization, the system owner replaces the primary database server with a newer model running a different operating system version. The security control baseline remains the same. As the GRC analyst supporting the ongoing authorization, what is the MOST appropriate action to maintain compliance?

You are tailoring the NIST SP 800-53 Rev. 5 Moderate baseline for a system that will be deployed in a tactical edge environment with limited network connectivity. The system processes sensitive but unclassified information. Which TWO of the following actions are appropriate when scoping and tailoring controls for this environment? (Choose two.)

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

What is the primary role of the authorization official (AO) during the Control Selection phase?

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

A security manager is tailoring a NIST SP 800-53 control baseline for a system that processes sensitive but unclassified information. The system owner proposes to remove a control that requires continuous monitoring because the system is in a low-risk environment. What should the security manager do?

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

A system owner is preparing to transition a system into the operations and maintenance phase. The Authorizing Official has granted an Authorization to Operate (ATO). What is the primary compliance activity that must continue during this phase?

A retail company is preparing for an external audit of its GRC program. The auditor requests evidence that risk treatment plans are approved by appropriate stakeholders and tracked to completion. Which of the following GRC platform features BEST demonstrates this capability?

A financial services firm is implementing a GRC program to satisfy multiple regulatory frameworks (e.g., GDPR, SOX, PCI DSS). The compliance team currently maps controls separately for each regulation, resulting in duplicated effort and inconsistent evidence. The CISO wants to streamline by identifying common controls that satisfy multiple requirements. Which approach should the GRC practitioner recommend?

Which THREE roles are typically involved in a security assessment?

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

An organization is preparing for a compliance audit against ISO/IEC 27001. The internal audit team needs to gather evidence that the information security management system (ISMS) is operating effectively. Which activity is MOST appropriate for the team to perform?

An organization is defining the authorization boundary for a system that will use a shared database service managed by a different business unit. The database will store sensitive data for multiple systems. What should the security manager do to properly address this shared service in the authorization process?

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

A system owner is preparing to authorize a system for operation. The Security Assessment Report (SAR) contains a finding that a high-impact security control is not implemented. The Authorizing Official (AO) decides to accept the risk and grant an Authorization to Operate (ATO). What document must the AO sign to formally accept the risk?

You are preparing a continuous monitoring strategy for a federal information system in accordance with NIST SP 800-137. Which TWO activities are essential components of the continuous monitoring program? (Choose two.)

Which THREE of the following are benefits of using the NIST 800-53 control framework?

A security architect is defining the authorization boundary for a new cloud-hosted financial system. The system uses a managed database service and a serverless compute service from the cloud provider. The provider's infrastructure (hypervisor, physical network, data center) is outside the boundary. According to NIST SP 800-37, which statement best describes how the shared responsibility model affects the authorization boundary?

Which TWO of the following are considered 'technical' security controls?

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

You are an internal auditor tasked with assessing the effectiveness of your organization's security controls. You have full access to internal documentation and personnel. Which type of audit are you performing?

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

A financial services firm must comply with GLBA Safeguards Rule. The security team is implementing encryption for data at rest on a new PostgreSQL database. Which of the following is the most appropriate control to protect the data if the underlying storage media is physically stolen?

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

A security assessor is evaluating an organization's access control policy. The assessor needs to verify that the policy includes all required elements for compliance with a specific framework. Which of the following would be the MOST reliable source of evidence to confirm the policy's content?

You are reviewing the continuous monitoring strategy for a system that processes Controlled Unclassified Information (CUI). The system owner proposes reducing the frequency of vulnerability scans from weekly to quarterly to save costs. As the GRC analyst, what is your primary consideration when evaluating this proposal?

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider. The control is documented in the system security plan as 'Inherited'. What is the most critical item to verify during assessment?

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

You are conducting an assessment of a cloud service provider's (CSP) compliance with the FedRAMP Moderate baseline. The CSP has provided a system security plan (SSP) and a set of assessment procedures. You notice that the SSP indicates that a particular control is inherited from the underlying IaaS provider. What is the most appropriate action to verify the effectiveness of this inherited control?

A healthcare organization is updating its risk management methodology. The GRC team wants to ensure that risk assessments consistently consider the potential impact on patient safety, regulatory compliance, and financial performance. The CISO requests a quantitative approach to prioritize risks for mitigation funding. Which risk analysis method BEST meets these requirements?

When setting up a new GRC program, which TWO of the following are essential for ensuring successful adoption across the business?

You are conducting a security assessment of a government agency's network. During evidence collection, you must ensure the integrity and authenticity of the evidence. Which TWO of the following actions are most critical to maintain the integrity of audit evidence? (Choose two.)

Which THREE of the following are components that must be included when documenting a compensating control?

When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)

Which THREE of the following are valid components of an Authorization Package?

A security analyst is selecting controls for a new information system based on NIST SP 800-53 Rev. 5. The system has been categorized as LOW impact. The analyst proposes using the LOW baseline but wants to add a control from the MODERATE baseline to address a specific risk identified in the risk assessment. What is the most appropriate action?

Which THREE of the following are components of a secure server hardening process?

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

A global manufacturing firm is maturing its GRC program. The GRC director wants a governance mechanism that both (1) translates the organization's risk appetite into measurable boundaries for business units and (2) provides a repeatable way to escalate issues when those boundaries are breached. Which two GRC components best deliver these outcomes? (Choose two.)

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

You are conducting an audit of a cloud service provider's continuous monitoring program. The provider claims to follow NIST SP 800-137 guidelines. You need to verify that the organization's continuous monitoring strategy includes the required elements for ongoing assessment of security controls. Which TWO elements are essential components of an effective continuous monitoring program according to NIST SP 800-137? (Choose two.)

A multinational corporation is implementing a new cloud-based ERP system. The GRC analyst must ensure that the control environment aligns with the organization's risk appetite. The CISO asks for a control that provides reasonable assurance that transactions are authorized and recorded accurately. Which type of control is most appropriate?

You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Which THREE categories of controls are identified in NIST SP 800-53?

A GRC practitioner is designing a continuous monitoring program for the organization's security controls. The goal is to detect control failures in near real-time. Which of the following should be the primary focus when selecting metrics for continuous monitoring?

You are the Information System Security Officer (ISSO) for a federal financial system undergoing an annual assessment. The Security Control Assessor (SCA) has completed the assessment and documented several controls as 'Other than Satisfied' in the Security Assessment Report (SAR). According to NIST SP 800-37 Revision 2, what is the primary next step the Authorizing Official (AO) must take before making an authorization decision?

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

You are a security consultant helping a financial institution select controls for a new mobile banking application. The institution must comply with PCI DSS and NIST SP 800-53. During control selection, you identify that a NIST SP 800-53 control has a parameter that must be defined, such as the frequency of reviews. What should you do to ensure the control is properly implemented?

Which TWO of the following statements regarding the 'Tailoring' process are accurate?

A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine which controls can be inherited from the cloud provider. Which TWO of the following are appropriate actions to take during this process? (Choose two.)

If a control is determined to be 'system-specific', what does that mean?

A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the following should be the PRIMARY focus of the update?

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which TWO factors should the analyst consider when evaluating this proposal? (Choose two.)

An Information System Security Officer (ISSO) is reviewing the Security Assessment Report (SAR) for a system that is undergoing initial authorization. The SAR indicates that a high-impact system has a control that is only partially implemented. What should the ISSO recommend to the Authorizing Official (AO)?

A GRC analyst is reviewing the continuous monitoring results for a system that has been in operation for two years. The analyst notices that a security control for access control (AC-2) has been consistently failing automated checks for the past three months. The system owner argues that the control is not critical and wants to accept the risk. What is the most appropriate action for the analyst to take?

An organization is selecting controls for a new information system. The system is categorized as low impact. According to NIST SP 800-53B, which baseline should be used as the starting point?

During tailoring, what is the 'Refinement' process?

An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

A system owner is defining the authorization boundary for a new information system that will process personally identifiable information (PII). The system will use a cloud-based customer relationship management (CRM) service, an on-premises database, and a web application hosted on a government-furnished server. Which TWO components should be included within the authorization boundary? (Choose two.)

Which TWO of the following are responsibilities of the Authorizing Official?

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

A security assessment team is planning to assess an organization's incident response capability. The team lead must ensure that the assessment covers the necessary components to evaluate the effectiveness of the incident response process. Which TWO of the following should be included in the assessment scope? (Choose two.)

You are configuring an AWS Security Group for a web server. To allow incoming HTTPS traffic from the internet while restricting all other traffic, which rule should you apply?

Which TWO of the following are effective ways to secure endpoints against malware?

Which document is mandatory to finalize the system categorization and begin the RMF process?

A financial services firm's GRC team is defining measurable objectives for its governance program. The chief risk officer wants to demonstrate that the program is not only operating but also improving over time. Which set of performance indicators BEST supports this goal?

You are managing an AWS S3 bucket that stores sensitive PII. Which control is the primary mechanism to prevent public access?

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Which document defines the specific security controls that an organization must implement based on its risk assessment?

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

What is the purpose of a 'pre-assessment' meeting?

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Which document provides the formal authority to operate a system?

A GRC officer is preparing for an annual assessment of a system's continuous monitoring program. The officer must ensure that the program's documentation reflects the current state of security controls. Which of the following artifacts is MOST important to review to verify that the continuous monitoring program is effectively tracking control changes?

A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact is specifically designed to depict the system boundary and its interfaces?

During a system compliance review, the Security Control Assessor (SCA) issues a finding that a critical security control is only partially implemented. The system owner disagrees and wants to proceed with authorization. As the Information System Security Officer (ISSO), what should you do FIRST?

Which GRC component is used to document the organizational structure, such as business units and departments, to which risks are assigned?

You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a commercial cloud service provider (CSP) for infrastructure as a service (IaaS). The CSP has a FedRAMP authorization at the Moderate impact level. Your system requires additional controls beyond the CSP's baseline. Which action should you take first to address the gap?

Which GRC platform component is most critical for ensuring that executive leadership receives accurate, real-time risk posture data?

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

You are the Information System Security Officer (ISSO) for a federal payroll system undergoing an annual assessment. The Security Control Assessor (SCA) reports that a firewall rule allowing inbound RDP from any source is in place, contradicting the documented configuration in the System Security Plan (SSP). The system owner argues the rule is temporary for a migration. What is the most appropriate immediate action?

To ensure the integrity of the GRC 'System of Record', which THREE controls must be enforced?

You are implementing Disk Encryption using BitLocker. You want to ensure that the recovery key is stored securely. Where should it be stored?

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Which THREE types of information should be included in a risk acceptance memo?

A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?

A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common control provided by a separate organizational unit. The common control's assessment was performed by that unit, and the results are documented in a shared assessment report. What should the Assessor do to support the system's authorization?

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

An organization is undergoing a periodic security assessment of its production environment. The assessment team lead needs to ensure that the assessment scope is formally agreed upon and that all relevant stakeholders understand the boundaries. Which document should the team lead produce FIRST to establish this shared understanding?

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner asks which document should be updated to reflect changes in the system's security posture resulting from continuous monitoring activities. What is the PRIMARY document that must be kept current?

You are conducting a security assessment of a cloud service provider's environment. The provider claims that its system meets the FedRAMP Moderate baseline. As part of your assessment, you need to verify that the provider has implemented the required continuous monitoring activities. Which document should you review to find the provider's continuous monitoring strategy and deliverables?

An organization is integrating 'Third-Party Risk Management' (TPRM) into their GRC framework. They need to ensure that vendors with 'Critical' status undergo annual due diligence. Which configuration is required?

A company is implementing a 'Continuous Monitoring' program in their GRC tool. They need to ingest data from a Cloud Security Posture Management (CSPM) tool. What is the most efficient configuration approach?

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

A security assessor is reviewing a system boundary for a high-impact system. The boundary includes a web server, an application server, and a database server, all located in the same data center. The system also uses an external identity provider for authentication. During the review, the assessor notices that the identity provider is not listed in the boundary diagram. What is the most significant risk of this omission?

During a security assessment of a cloud-based system, the Security Control Assessor (SCA) determines that a cryptographic module used for data at rest does not meet FIPS 140-2 validation requirements. The system owner argues that the module is provided by the cloud service provider (CSP) and is therefore outside their control. As the ISSO, what should you do first to address this finding?

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

You are the GRC lead for a U.S. federal agency. A system has an Authorization to Operate (ATO) that expires in 90 days. The system owner submits a revised System Security Plan (SSP) and a new security assessment report showing all controls are still effective, but no changes have been made to the system since the last authorization. According to NIST SP 800-37 Rev. 2, what is the most appropriate action to maintain the authorization?

A system owner is preparing to accept a risk for a low-impact information system. The system has a minor weakness that cannot be remediated in the next 30 days. Which document must the system owner sign to formally accept the risk?

An organization is implementing a continuous monitoring program for its information systems in accordance with NIST SP 800-137. Which TWO activities are essential components of this program? (Choose two.)

You are the Information System Security Officer (ISSO) for a federal system undergoing a periodic security control assessment. During the assessment, the assessor identifies that a high-impact security control is only partially implemented. According to NIST SP 800-37 Rev. 2, what should be your immediate next step?

A newly appointed GRC manager at a healthcare payer is drafting the organization's first charter for the governance function. The CIO asks what single element must be documented in the charter to give the GRC program the authority to enforce policy across business units that do not report to the GRC office.

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

An organization is using a FedRAMP-authorized cloud service provider (CSP) for a new system. The ISSO must determine how to leverage the CSP's authorization to reduce the assessment burden for the new system. Which approach is most appropriate according to FedRAMP guidance?

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

In VMware vSphere, what is the best practice for securing virtual machine consoles?

Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

A GRC manager is establishing a process to manage exceptions to security policies. The goal is to ensure that exceptions are granted only when justified, have a defined expiration, and are reviewed regularly. Which TWO of the following are essential components of this exception management process? (Choose two.)

An organization is using a cloud service provider (CSP) for a system that processes moderate-impact data. The CSP has a FedRAMP authorization. What is the most efficient way for the organization to leverage the CSP's authorization to support its own system's authorization?

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

A healthcare organization must implement a control to protect electronic protected health information (ePHI) from unauthorized access during transmission over a public network. The security team has decided to use Transport Layer Security (TLS) 1.3. Which statement best describes why TLS 1.3 satisfies the HIPAA Security Rule's transmission security requirement?

A GRC analyst is supporting the ongoing authorization of a system that has been designated as high-impact. The authorizing official has requested evidence that the continuous monitoring program is providing adequate visibility into the system's security posture. Which of the following activities BEST demonstrates that the program is effectively supporting ongoing authorization?

You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?

A newly formed GRC team at a logistics company is drafting the organization's first compliance program. The team lead wants to ensure the program aligns with the principle that compliance is everyone's responsibility, not just the GRC function's. Which element should be included to reinforce this principle?

You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)

A healthcare organization's GRC team is defining key risk indicators (KRIs) for its patient data protection program. The CISO wants KRIs that are predictive of potential breaches, not just historical metrics. Which of the following should the GRC practitioner recommend as a leading KRI?

During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

A federal information system has an approved Authority to Operate (ATO) with an expiration date of 18 months from now. The system owner asks you, the GRC analyst, what triggers a reauthorization before that date. Which of the following events most clearly requires a reauthorization decision by the Authorizing Official?

Which THREE of the following roles are typically involved in a GRC Steering Committee?

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Which TWO of the following are recommended practices for managing firewall rules?

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)

An organization is preparing for an independent security assessment of its cloud-hosted customer relationship management (CRM) system. The assessment will evaluate compliance with the organization's security policies and applicable regulations. Which document should the assessor request FIRST to understand the system's boundary, components, and data flows?

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Which THREE of the following are elements of a secure incident response control set?

An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end, an application server, and a database. The database is hosted in a separate virtual private cloud (VPC) managed by the same organization. The ISO wants to minimize the boundary while ensuring all necessary components are included. What should the ISO do?

A security analyst is documenting the authorization boundary for a new system. The system will be deployed on a government cloud environment and will interface with an external identity provider for authentication. The identity provider is owned and operated by another agency. How should the analyst represent the external identity provider in the authorization boundary documentation?

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

A software development company is implementing controls for its CI/CD pipeline. The GRC analyst must ensure that only approved and unaltered code is deployed to production. Which control BEST achieves this objective?

Which TWO of the following are examples of physical security controls?

Which document is used to standardize the implementation of security controls across an organization?

A financial services firm operates a system processing customer credit data under an active Authority to Operate (ATO). A quarterly review shows that a recent operating system upgrade altered the configuration of the audit logging service, causing it to stop forwarding events to the central log server. The GRC analyst must determine the correct action to maintain the system's security posture and ATO validity. What should the analyst do FIRST?

A global retailer's GRC team is preparing for an external audit of its compliance program. The auditor requests evidence that the program's governing body has reviewed and approved the risk appetite and tolerance levels within the last twelve months. Which activity satisfies this request?

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

During continuous monitoring, you discover that a security control that was previously assessed as effective is now failing because the responsible team stopped performing the control due to staff turnover. The control is critical for protecting sensitive data. What is the most appropriate immediate action for the GRC analyst to take?

You are leading a security assessment for a federal agency using NIST SP 800-53A. During the 'Develop Assessment Procedures' step, your team must tailor the assessment procedures to the system's specific environment. Which action should you take FIRST to ensure the procedures are appropriately scoped?

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

A financial services firm is implementing controls for a new mobile banking application that processes customers' personally identifiable information. The GRC analyst must select a control that provides strong confidentiality for data at rest on the mobile device and allows remote verification that the device has not been rooted or jailbroken. Which control BEST meets these requirements?

What is the primary goal of the 'Assessment Reporting' phase?

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

You are the Information System Security Officer (ISSO) for a federal system that has an approved Authority to Operate (ATO). During a continuous monitoring review, the system owner asks you to explain why a new vulnerability scan finding must be documented in the Plan of Action and Milestones (POA&M) rather than simply fixed and closed. What is the most appropriate reason?

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

Which standard provides the framework for conducting information security audits?

A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premises. The system owner wants to maximize efficiency by reducing duplicate documentation. The organization already has an enterprise-wide access control policy and a centralized identity management system. When developing the system security plan, what is the most appropriate approach for addressing the access control family controls?

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

A financial services firm is implementing a new payment processing system. The security architect must ensure that all changes to the production environment are authorized, tested, and documented before deployment. Which of the following controls best addresses this requirement?

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

A GRC practitioner is establishing a process for maintaining the compliance program's documented information. The goal is to ensure that policies, standards, and procedures remain current, authorized, and available to the right audiences. Which TWO of the following activities are essential to this process? (Choose two.)

What is the primary role of the Security Control Assessor (SCA)?

During an assessment of a federal information system, you are evaluating the implementation of the access control policy. You discover that the system administrator has granted temporary elevated privileges to a user for a critical maintenance task, but the privileges were not revoked after the task was completed. According to NIST SP 800-53A, which assessment method would best verify the effectiveness of the account management control?

Which of the following activities is a core component of the 'Ongoing Authorization' process?

A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?

A federal agency is implementing controls to comply with the Federal Information Security Modernization Act (FISMA). The agency uses the NIST Risk Management Framework (RMF). During the control implementation phase, the security team must select controls based on the system's security categorization. Which NIST Special Publication provides the catalog of security and privacy controls?

You are developing a security plan for a system that uses a NIST SP 800-53 control baseline. During control selection, you determine that a particular control is not applicable because the system does not have the relevant technology. How should you document this decision?

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

You are an auditor evaluating the results of a security assessment. The assessment team identified a high-risk finding related to inadequate logging and monitoring. The system owner disagrees with the finding and argues that compensating controls mitigate the risk. As the auditor, what should you do NEXT to resolve this disagreement?

A GRC team is defining the scope of its governance program. The organization wants to ensure that all relevant stakeholders are aware of their roles and responsibilities regarding risk and compliance. Which artifact is most appropriate to document and communicate this information?

A government agency is implementing a new case management system that will store sensitive law enforcement data. The GRC team must ensure that the system meets the requirements of the Criminal Justice Information Services (CJIS) Security Policy. The agency's CIO asks for a control that ensures only authorized personnel can access the system and that their activities are tracked. Which combination of controls should be implemented?

What is the primary benefit of mapping regulatory requirements to internal controls in a GRC platform?