CGRC Exam Questions

The primary responsibility to select control assessors rests on which roles? Response:

Which plan documents objectives for the security control assessment & details how to conduct such an assessment and records assessment procedures (Security Plan, Assessment Plan, P...

What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope? Response:

According to NIST SP 800-53 Rev 5, security controls are broken down into how many control families Response:

Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution. Choose all that apply. Res...

A measure of the degree to which an organization depends on the information or information system for the success of a mission or of a business function best defines which of the f...

Which RMF role establishes risk management roles and responsibilities and provides advice and relevant information to authorizing officials concerning the risk management strategy...

Which NIST SP describes various sensitivity rankings for federal systems; Guide for Developing Security Plans for Federal Info Systems? Response:

What roles and responsibilities can only be occupied by a government employee? Response:

As indicated in NIST SP 800-37, and NIST SP 800-53 the RMF provides inputs to the risk management strategy, including: laws, directives, and policy guidance; strategic goals and ob...

Significant changes to a system may trigger an event-driven authorization action which may include by are not limited to all of the following except one. Choose the exception. Resp...

An instance of an information type. Response:

When does monitoring security controls take place? Response:

The authorization approach that is employed when multiple organizational officials either from the same organization or different organizations, have a shared interest in authorizi...

Information that has been determined pursuant to Executive Order 12958 as amended by Executive Order 13292, or any predecessor order, or by the Atomic Energy Act of 1954, as amende...

If an organization shares financial and personal details of a client to other companies without prior consent of the individuals that organization is violating what following Inter...

An information system's boundary definition resides with who? Response:

Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements? Response:

FIPS 199, Standards for Security Categorization of Federal Systems defines which 3 Security Categories? Response:

One of the primary goals in conducting analysis of the test results from a scan during Security Control Assessment (SCA) is to Response:

Who determines the required level of independence for security control assessors? Response:

Which of the following statements correctly describes DIACAP residual risk? Response:

According to NIST SP 800-37 Rev 2, What is step five of the Risk Management Framework (RMF) process? Response:

What is included in a POA&M that is presented to the Approving Authority as part of the initial authorization package? Response:

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF...

Which of the following is not an example of automation activity? Response:

Who is primarily responsible for the development of system-specific procedures? Response:

NIST SP 800-39 requires that the Security Control Assessor's findings should be: Response:

The physical surroundings in which an information system processes, stores, transmits, or disseminates information is referred to as Response:

What is FIPS 199? Response:

Which NIST guide authorizes an organization to tailor system authorization activities to the level of effort and rigor that is suitable for the IS being tested? Response:

The threats to an information system and its environment of operation have been classified as human, natural, and machine threats. Which of the following threats is refferred to as...

What RMF role is primarily responsible for Tasks 1, 2, and 3 in Assessing Security Controls? Response:

An environmentally conditioned workspace that is partially equipped with information systems and telecommunications equipment to support relocated operations in the event of a sign...

Which of the following guidance documents is useful in determining the impact level of a particular threat on agency systems? Response:

According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability? Resp...

One of the main objectives of testing is to avoid ______________ of normal operations. Response:

In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed? Response:

What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process? Each correct answer represents a complete solution. Choose all that apply. Response:

Which of the following groups represents the most likely source of an asset loss through the inappropriate use of computers? Response:

What are the six steps of the RMF? Response:

Any circumstance or event with the potential to adversely impact organizational operations, assets, personnel, etc..? Response:

Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three. Response:

Gary is the project manager for his project. He and the project team have completed the qualitative risk analysis process and are about to enter the quantitative risk analysis proc...

Which of the following is an entry in an object's discretionary access control list (DACL) that grants permissions to a user or group? Response:

A group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying...

The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such infor...

Why is security control volatility an important consideration in the development of a security control monitoring strategy? Response:

What role ensures the selection of security controls is consistent with the enterprise architecture, including reference models and segment and solution architectures Response:

An occurrence that actually jeopardizes the CIA of an information system or the information system processes that stores or transmits information or that constitutes a violation or...