How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CGRC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CGRC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CGRC

exam code

(ISC)²

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CGRC topic practice pages

Control Selection practice questions

GRC Program practice questions

Scope OF System practice questions

System Compliance practice questions

Control Implementation practice questions

Assessment And Audit practice questions

Compliance Maintenance practice questions

CGRC fundamentals practice questions

CGRC scenario practice questions

CGRC troubleshooting practice questions

Practice scenarios

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Which TWO of the following represent best practices for password management?

Which TWO types of controls are specifically examined during an audit?

Which THREE of the following are elements of a secure incident response control set?

Which TWO of the following are primary components of an effective security control assessment report?

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Which THREE activities are part of the 'Assessment Execution' phase?

Which TWO of the following are critical requirements for implementing an effective patch management program?

Which TWO of the following are recommended practices for managing firewall rules?

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Which TWO methods are commonly used to gather assessment evidence?

Which TWO factors contribute to the 'scope' of an information security audit?

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Which THREE of the following are components of a secure server hardening process?

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Which TWO of the following are examples of physical security controls?

Which THREE categories of controls are identified in NIST SP 800-53?