CGRC GRC Program Practice Question
You are configuring a GRC workflow to address 'High' severity findings. The requirement is that any finding classified as 'High' must be approved by the CISO before moving to the 'Remediated' state. Which mechanism should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up a Workflow Transition Condition triggered by the 'Severity' field.
Workflow automation engines in GRC platforms use conditional logic transitions to route tasks based on field values like 'Severity'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set up a Workflow Transition Condition triggered by the 'Severity' field.
Why this is correct
Workflow transitions allow for conditional routing based on specific metadata values.
- ✗
Configure a global Business Rule to auto-close all findings.
Why it's wrong here
This bypasses the CISO approval requirement.
- ✗
Change the default notification email template for findings.
Why it's wrong here
Notifications only inform users, they do not enforce workflow logic.
- ✗
Modify the User Permission set for the CISO account.
Why it's wrong here
Permissions control access, not the automated movement of task states.
About these practice questions
One of 199 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.