CGRC Practice Questions

Question 1

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Accepted Answer

It reduces the level of effort for the security assessment. A FedRAMP-authorized CSP has already undergone an independent, NIST SP 800-53-based security assessment by a Third-Party Assessment Organization (3PAO) and received an Authority to Operate (ATO) from a federal agency. Federal agencies (and organizations leveraging FedRAMP reciprocity) can reuse that assessment package—the SSP, SAR, and POA&M—rather than performing a full independent assessment of the CSP's environment. This reuse dramatically reduces the level of effort, cost, and time required for the customer's own security authorization activities.

Answer

It guarantees the system will never be breached

Answer

It eliminates the need for any internal security oversight

Answer

It allows the organization to bypass the RMF

Question 2

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

Accepted Answer

Update the SSP to reflect the actual implementation and document the change in the configuration management process.. The correct answer is to update the SSP to reflect the actual implementation. The SSP is a living document that must accurately describe the system's security controls. When an effective control is implemented differently than documented, the SSP should be revised to maintain consistency. This ensures that continuous monitoring and future assessments are based on accurate information.

Answer

Revert the control to match the SSP because the SSP is the authoritative document.

Answer

Initiate a security impact analysis to determine if the change is significant.

Answer

Take no action because the control is still effective and the discrepancy is minor.

Question 3

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Accepted Answer

Self-assessment. A self-assessment is an audit performed by an internal department to evaluate the effectiveness of security controls without external pressure. It is a proactive internal review that helps identify gaps and improve security posture before external audits occur. This type of audit is typically conducted by internal audit teams or security personnel within the organization.

Answer

Third-party assessment

Answer

Penetration test

Answer

Regulatory inspection

Question 4

You are the GRC lead for a U.S. federal agency. A system has an Authorization to Operate (ATO) that expires in 90 days. The system owner submits a revised System Security Plan (SSP) and a new security assessment report showing all controls are still effective, but no changes have been made to the system since the last authorization. According to NIST SP 800-37 Rev. 2, what is the most appropriate action to maintain the authorization?

Accepted Answer

Update the authorization package with the new SSP and assessment results, and continue ongoing authorization without a new authorization decision.. Ongoing authorization allows a system to maintain its ATO through continuous monitoring rather than periodic reauthorization. When no significant changes have occurred and controls are assessed as effective, the authorizing official can continue the authorization based on updated documentation. This approach is risk-based and avoids unnecessary reassessment while ensuring the system remains compliant.

Answer

Allow the ATO to expire and operate the system under an interim authority to test (IATT) until a new authorization can be completed.

Answer

Request a waiver from the authorizing official to extend the ATO indefinitely without any further monitoring or documentation.

Answer

Initiate a full reauthorization process, including a new security assessment of all controls and a new authorization decision.

Question 5

Which document provides the formal authority to operate a system?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document (also called the Authorization to Operate, ATO, or in NIST RMF terms the authorization package's decision) is the formal artifact in which the Authorizing Official accepts the risk and grants authority to operate the system. It is the official record that the system may be placed into operation based on the assessed controls and residual risk.

Answer

System Security Plan

Answer

Risk Assessment Report

Answer

Security Control Assessment

Question 6

A GRC officer is preparing for an annual assessment of a system's continuous monitoring program. The officer must ensure that the program's documentation reflects the current state of security controls. Which of the following artifacts is MOST important to review to verify that the continuous monitoring program is effectively tracking control changes?

Accepted Answer

The continuous monitoring strategy and the associated metrics and reports.. The continuous monitoring strategy and its associated metrics and reports are the most important artifacts because they directly document how controls are monitored, what data is collected, and how that data is reported. This provides verifiable evidence that the program is actively tracking control changes and effectiveness, as required by NIST SP 800-137. Other documents support the program but do not replace the core monitoring artifacts.

Answer

The configuration management plan and change logs.

Answer

The plan of action and milestones (POA&M) and its status reports.

Answer

The system security plan (SSP) and its recent updates.

Question 7

A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact is specifically designed to depict the system boundary and its interfaces?

Accepted Answer

Authorization Boundary Diagram. The Authorization Boundary Diagram is the artifact specifically created to depict the system boundary, including components and interfaces. It provides a clear visual scope for the assessment and is essential for the Authorizing Official to understand what is being authorized. Other documents like the SSP reference the boundary but do not serve as the primary depiction.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Privacy Impact Assessment (PIA)

Question 8

During a system compliance review, the Security Control Assessor (SCA) issues a finding that a critical security control is only partially implemented. The system owner disagrees and wants to proceed with authorization. As the Information System Security Officer (ISSO), what should you do FIRST?

Accepted Answer

Request that the SCA reconsider the finding by providing additional evidence that demonstrates the control is fully implemented.. The ISSO should first attempt to resolve the disagreement by providing additional evidence to the SCA. If the SCA maintains the finding, it becomes a risk that the AO must accept or mitigate. Proceeding directly to a POA&M or AO escalation skips the necessary step of validating the assessment finding.

Answer

Advise the system owner to submit a Plan of Action and Milestones (POA&M) for the partial control and proceed with authorization.

Answer

Escalate the issue to the Authorizing Official (AO) immediately and recommend denying the Authorization to Operate (ATO).

Answer

Document the disagreement in the System Security Plan (SSP) and allow the Authorizing Official (AO) to make the final risk-based decision.

Question 9

When aligning GRC objectives with business goals, which metric best demonstrates the value of an integrated GRC program to a Board of Directors?

Accepted Answer

The percentage reduction in repeat audit findings.. A Board of Directors cares about outcomes that reduce organizational risk and cost while improving compliance posture. A reduction in repeat audit findings demonstrates that the GRC program is not just identifying issues but driving durable remediation — the same problems are not recurring. This metric ties GRC activity directly to improved control effectiveness and lower regulatory exposure, which is the language of the boardroom.

Answer

The number of tickets opened in the GRC helpdesk.

Answer

The total storage space consumed by evidence files.

Answer

The number of users logged into the GRC platform daily.

Question 10

You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a commercial cloud service provider (CSP) for infrastructure as a service (IaaS). The CSP has a FedRAMP authorization at the Moderate impact level. Your system requires additional controls beyond the CSP's baseline. Which action should you take first to address the gap?

Accepted Answer

Implement a control overlay that adds the necessary controls and documents them in the system security plan.. The first step is to implement a control overlay to add the necessary controls to the CSP's Moderate baseline. Overlays are designed to tailor baselines for specific environments or impact levels, enabling the system to meet its security requirements without disrupting the CSP's authorization. This approach is efficient and aligns with NIST guidance.

Answer

Require the CSP to obtain a new FedRAMP authorization at the High impact level before proceeding.

Answer

Document the gap as a risk and accept it without additional controls, since the CSP is already authorized.

Answer

Select a different CSP that already has a FedRAMP High authorization and migrate the system.

Question 11

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Accepted Answer

The SAR evaluates the effectiveness of the controls described in the SSP. The System Security Plan (SSP) documents the system boundary, controls selected and implemented, and how they meet requirements. The Security Assessment Report (SAR) is the output of assessing those controls, evaluating whether the controls described in the SSP are effective. Thus the SAR evaluates the SSP's controls, and both feed the authorization decision.

Answer

The SSP is a summary of the SAR

Answer

They are independent documents with no relationship

Answer

The SAR provides the controls to be documented in the SSP

Question 12

You are the Information System Security Officer (ISSO) for a federal payroll system undergoing an annual assessment. The Security Control Assessor (SCA) reports that a firewall rule allowing inbound RDP from any source is in place, contradicting the documented configuration in the System Security Plan (SSP). The system owner argues the rule is temporary for a migration. What is the most appropriate immediate action?

Accepted Answer

Instruct the network team to remove or restrict the rule immediately, then update the SSP and POA&M to reflect the change.. An undocumented firewall rule allowing unrestricted RDP is a critical finding that must be addressed immediately. The correct approach is to restrict or remove the rule to eliminate exposure, then update the SSP to reflect the actual configuration and create a POA&M entry to track root-cause remediation. This restores compliance and ensures the system operates within its authorized security posture.

Answer

Document the discrepancy in the Plan of Action and Milestones (POA&M) and allow the migration to complete.

Answer

Accept the risk because the system owner has authority over the system and can approve temporary deviations.

Answer

Suspend the system's Authorization to Operate (ATO) until the migration is complete and the rule is removed.

Question 13

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. During the Control Selection phase, the Authorizing Official (AO) is responsible for approving the tailoring decisions made by the system owner and security team, ensuring the selected controls adequately address the system's risk profile. The AO's approval formalizes the agreed-upon control set before it moves into implementation and assessment. This approval is a key governance step that ties control selection to the authorization decision.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 14

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Accepted Answer

The on-premises servers are included in the boundary because they are under the agency's direct control and process CUI.. The boundary should include components under the agency's direct control that process CUI, such as on-premises servers. For cloud services with FedRAMP authorizations, the agency can exclude those components if it documents inherited controls and accepts residual risk. This approach aligns with NIST guidance on leveraging external authorizations and focusing on the agency's own responsibilities.

Answer

The boundary must include all cloud components regardless of the provider's authorization status to ensure end-to-end security.

Answer

The boundary should be defined based on the physical location of the servers to ensure data sovereignty requirements are met.

Answer

The PaaS provider's underlying infrastructure is included in the boundary because the agency's applications run on it.

Question 15

A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?

Accepted Answer

FedRAMP Customer Responsibility Matrix (CRM). The FedRAMP Customer Responsibility Matrix (CRM) is the key document that defines which security controls are inherited from the CSP and which the agency must implement and assess. By using the CRM, the agency can avoid duplicating assessments and focus on its own responsibilities. This leverages the FedRAMP authorization to streamline the ATO process while ensuring all controls are covered.

Answer

FedRAMP Authority to Operate (ATO) letter

Answer

FedRAMP Security Assessment Report (SAR)

Answer

FedRAMP Continuous Monitoring (ConMon) plan

(ISC)2 Certified in Governance, Risk and Compliance CGRC practice test

Three ways to study

Study CGRC by domain

Study CGRC by topic

Scope OF System practice questions

System Compliance practice questions

Control Implementation practice questions

Compliance Maintenance practice questions

Control Selection practice questions

Assessment And Audit practice questions

GRC Program practice questions

CGRC fundamentals practice questions

CGRC scenario practice questions

CGRC troubleshooting practice questions

(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) practice questions