CGRC Exam Questions

An authorization approach where multiple organizational officials either from the same organization or different organizations, have a shared interest in authorizing a system is kn...

Which of the following formulas was developed by FIPS 199 for categorization of an information type? Response:

Who is the official with the authority to formally assume responsibility for operating an IS at an acceptable level of risk to agency operations (including mission, functions, imag...

The Information system owner should strive to test every control at least every ___ years & most critical controls continuously. Response:

The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise. What are the responsibili...

The Security Category that guards against the improper modification or destruction of information and includes ensuring information non-repudiation & authenticity. Response:

An organization's information systems are a mix of Windows and UNIX systems located in a single computer room. Access to the computer room is restricted by the use of door locks th...

Functional description of security control implementation must include which of the following, primarily as related to technical controls employed in the system? Response:

Any telecommunications system or information system used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency that (1) the functio...

Colvine Tech implemented security cameras, door locks, and light bulbs to protect its systems from threats. What is the function of security cameras? Response:

The security assessment plan is prepared to provide the Authorizing Official and other organizational officials with a plan of how the security assessment will be conducted. Which...

What is the first step in the process of implementing an Information Security Continuous Monitoring (ISCM)? Response:

In what phases of the RMF and SDLC, respectively, does documentation of control implementation start? Response:

The authorization decision may carry restrictions on system operation and caveats that must be followed to maintain the authorization, and other information as determined by the or...

A certain security principle provides assurance that data has not been modified, tampered with or corrupted through unauthorized or unintended changes. Data can be a message, a fil...

According to NIST SP 800-39, when an organization responds to risk by eliminating the activities or technologies that are the basis for the risk, that organization is Response:

Which of the following processes provides a standard set of activities, general tasks, and a management structure to certify and accredit systems, which maintain the information as...

What are the three primary considerations for defining system boundaries? Response:

The tiers of the National Institute of Standards and Technology (NIST) risk management framework are Response:

Security commensurate with the risk and the magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information. Response:

Under key roles in Continuous Monitoring; the __________ acts under authority of the system owner to monitor security posture of system & immediately reports discrepancies to syste...

Which of the following recovery plans includes specific strategies and actions to deal with specific variances to assumptions resulting in a particular security problem, emergency,...

During which Risk Management Framework (RMF) step is the system security plan initially approved? Response:

Which one of the following publications provides details of the monitoring security control? Response:

At which point in the Risk Management Framework (RMF) process is a system analyzed for changes that impact the security and privacy posture of the system? Response:

A full backup captures all files on the disk or within the folder selected for backup. Because all backed-up files are recorded to a single media or media set, locating a particula...

In what phases of the Risk Management Framework (RMF) and system development life cycle (SDLC), respectively, does documentation of control implementation start? Response:

The mitigation of violations of security policies and recommended practices. Response:

Who has the authority to divide a complex system in order to establish realistic security authorization boundaries? Response:

Which of the following NIST Special Publication documents provides a guideline on network security testing? Response:

Site-specific controls are typically implemented by an organization as what type of controls? Response:

An effective continuous monitoring program can be used to Response:

A specification of security controls, control enhancements, supplemental guidance, and other supporting information employed during the tailoring process, that is intended to compl...

When an authorizing official (AO) submits the security authorization decision, what responses should the information system owner (ISO) expect to receive? Response:

Which of the following assessment methods involves observing or conducting the operation of physical devices? Response:

System authorization programs are marked by frequent failure due to, among other things, poor planning, poor systems inventory, failure to fix responsibility at the system level, a...

Tom is the project manager for his organization. In his project he has recently finished the risk response planning. He tells his manager that he will now need to update the cost a...

Which of the following methods of authentication uses finger prints to identify users? Response:

A predetermined set of instructions or procedures that describe how an organization's mission essential functions will be sustained within 12 hours and for up to 30 days as a resul...

Information Security management is a process of defining the security controls in order to protect information assets. What are the security management responsibilities? Each corre...

Who has the primary responsibility to report the authorization decision? Response:

Which of the following roles is not one of those with primary responsibility for ongoing risk response? Response:

Neil works as a project manager for SoftTech Inc. He is working with Tom, the COO of his company, on several risks within the project. Tom understands that through qualitative anal...

An entity of any size, complexity, or positioning within an organizational structure (e.g., a federal agency, or, as appropriate, any of its operational elements). Response:

The National Institutes of Standards and Technology (NIST) guidance classifies security controls as? Response:

The scope of certification normally addresses all NIST SP _________ control families with the purpose of uncovering design, implementation, and operational flows in those controls....

There are seven risks responses that a project manager can choose from. Which risk response is appropriate for both positive and negative risk events? Response:

Which of the following in an assessment plan protects the security control assessment team from liability should the security control assessment result in unforeseen damage? Respon...

A SCAP specification for communicating the characteristics of vulnerabilities and measuring their relative severity. Response:

What should the system owner use to prioritize mitigation actions when developing the plan of action and milestones (POA&M)? Response: