How should I use these Control Selection practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Control Selection questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Control Selection domain.

CGRC · topic practice

Control Selection practice questions

Practise (ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) Control Selection practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Control Selection

Practice 10 questions Browse domain →

What the exam tests

What to know about Control Selection

Control Selection questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Control Selection exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Control Selection questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Control Selection explanation →

Which of the following is the first step in the RMF that involves the selection of security controls?

Trap 1: Categorize.

Categorization comes before selection.

Trap 2: Assess.

Assessment occurs after implementation.

Trap 3: Implement.

Implementation follows selection.

Study all Control Selection common traps →

A
Categorize.
Why wrong: Categorization comes before selection.
B
Assess.
Why wrong: Assessment occurs after implementation.
C
Implement.
Why wrong: Implementation follows selection.
D
Select.
Select is the correct step for control choice.

Control Selection practice questions

What to know about Control Selection

Common Control Selection exam traps

Control Selection questions

Which of the following is the first step in the RMF that involves the selection of security controls?

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

What document provides the most granular guidance on tailoring security controls for federal systems?

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

What is the primary role of the authorization official (AO) during the Control Selection phase?

During tailoring, what is the 'Refinement' process?

If a control is determined to be 'system-specific', what does that mean?

Which of the following describes a 'Hybrid' control?

Which TWO of the following characterize the 'Select' step in the RMF?

Track your progress over time

Start a Control Selection only practice session

Related CGRC topic practice pages

Control Selection practice questions

GRC Program practice questions

Scope OF System practice questions

System Compliance practice questions

Control Implementation practice questions

Assessment And Audit practice questions

Compliance Maintenance practice questions

CGRC fundamentals practice questions

CGRC scenario practice questions

CGRC troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid