CGRC Practice Question: Documenting the system inventory in the Security Assessment Plan (SAP)
You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?
⚠ Common exam trap
CGRC often tests the difference between artifacts that describe 'what the system is' (topology, SSP) versus 'what is wrong with it' (scan reports, risk register) — candidates who focus on security posture pick the vulnerability scan instead of the topology diagram.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A comprehensive network topology diagram showing external service endpoints.
A network topology diagram that shows external service endpoints, connection paths, and system boundaries is the most effective artifact for demonstrating that all system interconnections have been inventoried, because it visually and explicitly maps every connection into and out of the system. The SAP references this diagram to support the interconnection inventory required by NIST 800-53 controls like CA-3 and SA-9. Vulnerability scans, risk registers, and patch lists do not enumerate interconnections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The system's latest vulnerability scan report.
Why it's wrong here
A vulnerability scan enumerates software flaws on hosts, not communication paths between systems, so it cannot evidence interconnection inventory. It is tempting because scans do discover live hosts and open ports, and would suit validating exposure of known interconnections rather than identifying them.
- ✓
A comprehensive network topology diagram showing external service endpoints.
Why this is correct
A network topology diagram maps every interconnection and external service endpoint, directly satisfying the SAP requirement to demonstrate complete interconnection inventory. Unlike prose lists, its visual structure exposes undocumented links and data flows, making omissions immediately apparent during assessment. This evidentiary completeness is what proves all system interconnections have been properly inventoried.
- ✗
The organization's enterprise risk register.
Why it's wrong here
A risk register records identified risks and treatments, not the authoritative inventory of system interconnections required by the SAP. It is tempting because it catalogues organisational exposures, but interconnection inventory belongs in the system inventory and boundary documentation instead.
- ✗
A listing of all installed software patches.
Why it's wrong here
Patch listings evidence software maintenance status, not the interconnections between systems that the SAP inventory must demonstrate. It is tempting because patch data supports other assessment objectives, but it cannot show which systems connect to which external or internal counterparts.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which NIST publication provides the definitive guidance on FIPS 199 security categorization?
- When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)
- When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?
- Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THR…
- Which of the following is an example of a 'System Boundary' document that assists with the RMF process?
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.