CGRC Practice Question: Your GRC program requires that assessment evidence be stored in an immutable state for…
Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?
⚠ Common exam trap
CGRC often tests the confusion between access control (who can see or delete) and immutability (whether a record can be changed at all), leading candidates to pick permission-based answers instead of retention/lock features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Applying an 'Evidence Lock' or 'Retention Policy' to the record.
An 'Evidence Lock' or 'Retention Policy' is the correct feature because it enforces immutability at the record level, preventing modification or deletion for the defined retention period (three years). This satisfies evidentiary integrity requirements by ensuring the evidence cannot be altered after collection. It also produces an auditable control that maps directly to retention and chain-of-custody obligations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Applying an 'Evidence Lock' or 'Retention Policy' to the record.
Why this is correct
An Evidence Lock or Retention Policy prevents modification or deletion of the stored record for the defined period, preserving it in an immutable state. This directly enforces the three-year immutability constraint the GRC programme requires for assessment evidence.
- ✗
Disabling the record deletion permission for all users.
Why it's wrong here
Disabling deletion permissions only blocks removal through the platform's own interface; it leaves records mutable, so edits and overwrites still occur, and administrators can re-enable the permission. It is tempting because permission restriction genuinely supports retention and access control, and would suit scenarios demanding least privilege or preventing accidental deletion, but it cannot deliver cryptographic immutability.
- ✗
Setting the record visibility to 'Public'.
Why it's wrong here
Public visibility only widens who can read a record; it grants no write protection, so evidence remains editable and deletable. Visibility settings suit sharing records across teams, not enforcing immutability for a three-year retention requirement.
- ✗
Setting the 'Draft' workflow state to permanent.
Why it's wrong here
A permanent Draft state merely fixes the workflow stage; records stay editable and deletable, so immutability is not achieved. Permanent draft states suit evidence still being authored, not retention-locked assessment evidence held for three years.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A GRC manager is establishing a process to manage exceptions to security policies. The goal is to ensure that exceptions…
- A newly formed GRC team at a logistics company is drafting the organization's first compliance program. The team lead wa…
- A healthcare organization's GRC team is defining key risk indicators (KRIs) for its patient data protection program. The…
- Which THREE of the following roles are typically involved in a GRC Steering Committee?
- When documenting a GRC policy, which TWO elements should be included to ensure effective governance?
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.