CGRC Exam Questions

Amy is the project manager for her company. In her current project the organization has a very low tolerance for risk events that will affect the project schedule. Management has a...

The first item listed in the system security plan is the system name and identifier. As required in OMB Circular A 11, each system should be assigned a name and unique identifier....

In which step of the NIST SP 800-30 Risk Assessment process are vulnerabilities paired with threats? Response:

When should the assessment team provide the briefing following the conclusion of testing to provide system management/operations personnel an opportunity to know the security postu...

Which of the following is used throughout the entire C&A process? Response:

Which of the following NIST Special Publication documents provides a guideline on questionnaires and checklists through which systems can be evaluated for compliance against specif...

Gary is the project manager of his organization. He is managing a project that is similar to a project his organization completed recently. Gary has decided that he will use the in...

Which Certification Level of Effort is indicated by checklist-based, independent security review that includes; interviews, policy/procedure reviews, operations observation? Respon...

A set of discrete threat events, associated with a specific threat source or multiple threat sources, partially ordered in time. Response:

Testing officials should use which NIST publication as guide for developing test procedures? Response:

You work as a project manager for SoftTech Inc. You are working with the project stakeholders to begin the qualitative risk analysis process. You will need all of the following as...

Which of the following processes is used to protect the data based on its secrecy, sensitivity, or confidentiality? Response:

Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing?...

Basic testing is a test methodology that assumes no knowledge of the internal structure and implementation detail of the assessment objet. This type of testing is also known as: Re...

James work as an IT systems personnel in SoftTech Inc. He performs the following tasks: - Runs regular backups and routine tests of the validity of the backup data. - Performs data...

What are information system? Response:

Which of the following individuals informs all C&A participants about life cycle actions, security requirements, and documented user needs? Response:

The risk transference is referred to the transfer of risks to a third party, usually for a fee, it creates a contractual-relationship for the third party to manage the risk on beha...

Which RMF role is responsibility for securing the system and managing all security aspects of the system. Closely monitors the day-to-day security of the system and monitors effect...

The security authorization package contains multiple key documents enabling the authorization officials to make risk based authorization decisions. Which of the following documents...

Controls reported by system owner as not in place should not be tested but needs to be recorded as (passing, failing, of N/A) since report is basis for remediation plan. Response:

Which three classifications of security controls have been identified by NIST based on the responsibility for their provision? Response:

One of the inputs to the risk determination task is the employment of risk assessments to provide information that may influence the risk analysis and risk determination. What publ...

An Authorizing Official plays the role of an approver. What are the responsibilities of an Authorizing Official? Each correct answer represents a complete solution. Choose all that...

When determining the applicability of a specific security control, the security professional should utilize which type of guidance? Response:

When an AO submits the security authorization decision, what responses should the ISO expect to receive? Response:

__________ of Effort will drive size of testing team, rigor of testing, & amount of documentation required. Response:

An information system is currently in the initiation phase of the system development life cycle (SDLC) and has been categorized high impact. The information system owner wants to i...

A countermeasure or safeguard that is implemented in an informational system in part as a common control and in part as a system-specific control Response:

Which of the following individuals is responsible for the final accreditation decision? Response:

Overlays can be implemented as part of control tailoring. In which step of the assessment and authorization process is control tailoring done? Response:

A key part of the risk-based decision process is the recognition that regardless of the risk response, There remains some risks known as: Response:

Governing document that provides a comprehensive, rigorous method for specifying security function and assurance requirements for products and systems. Response:

Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. For what purposes is ST&E used? Each correct answer repre...

Which NIST special publication is the guide on continuous monitoring? Response:

Which role in the security authorization process is responsible for organizational information systems? Response:

The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availa...

This is a standard that sets essential requirements for assessing the effectiveness of computer security controls built into a computer system? Response:

When an authorization to operate is issued, which of the following roles authoritatively accepts residual risk on behalf of the organization? Response:

Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person? Response:

What does RTM stand for? Response:

What is the three-tiered approach to risk management described in NIST SP 800-37, Revision 1? Response:

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security cont...

A security control for an information system that has not been designated as a common control or the portion of a hybrid control that is to be implemented within an informational s...

In performing ongoing risk determination and acceptance; the AO consults with the CISO and Risk _______________ to determine whether current system risk is acceptable, provides app...

Which of the following assessment methodologies defines a six-step technical security evaluation? Response:

What publication provides a wide range of security controls as a basis for mitigation measures? Response:

Documenting the description of the system in the system security plan is the primary responsibility of which Risk Management Framework (RMF) role? Response:

What is the potential impact if the loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operatio...

Which of the following is a 1996 United States federal law, designed to improve the way the federal government acquires, uses, and disposes information technology? Response: