(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 151–199

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Which TWO of the following are primary components of an effective security control assessment report?

A multinational company needs to ensure that GRC data access complies with regional data residency laws. Which configuration feature should be utilized?

During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

In VMware vSphere, what is the best practice for securing virtual machine consoles?

Your GRC program requires that assessment evidence be stored in an immutable state for three years. In the GRC platform, which feature ensures this integrity?

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

You need to enforce MFA on Azure AD (Microsoft Entra ID) users. Which policy type is the most recommended for modern authentication control?

When configuring an email security gateway (e.g., Proofpoint), which record should be added to DNS to prevent domain spoofing?

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

Which THREE of the following roles are typically involved in a GRC Steering Committee?

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

Which TWO of the following are recommended practices for managing firewall rules?

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

When documenting a GRC policy, which TWO elements should be included to ensure effective governance?

Which THREE of the following are elements of a secure incident response control set?

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Which TWO of the following are examples of physical security controls?

Which document is used to standardize the implementation of security controls across an organization?

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

You are securing a database server. What is the most effective administrative control to minimize the impact of a compromised DBA account?

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

You need to ensure that the 'Compliance Dashboard' is updated only when the 'Assessment Completion' status is 'Verified'. How can you achieve this?

What is the primary goal of the 'Assessment Reporting' phase?

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Your GRC platform allows for 'Risk Heat Map' visualization. An executive wants to see only risks associated with 'Cybersecurity'. Which feature should you configure to support this view?

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

You are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?

A developer needs to access a production server. To maintain the highest level of security, how should you implement this access?

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

Which standard provides the framework for conducting information security audits?

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

Which of the following describes a 'Hybrid' control?

What is the primary role of the Security Control Assessor (SCA)?

Which of the following activities is a core component of the 'Ongoing Authorization' process?

A GRC practitioner is auditing access. Which report provides the best overview of who has 'Write' access to sensitive compliance evidence?

You are deploying an EDR (Endpoint Detection and Response) solution. Which configuration minimizes false positives while maintaining visibility?

What is the primary benefit of mapping regulatory requirements to internal controls in a GRC platform?