CGRC Assessing a system Practice Question
You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?
⚠ Common exam trap
CGRC often tests the misconception that inherited controls require no verification, when in fact the system owner must obtain and review evidence from the common control provider.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
That the common control provider provides evidence of compliance.
When a control is marked 'Inherited', the system owner is relying on a common control provider (CCP) to implement and assess that control. The most critical verification is that the CCP provides evidence of compliance, such as assessment reports or authorization documentation, to ensure the control is actually effective for the system's scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
That the control is listed in the system's own configuration guide.
Why it's wrong here
Inherited controls derive assurance from the providing organisation's authorisation boundary and assessment, not from appearing in the system's own documentation. It is tempting because configuration guides are a normal artefact assessors review, so listing a control there looks like sufficient evidence that it operates.
- ✗
That the system owner has full administrative control.
Why it's wrong here
An inherited control is provided by a common control provider, so the critical check is that the provider's authorisation boundary and assessment cover this system, not who holds administrative rights. It is tempting because system owners are accountable for their systems, and administrative control sounds like the assurance an assessor needs.
- ✓
That the common control provider provides evidence of compliance.
Why this is correct
An inherited control's compliance depends entirely on the common control provider, so the critical verification is obtaining evidence that the provider actually implements and monitors the control. Without that evidence, the inheriting system cannot claim the control satisfies its own security requirement.
- ✗
That the control is manually tested by the system team.
Why it's wrong here
Inherited controls are assessed by the providing organisation, so the assessor verifies the provider's authorisation and evidence rather than requiring the system team to retest manually. It is tempting because manual testing is a recognised assessment method, so it appears to give direct assurance over the inherited control.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a com…
- You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (P…
- Which document defines the security control baselines (Low, Moderate, High) for federal information systems?
- A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is…
- You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation appro…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.