CGRC Exam Questions

The tiers of the NIST RMF are Response:

The objective of Configuration Manager and control is "not to" document all proposed or actual changes to an IS & to assess the impact of changes on security of system. Response:

Normally the requirements documented in the __________ ________ document will formulate the scope of SCA testing. Response:

Which of the following individuals is responsible for preparing and submitting security status reports to the organizations? Response:

The overall length of time an information system's components can be in the recovery phase before negatively impacting the organization's mission or mission/business functions. Res...

Security testing that involves direct interaction with a target, such as sending packets to a target. Response:

Which of the following are included in Administrative Controls? Each correct answer represents a complete solution. Choose all that apply. Response:

Which of the following statements about the availability concept of Information security management is true? Response:

A discussion-based exercise where personnel with roles and responsibilities in a particular IT plan meet in a classroom setting or in breakout groups to validate the content of the...

Who makes decision to require an IS to under re-accreditation based on security status reporting & documentation & recommendation of Designated Rep & IT security staff? Response:

Which of the following are included in Technical Controls? correct answer represents a complete solution. Choose all that apply. Response:

Information developed from Federal Information Processing Standard (FIPS) 199 may be used as an input to which authorization package document? Response:

Fill in the blank with an appropriate word. ________ ensures that the information is not disclosed to unauthorized persons or processes. Solution: Confidentiality Determine whether...

Which NIST publication is the Guide to applying RMF in Federal Info Systems a Security Life cycle approach & moved process from four phase certification & accreditation approach to...

Which SDLC phase can use the System Authorization package to assist with decommissioning tasks for an IS? Response:

The use of automation to manage changes to the information system or its environment of operation facilitates Response:

A major subdivision or component of an information system consisting of information, information technology, and personnel that perform one or more specific functions. Response:

What is the publication that has the Minimum Security Requirements for Federal Information and Information Systems. Response:

Which of the following recovery plans includes a monitoring process and triggers for initiating planned actions? Response:

When an authorization to operate (ATO) is issued, which of the following roles authoritatively accepts residual risk on behalf of the organization? Response:

Which Certification Level of Effort is indicated by exercise-based and independent assessments? Response:

What type of testing is a Physical review or examination of control such as review of the security setting or software version number? Response:

Your project has several risks that may cause serious financial impact should they happen. You have studied the risk events and made some potential risk responses for the risk even...

The process by which a security control baseline is modified based on: (i) the application of scoping guidance; (ii) the specification of compensating security controls, if needed;...

System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process. What are the diffe...

The purpose of security controls testing is to evaluate the _________________ of the security controls protecting an information system. Response:

Step 7 of the risk management framework can be described as: Response:

An organization's decision on acceptable degrees of residual risks should be based on; choose one. Response:

A General principle is that the scope of certification testing should include all controls defined in what document; SAR, SP, POAM? Response:

For which of the following reporting requirements are continuous monitoring documentation reports used? Response:

Which of the following is a subset discipline of Corporate Governance focused on information security systems and their performance and risk management? Response:

An organization monitors the hard disks of its employees' computers from time to time. Which policy does this pertain to? Response:

The RMF Step and task where the Categorization of the information and IS is done and results documented in the Security Plan (SP) Response:

Change management is initiated under which phase? Response:

The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecomm...

Process of controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modification prior to, during, and after...

You are the project manager of the NHH project for your company. You have completed the first round of risk management planning and have created four outputs of the risk response p...

What is the 1st task in Security Controls Assessment; where the assessment plan is developed, reviewed, and approved to assess the controls? Response:

Which role has the supporting responsibility to coordinate changes to the system, assess the security impact and update the system security plan? Response:

A security control for an information system that has not been designated as a common security control or the portion of a hybrid control that is to be implemented within an inform...

The potential impact is moderate if-The loss of confidentiality, integrity, or availability could be expected to have a.......................... Response:

According to NIST SP 800-37 Rev 2 appendix F, there exists several types of authorization decisions including all of the following except one. Response:

Which of the following persons is responsible for testing and verifying whether the security policy is properly implemented, and the derived security solutions are adequate or not?...

Updating the security plan, security assessment report, and POAM based on results of the continuous monitoring process is what task in RMF Step 6, Monitor. Response:

NIST 800-53 identifies continuous monitoring as which of the following security control? Response:

A passive technique that monitors network communication, decodes protocols, and examines headers and payloads for information of interest. It is both a review technique and a targe...

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal de...

What course of action can be taken by a party if the current negotiations fail and an agreement cannot be reached? Response:

The documentation of a predetermined set of instructions or procedures that describe how an organization's mission/business functions will be sustained during and after a significa...

"The authorization for the system or the common control is approved or denied" is an an outcome of which of the ensuing tasks? Response: