How many Hard Difficulty Questions questions are on this page?

This page has 20 Hard Difficulty Questions scenario questions for the CGRC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CGRC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) questions

Scenario-based practice

Hard Difficulty Questions

Practise (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CGRC

exam code

(ISC)²

vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

A
The system's latest vulnerability scan report.
Why wrong: Scans show status, not the scope of defined connections.
B
A comprehensive network topology diagram showing external service endpoints.
A topology diagram is the primary artifact for visualizing and validating the system boundary.
C
The organization's enterprise risk register.
Why wrong: The risk register is an aggregate view and lacks technical detail on specific connections.
D
A listing of all installed software patches.
Why wrong: Patch status is irrelevant to the scope of interconnections.

Hard Difficulty Questions

How to approach hard difficulty questions

Quick answer

Related CGRC topic practice pages

Control Selection practice questions

GRC Program practice questions

Scope OF System practice questions

System Compliance practice questions

Control Implementation practice questions

Assessment And Audit practice questions

Compliance Maintenance practice questions

CGRC fundamentals practice questions

CGRC scenario practice questions

CGRC troubleshooting practice questions

Practice scenarios

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Which THREE of the following are elements of a secure incident response control set?

You are deploying a PKI solution using Microsoft AD CS. You need to ensure that compromised certificates can be revoked. What must be configured?

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Which technique is best to detect 'false negatives' during a security control assessment?

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

You are implementing Windows AppLocker. You want to ensure that only signed binaries from your organization are executed. Which configuration should you choose?

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

When implementing an 802.1X environment, what is the role of the RADIUS server?

You are hardening a web server. You need to ensure that only secure ciphers are used for TLS connections. Where is this typically configured?

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?