CGRC Practice Question: Preparing a security plan for a federal information system categorized as MODERATE impact
You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?
⚠ Common exam trap
CGRC often tests the distinction between baseline selection (choosing the standardized starting set) and tailoring (customizing it), so candidates who conflate the two pick options about removing or compensating controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide a standardized starting point based on impact level.
NIST SP 800-53B defines control baselines (Low, Moderate, High, Privacy) as standardized sets of controls derived from SP 800-53 that serve as a starting point for any system at a given impact level. For a MODERATE-impact federal system, the initial baseline is the Moderate baseline, which the organization then tailors (scoping, parameterization, compensating controls) to fit the specific system. The baseline's purpose is to give a consistent, defensible foundation rather than a system-specific final control set.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To remove all controls that do not apply to the local network.
Why it's wrong here
Baseline selection starts from the NIST SP 800-53B catalogue for the system's impact level; tailoring then removes or scopes controls, not the initial selection. It is tempting because tailoring is a real later step, and it would be correct if the question asked how controls are adjusted to fit a specific system's environment.
- ✗
To define the continuous monitoring strategy for the system.
Why it's wrong here
Continuous monitoring strategy is defined later, in the monitor step of the RMF, not during initial baseline selection. It is tempting because monitoring is part of the wider RMF lifecycle, and it would be correct if the question asked how an organisation maintains ongoing situational awareness of control effectiveness after authorisation.
- ✓
To provide a standardized starting point based on impact level.
Why this is correct
NIST SP 800-53B baselines map MODERATE impact systems to a predefined set of controls, giving a standardised starting point before tailoring. This satisfies the stem's objective by ensuring consistent, impact-appropriate coverage rather than selecting controls ad hoc.
- ✗
To identify all system-specific compensations.
Why it's wrong here
Compensating controls address requirements a system cannot meet directly, so they are identified during tailoring, not baseline selection. The initial baseline derives from the FIPS 199 impact categorisation, which determines the starting control set. Identifying compensations would be correct later, when documenting how a specific control is satisfied by an alternative mechanism.
About these practice questions
This CGRC question is part of Courseiva's 341-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are selecting controls for a cloud-based system that will be used by a government agency. The cloud service provider…
- You are tailoring the NIST SP 800-53 Rev. 5 Moderate baseline for a system that will be deployed in a tactical edge envi…
- What is the primary role of the authorization official (AO) during the Control Selection phase?
- A security manager is tailoring a NIST SP 800-53 control baseline for a system that processes sensitive but unclassified…
- When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship be…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.