CGRC Exam Questions

An event or situation that has the potential for causing undesirable consequences or impact. Response:

In which type of access control do user ID and password system come under? Response:

The Organization Level (Tier 1) strategy addresses/requires........ Response:

Individual, group, organization, or government that conducts or has the intent to conduct detrimental activities. Response:

Choose from the following options the U.S. government repository of standards-based vulnerability management data where you can easily find the NIST standards for guidance on conti...

In the case of a complex information system, where a "leveraged authorization" that involves two agencies will be conducted, what is the minimum number of system boundaries/accredi...

What is the MOST appropriate action to take after weaknesses or deficiencies in controls are corrected? Response:

You are the project manager for GHY Project and are working to create a risk response for a negative risk. You and the project team have identified the risk that the project may no...

Which of the following are the goals of risk management? Each correct answer represents a complete solution. Choose three. Response:

What would be the impact level due to the loss of CIA that could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, in...

Which of the following is not an authorization decision identified in the RMF? Response:

Sensitivity of a system based on the _________ processed, stored, and transmitted by the system. Response:

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur? Response:

Where would you find standard guidance for determining an organization's risk appetite? Response:

The FISMA defines three security objectives for information and information systems: Response:

Which of the following tasks are identified by the Plan of Action and Milestones document? Each correct answer represents a complete solution. Choose all that apply. Response:

Authentication ensures that system users are who they say the are. At Colvine Tech, a system user must prove identity by providing an email address, a password, and answer a securi...

The ability to quickly adapt and recover from any known or unknown changes to the environment through holistic implementation of risk management, contingency, and continuity planni...

A written plan for recovering one or more information systems at an alternate facility in response to a major hardware or software failure or destruction of facilities. Response:

The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect; a serious adverse effect, or a severe or catastrophic adverse effect on...

Which of the following techniques are used after a security breach and are intended to limit the extent of any damage caused by the incident? Response:

The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational opera...

Which of the following are the common roles with regard to data in an information classification program? Each correct answer represents a complete solution. Choose all that apply....

What RMF artifact establishes the scope of protection for an IS and encompass people, process, and info tech that are part of the system?

The loss of confidentiality, integrity, or availability that could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets,...

The findings from a security control assessment are documented in which of the following documents? Response:

The security control type for an information system that primarily are implemented and executed by people (as opposed to systems). Response:

The security controls for an information system that primarily are implemented by people (as opposed to systems) are known as Response:

The authorizing official may determine that additional information supporting the authorization package is needed. The additional documentation may include all but one of the follo...

A business-based framework for government wide improvement developed by the Office of Management and Budget that is intended to facilitate efforts to transform the federal governme...

You are working as a project manager in your organization. You are nearing the final stages of project execution and looking towards the final risk monitoring and controlling activ...

Defining the types of information needed by the organization to successfully carry out identified missions and business processes as well as defining the organization's internal an...

The set of minimum security controls defined for a low - impact, moderate-impact, or high-impact information system. Response:

The security category of information 1 is determined to be: Confidentiality, low; Integrity, moderate; and availability, Moderate. The security category for information 2 is determ...

The emphasis of the revised NIST SP 800-37 process is on............. Response:

Which of the following is NOT an objective of the security program? Response:

Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?...

Prepare, Categorize, select, and implement are steps or phases of the risk management framework which can be described as Response:

A citizen of the United States or an alien lawfully admitted for permanent residence. Agencies may, consistent with individual practice, choose to extend the protections of the Pri...

The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator. Response:

In which of the following elements of security does the object retain its veracity and is intentionally modified by the authorized subjects? Response:

What is the purpose of a Privacy impact assessment? Response:

A discrete set of resources organized for the collection, processing, maintenance, or disposition of information best describes one of the following Response:

Who is primarily responsible for the withdrawal and decommissioning of and information system? Response:

Tailoring refers to the process by which a security control baseline is modified based on all but one of the following: Response:

Which of the following statements about the authentication concept of information security management is true? Response:

What is the first SDLC phase; which maps to the first two RMF steps (Categorization, Select Controls)? Response:

True or False; After an ATO is granted, ongoing continuous monitoring is performed on all identified security controls as well as physical environment, etc.. Response:

The security control assessor for Colvine Tech will be conducting a comprehensive level assessment on an information system at Colvine Tech. Which controls must be assessed separat...

What is the comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to determi...