How many questions are in the ISC2 CGRC practice bank?

The Certilum bank for the ISC2 CGRC holds 150 Foundation questions across 7 exam domains. Every question ships with a written explanation of why the right answer is right, and each row exists in three wording variants, so a session never repeats itself verbatim.

How long is the ISC2 CGRC exam?

The real ISC2 exam is timed at around 180 minutes, with a passing score of 70%. The Certilum diagnostic mirrors that structure so your practice session feels like test day.

What is the ISC2 CGRC exam complexity score?

We measured 150 questions and scored them 1-10 on a composite of format difficulty: multi-select questions (which require every correct option), scenario-length questions, interactive code questions and explanation depth. The ISC2 CGRC scores 2.0 out of 10, with a per-domain breakdown on the difficulty page.

Is the ISC2 CGRC exam practice free?

Yes. You can run the full diagnostic for free, get domain-level scoring and see which domains cost you the most points before deciding whether to go further.

Which domains should I focus on for the ISC2 CGRC?

The ISC2 CGRC blueprint is split into 7 domains, and the heaviest one carries 17% of the exam. The difficulty breakdown shows where the hardest questions actually sit, so you can spend your study time where it pays.

Free diagnostic practice

ISC2 CGRC

CGRC

The ISC2 CGRC certification demonstrates advanced expertise in managing governance, risk, and compliance activities throughout the system development life cycle

180 min

70% to pass

150 bank questions

7 domains

certilum

Start the full practice examISC2 CGRC — freshly shuffled Foundation questions, timed, with domain scoring and explanations.

Exam syllabus, organized by domain

The official ISC2 blueprint, with the real weight each domain carries on test day.

Try a real question

Answer one question from the live bank. Grading happens on our servers, so the answer key never reaches the page.

Try a real question

Sample ISC2 CGRC exam question

Answer this question the same way you would on exam day. No sign-up needed — one random question, three tries to swap it out.

FoundationImplementation of Security and Privacy Controls

Hybrid controls are best defined as which type of control?

Exam facts at a glance

Every figure below comes from the certification record or from the question bank itself.

Time limit: 180 minutes
Passing score: 70%
Domains: 7
Questions in our bank: 150
Level: PROFESSIONAL
Measured complexity: 2.0 / 10
Question mix: 51 single · 50 multi · 49 interactive

Where the hard questions actually are

We score every question in the bank 1-10 on a reproducible formula. Below is the per-domain breakdown.

Exam complexity score2.0/10Gentle · measured across 150 bank questions

Assessment/Audit of Security and Privacy Controls24 questions · complexity 2.2/10 · Gentle
38% multi-select · 0% scenario · 33% interactive
Compliance Maintenance19 questions · complexity 1.9/10 · Gentle
32% multi-select · 0% scenario · 32% interactive
Implementation of Security and Privacy Controls26 questions · complexity 2.0/10 · Gentle
35% multi-select · 0% scenario · 31% interactive
Scope of the System15 questions · complexity 2.2/10 · Gentle
33% multi-select · 7% scenario · 33% interactive
Security and Privacy Governance, Risk Management, and Compliance Program24 questions · complexity 2.0/10 · Gentle
33% multi-select · 0% scenario · 33% interactive
Selection and Approval of Framework, Security, and Privacy Controls21 questions · complexity 2.0/10 · Gentle
33% multi-select · 0% scenario · 33% interactive
System Compliance21 questions · complexity 2.0/10 · Gentle
33% multi-select · 0% scenario · 33% interactive