CGRC Practice Question: During a control audit, you find that the organization has documented a 'common control'…
During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?
⚠ Common exam trap
The trap is thinking that individual systems must still address the control or override it, when in fact common controls are inherited and do not require duplication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Individual systems do not need to address password complexity.
A 'common control' is a control that is implemented once and inherited by multiple systems. If the organization has documented a common control for password complexity, individual systems do not need to address password complexity separately because they inherit the control from the common control provider. This avoids duplication and ensures consistency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Individual systems must override the common control.
Why it's wrong here
Systems inherit common controls rather than overriding them; an override would break the shared inheritance model and duplicate the control. It is tempting because system-specific tuning of parameters feels necessary, but tailoring happens within the inherited control, not by replacing it.
- ✗
Common controls cannot be used for password complexity.
Why it's wrong here
Common controls are inherited by systems, so password complexity can absolutely be documented as one; the claim of impossibility is false. It is tempting because common controls are often infrastructure-level, yet password policy is a legitimate shared control inherited by every system in scope.
- ✗
Individual systems must report their own password status.
Why it's wrong here
Inheriting a common control means systems do not separately report that control's status; the common control provider does. It is tempting because each system still owns its own authorisation boundary, yet password complexity status is reported once at the common control level.
- ✓
Individual systems do not need to address password complexity.
Why this is correct
A common control is implemented once and inherited by multiple systems, so individual systems inherit password complexity rather than reimplementing it. This satisfies the audit finding by avoiding duplicate controls across systems covered by the common control.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are a security architect selecting controls for a new federal payroll system categorized as MODERATE impact. The sys…
- You are a risk practitioner for a healthcare organization. You are selecting controls for a system that processes electr…
- An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official…
- You are a security analyst at a hospital that must comply with HIPAA and NIST SP 800-53. You are selecting controls for…
- You are a security architect for a federal agency. You are selecting controls for a new high-impact system that processe…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.