CGRC Practice Question: When selecting controls for a system that uses mobile devices, you apply an overlay
When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?
⚠ Common exam trap
CGRC often tests the relationship between baselines and overlays; candidates may incorrectly think an overlay replaces the baseline or is only for high-impact systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The overlay supplements the baseline.
In NIST SP 800-53, an overlay is a set of additional or modified controls applied to a baseline to address specific technology, environment, or mission needs. The overlay supplements the baseline (Option A) by adding controls or tailoring existing ones; it does not replace or discard the baseline. The baseline remains the foundation, and the overlay enhances it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The overlay supplements the baseline.
Why this is correct
An overlay is applied on top of an existing baseline, adding, tailoring or strengthening controls for a specific technology such as mobile devices. It never replaces the baseline; it extends it, so the baseline remains the foundation.
- ✗
The overlay is used only if the system is High impact.
Why it's wrong here
Overlays are applied regardless of impact level; they tailor a baseline to specific technologies, environments or threat concerns, and can supplement Low or Moderate baselines too. Restricting them to High impact is tempting because High systems attract extra controls, but impact categorisation is not the trigger.
- ✗
The baseline is discarded if an overlay is used.
Why it's wrong here
The baseline stays selected and the overlay supplements it with mobile-specific controls; discarding the baseline removes the common control set the overlay builds upon. Overlays are tempting because they tailor controls to a technology, but they are additive by design, not a substitute that voids the underlying baseline.
- ✗
The overlay replaces the entire baseline.
Why it's wrong here
An overlay adds or strengthens controls for a specific technology or environment; it does not supersede the baseline, which remains in force. Replacing the baseline would drop the common controls the overlay assumes. Overlays are tempting because they are applied on top of a chosen baseline, but that layering is exactly why the baseline persists.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which THREE of the following are benefits of using the NIST 800-53 control framework?
- You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider.…
- When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?
- Which THREE of the following are components that must be included when documenting a compensating control?
- A security analyst is selecting controls for a new information system based on NIST SP 800-53 Rev. 5. The system has bee…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.