CGRC Exam Questions

A situation in which an information system or application receives protection from security controls (or portions of security controls) that are developed, implemented, assessed, a...

The security controls (i.e., safeguards or countermeasures) for an information system that primarily are implemented and executed by people (as opposed to systems). Response:

What may Colvine Tech do if they determine that the root cause of an unauthorized change is an adversarial attack? Response:

Security control assessors can reuse past assessment results to satisfy the annual FISMA security assessment requirement provided the assessment results are: CHOOSE ALL THAT APPLY...

The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the baselines described...

Aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information. Response:

An organizational official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, proces...

Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social s...

Which of the following provides instructions for annual FISMA reporting and emphasizes monitoring the security state of information systems on an ongoing bases with a frequency suf...

The System Owner (SO) of Colvine Tech is implementing a new system in the organization's Information Technology (IT) environment. What objectives are considered when determining po...

Statements of security capability to: (i) build in additional, but related, functionality to a security control; and/or (ii) increase the strength of the control. Response:

Which of the following NIST publications is the guide for security and privacy control assessments in federal information systems and organizations? Response:

Which of the following emphasizes the importance of continuous monitoring by requiring agencies to conduct control assessments at a frequency appropriate to risk but no less than a...

Which of the following are "not" a phase of the NIST Risk Management Framework? Response:

Which organizational official is responsible for identifying assessment methodologies and metrics to ensure that privacy controls are meeting the organization's privacy requirement...

Who is the organizational official responsible for the development, implementation, assessment, and monitoring of security controls in an information system? Response:

Which of the following publications serves as a guide for the selection of security controls? Response:

Step 6 of the risk management framework can be described as: Response:

The RMF Step and task where the Information System is registered with the appropriate organization and PMO. Response:

Why would the authorization decision issue a determination of Not Authorized? Response:

Which of the following documents can be best aid in selecting controls to be monitored? Response:

What does avoidance mean with respect to risk response? Response:

With respect to legacy systems, What RMF Steps can be applied to validate the security categorization to ensure appropriate security controls have been selected and implemented. Re...

Who is primarily responsible for categorizing the Information System? Response:

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptiti...

When was Title III of E-Government Act 44 USC sec.351 (Public Law 107-347) passed and signed into law? Response:

Common control providers have the responsibility for development, implementation, assessment, and monitoring of common controls. In which document do common control providers docum...

A structured set of arguments and a body of evidence showing that an information system satisfies specific claims with respect to a given quality attribute. Response:

Where can you find guidance for registering information systems in the organization system inventory? Response:

You are the project manager for the NHH project. You are working with your project team to examine the project from four different defined perspectives to increase the breadth of i...

Focused testing is a test methodology that assumes some knowledge of the internal structure and implementation detail of the assessment object. This type of testing is also known a...

Which NIST publication provides guidance on the three tiers in the risk management hierarchy including Tier 1, Tier 2, and Tier 3? Response:

_________________________ management offers a structured approach to managing, approving, and documenting changes affecting an IS; critical to continuous assessment of security pos...

Any executive department, military department, government corporation, government -controlled corporation, or other establishment in the executive branch of the government (includi...

Which of the following acts is used to recognize the importance of information security to the economic and national security interests of the United States? Response:

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statem...

Which RMF role needs to be aware of id of new threats, evolving risks, changes in data sensitivity/criticality and changes in operating environment; to make conscious decision on w...

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security cont...

The use of automation to support ongoing assessments facilitates all but one of the following. Response:

Which of the following is not a part of Identify Risks process? Response:

During the assessment of a new system, the ISO mentioned that if unauthorized modification or destruction of medical information in the system occurred, it could result in potentia...

A system or system element that is outside of the authorization boundary established by the organization and for which the organization typically has no direct control over the app...

NIST SP 800-37 defines a 3-tiered approach to the RMF, which are? Response:

What publication provides a structured process (RMF) to fully integrate information security and risk management activities into the SDLC in a disciplined fashion? Response:

A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk respons...

Which RMF role can be appointed at the discretion of the Approving/Authorization Authority? Response:

This process is used to determine if the security controls in the information system continue to be effective over time in light of the inevitable changes that occur in the system...

Which National Institute of Standards and Technology Special Publication (NIST SP) 800 series document is concerned with continuous monitoring for federal information systems and o...

You have newly joined the assessment team that will be carrying out an independent, focused level of coverage, control assessment at Colvine Tech. What is a focused level of assess...

Publication that specifies security requirements for federal information and Info Systems in 17 security related areas that represent a broad-based, balanced information security p...