Courseiva
Free · No account needed · No credit card

(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) Practice Test

341 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.

Instant feedback after each answer
Full explanations included
Domain score breakdown
Real exam: 180 min
Pass mark: 700 out of 1,000

Sample questions with explanations

This is exactly what you see during practice — question, options, and a full explanation after you answer.

Q1Assessment And Auditmedium
Full explanation →

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

To provide a language for checking system configuration stateCorrect
BTo standardize the transfer of vulnerability data
CTo define the severity of a vulnerability
DTo manage the lifecycle of a POA&M

OVAL (Open Vulnerability and Assessment Language) is the SCAP component that provides a standardized language for expressing system state checks — it defines how to test for specific configurations, patches, and vulnerabilities on a host. OVAL definitions contain tests, objects, …Read full explanation

Q2Assessment And Auditmedium
Full explanation →

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

AAnalyze Security Assessment Results
BDevelop the Plan of Action and Milestones (POA&M)
Assess Security ControlsCorrect
DAuthorize the Information System

NIST SP 800-53A defines the security control assessment process as: Prepare for Assessment, Assess Security Controls, Analyze Security Assessment Results, and Document/Report. Immediately after 'Prepare for Assessment' (which includes developing the assessment plan, selecting con…Read full explanation

Q3Assessment And Auditeasy
Full explanation →

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

AInterconnection Security Agreement
Rules of EngagementCorrect
CSecurity Assessment Plan
DRisk Assessment Report

The Rules of Engagement (RoE) is the formal document that defines the scope, boundaries, timing, and authorized activities of a security assessment, and it is signed by both the assessor and the target organization before testing begins. It establishes what systems may be tested,…Read full explanation

What's covered

Questions are tagged by exam domain. Practice a specific domain or mix them all.

Untimed Practice

Answer at your own pace. Explanation and domain tag shown immediately after each answer.

Timed Practice

Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.

Why practice here?

Full explanations on every question

Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.

Domain score breakdown

After each session see your score by exam domain so you know exactly where to focus study time.

100% free, forever

No subscription, no trial, no email wall. Start a session in under 10 seconds.

Exam-style questions

Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.

← All CGRC questionsCGRC exam guideStudy guidePractice by domain