CGRC Practice Question: Which TWO of the following are considered 'common controls'?
Which TWO of the following are considered 'common controls'?
⚠ Common exam trap
CGRC often tests the misconception that any control implemented at the enterprise level is automatically a common control, when in fact it must be provided by a common control provider and formally inherited by multiple systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physical building access badges.
In security control categorization, 'common controls' are controls that are inherited by or shared across multiple systems rather than being unique to a single information system. Option C (physical building access badges) is a common control because facility-level physical access mechanisms protect all systems and personnel within the building, not just one application. Option E (network boundary protection/firewall for the data center) is a common control because the firewall at the data center perimeter provides shared network protection for every system hosted behind it. By contrast, options A (custom source code of a business logic application), B (application-specific encryption keys), and D (the specific database schema of a custom app) are all system-specific controls tied to one particular application, so they are not shared or inherited across systems and therefore are not common controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The custom source code of a business logic application.
Why it's wrong here
Custom business-logic source code is application-specific, so it cannot be inherited or shared across systems as a common control. It tempts architects because bespoke code often embeds reusable security logic, yet common controls must be enterprise-wide and system-independent, such as an organisation-wide access management policy.
- ✗
Application-specific encryption keys.
Why it's wrong here
Application-specific encryption keys are scoped to one system, so they cannot serve as an enterprise-wide common control inherited by many systems. They tempt because encryption is a security control, but common controls must apply across systems; keys are unique per application, unlike a shared key-management policy.
- ✓
Physical building access badges.
Why this is correct
Physical building access badges operate across all systems within a facility, so a single implementation satisfies the security requirement for every system hosted there. This shared, inherited nature is precisely what defines a common control, contrasting with system-specific controls tailored to one information system's particular needs.
- ✗
The specific database schema of a custom app.
Why it's wrong here
A custom app's database schema is application-specific, so it cannot be inherited or reused across systems. It tempts because shared components sound reusable, yet common controls are enterprise-wide safeguards such as an organisation's access-review process or incident-response policy.
- ✓
Network boundary protection (firewall) for the data center.
Why this is correct
A firewall protecting the data center serves every system within that boundary, so it is inherited rather than system-specific. This satisfies the stem's 'common controls' criterion: controls shared across multiple systems, scoped to the infrastructure layer, and documented once in the security plan.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are a security manager for a federal agency. You are selecting controls for a new information system using NIST SP 8…
- Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using a…
- Which THREE factors should an organization consider when applying control overlays?
- A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organi…
- You are tailoring a NIST SP 800-53 baseline for a new system. The system owner asks you to identify the reasons why a co…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.