CGRC Exam Questions

The authorizing official may choose to authorize the system to operate only for a short period of time if it is necessary to test the system in the environment of operation before...

Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy. Response:

What are the four phases for interconnecting systems? Response:

The guidelines in this publication apply to the security controls defined in NIST Special Publication 800 53 in an effort to enable more consistent, comparable, and repeatable asse...

Which of the following control families belongs to the management class of security controls? Response:

Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into productio...

An authentication method uses smart cards as well as usernames and passwords for authentication. Which of the following authentication methods is being referred to? Response:

Who has the responsibility to track corrective actions to their completion keeping the approving authority informed with periodic updates as directed? Response:

Volatile security controls are assessed more frequently with objective to establish security control effectiveness or to support the calculation of a metric. Which of the following...

Risks with low ratings of probability and impact are included on a ____ for future monitoring. Response:

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three....

What is the system development life cycle phase for step six of the RMF for a new system? Response:

Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will h...

Developmental testing and evaluation is a type of control Assessment and its activities include the following except one. Response:

To help review or design security controls, they can be classified by several criteri

Who has primary responsibility to develop a report of the results of the security and privacy control assessments, including recommendations for correcting deficiencies in the impl...

The transfer of risk is one of the five risk treatment methods pointed out in NIST 800-37 Rev 2. Choose an example of risk transfer from the following options. Response:

A part of tailoring guidance providing organizations with specific policy/regulatory -related, technology-related, system component allocation-related, operational/environmental-re...

Information Security management is a process of defining the security controls in order to protect information assets. The first action of a management program to implement informa...

Which of the following are phases of the National Institute of Standards and Technology (NIST) Risk Management Framework? Response:

Assessment plans should be prepared _______ of the testing and forwarded to all involved for review and approval. Response:

Risk assessments at the organizational level leverages aggregated information from system-level risk assessment results, continuous monitoring and any startegic risk considerations...

A specific category of information (e.g., privacy, medical, proprietary, financial, investigative, contractor sensitive, security management), defined by an organization or in some...

What is the name of the formal document that provides an overview of security requirements for the information system and describes the security controls in place or planned for me...

Security testing conducted from inside the organization's security perimeter. Response:

ISO 17799 has two parts. The first part is an implementation guide with guidelines on how to build a comprehensive information security infrastructure and the second part is an aud...

Which of the following components ensures that risks are examined for all new proposed change requests in the change control system? Response:

Which document in support of the authorization package contains the well-defined set of security controls for an information system? Response:

NIST SP 800-53 describes a family of controls as: Response:

What are the 2 activities involved in certification testing? Response:

In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an in...

Any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency. Respon...

A differential backup stores files that were created or modified since the last full backup. Therefore, if a file is changed after the previous full backup, a differential backup w...

Which FIPS publication specifies security requirements for federal information and information systems in 17 security related areas that represent a broad-based, balanced informati...

The change control board team at Colvine Tech has determined the security impact of proposed changes to an application, what would be the team's next action? Response:

Which of the following refers to the ability to ensure that the data is not modified or tampered with? Response:

Documenting the description of the system in the SSP is the primary responsibility of which RMF role? Response:

Ongoing authorizations and reporting can be time- and event-driven. Which official has the primary responsibility for ongoing authorizations? Response:

What does OCTAVE stand for? Response:

Which organizational official is responsible for the procurement, development, integration, modification, operation, maintenance, and disposal of an information system? Response:

NIST SP 800-64 Rev 2 has been withdrawn but security professionals can still find guidance on system development lifecycle in which Publication? Response:

An effective security control monitoring strategy for an information system includes Response:

In which of the following Risk Management Framework (RMF) phases is a risk profile created for threats? Response:

In which of the 6 steps of RMF is the System Boundary defined? Response:

What RMF role is responsible for assessing impact of changes on systems, process it supports, & data it processes (ISO, AO, ISSO)? Response:

Which of the following refers to an information security document that is used in the United States Department of Defense (DoD) to describe and accredit networks and systems? Respo...

Which reference document describes the contents of a Plan of Action and Milestone (POA&M) updating and replacing OMB M 02-01? Response:

The use of automation to conduct security control assessments should be maximized to do the following except one. Response:

What are five primary roles associated with the system authorization program? Response:

A system of organizations, people, activities, information, and resources, possibly international in scope, that provides products or services to consumers. Response: