CGRC Exam Questions

According to FISMA and OMB policy, external subsystems are required to meet the same security requirements as systems operated internally.................... Response:

Organizations consider which of the following factors when selecting security or privacy control assessors? Response:

Which RMF role must ensure security assessment plan is constent with or security objectives, reflects the use of tools, techniques, etc..? Response:

Who provides oversight of activities of the system owner, who provides trend analysis to id problems that may impact security posture. From Enterprise perspective reports to AO and...

What are three examples of data classification found in FIPS PUB 199? Response:

What key information is used by the authorizing official (AO) to assist with the risk determination of an information system (IS)? Response:

The security controls for an information system that focus on the management of risk and the management of information system security are known as: Response:

What is the objective of the Security Accreditation Decision task? Response:

Significant changes to the environment of operation may trigger an event-driven authorization action which may not be limited to all of the following except one. Choose the excepti...

Hardware, software, and firmware are examples of which of the assessment objects exercised by control assessors? Response:

Which of the following is principally used to verify that Information Systems (IS) are meeting their stated security goals and objectives? Response:

Which of the following roles is responsible for review and risk analysis of all contracts on a regular basis? Response:

A set of security controls resulting from the application of tailoring guidance to the security control baseline. Response:

Of the ensuing potential inputs to the Authorization package, one is not a living document. Which one? Response:

Which of the following is NOT considered an environmental threat source? Response:

What kind of approach does BRM provides? Response:

What is RMF Step 2? Response:

Which of the following concepts represent the three fundamental principles of information security? Each correct answer represents a complete solution. Choose three. Response:

The test plan should evaluate plans that support the IS; such as Incident Response, Disaster Recovery, and _______________ Plan to ensure they are up to date & meet the protection...

Task five of the Authorize step is authorization reporting. Which of the following best explains why authorization reporting is carried out? Response:

When an ATO is issued, which of the following roles authoritatively accepts residual risk on behalf of the organization? Response:

What are the four business areas of BRM? Response:

The person primarily responsible for RMF Step 1, Categorization. Response:

Which security Objective ensures that data accuracy is maintained? Response:

A continuous monitoring strategy for a new system is developed during which phase of the system development life cycle? Response:

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing s...

True or False. Impacts of changes should be known in advance so that appropriate actions can be taken before vulnerabilities are experienced. Response:

Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Whic...

Which of the following is not a risk factor as stated in NIST SP 800-37? Response:

When attempting to categorize a system which two RMF starting point inputs should be accounted for and are critical input to Categorization? Response:

A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required...

A security control that is implemented in an information system in part as a common control and in part as a system-specific control. See also Common Control and System-Specific Se...

The ability of an information system to continue to: (i) operate under adverse conditions or stress, even if in a degraded or debilated state, while maintaining essential operation...

Any telecommunications or information system that is defined as a national security system (FISMA 2002) because it processes any information the loss, misuse, disclosure, or unauth...

The Risk Management Framwork (RMF) provides an organized approach for organization-wide risk management. What are the tiers of the organization-wide perspective? Response:

Which of the following administrative policy controls requires individuals or organizations to be engaged in good business practices relative to the organization's industry? Respon...

What is the system development life cycle phase for step six of the RMF for an existing system? Response:

Which of the following is the acronym of RTM? Response:

According to NIST SP 800-37 Rev 2 appendix F, there are several types of authorizations including all of the following, except one. Response:

After a monthly change control board meeting at which the team determined the security impact of proposed changes to an application, what would be the team's next action? Response:

Besides the System Owner (SO), what role has the PRIMARY responsibility for implementing the security controls in the security and privacy plans for an Information Systems (IS)? Re...

The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation. What are the process...

Risk acceptance when the external subsystem owner or service provider cannot fully meet security expectations should be based on the implementation of........ Response:

The process of determining the security category for information or an information system. Security categorization methodologies are described in CNSS Instruction 1253 for national...

National Institute of Standards and Technology (NIST) guidance classifies security controls as Response:

Jeff, a key stakeholder in your project, wants to know how the risk exposure for the risk events is calculated during quantitative risk analysis. He is worried about the risk expos...

What is the 3rd SDLC phase; which maps to RMF step 5 (Authorize)? Response:

Which of the following is a risk that is created by the response to another risk? Response:

NIST guidance classifies security controls as Response:

Who initiates system authorization process and has the full responsibility over the life cycle of an information system? Response: