Question bank
ISC2 CGRC
43 ISC2 CGRC questions with the correct answer and a written explanation, organised across 7 exam domains.
- 43 questions
- 7 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Assessment/Audit of Security and Privacy Controls
7 questions in this domain
- Question 1Single Choice
What document is the primary output of the preparation phase in the RMF Assess step?
- ASecurity and Privacy Assessment PlanCorrect answer
- BSecurity Assessment Report
- CPlan of Action and Milestones
- DSystem Security and Privacy Plan
Why this is the answer
The Security and Privacy Assessment Plan is produced during preparation and defines scope, objectives, methods, and logistics for the assessment.
- Question 2Multiple Select
According to NIST SP 800-53A, which three assessment methods are used to evaluate controls?
- AExaminationCorrect answer
- BInterviewCorrect answer
- CTestingCorrect answer
- DImplementation
Why this is the answer
NIST SP 800-53A defines examination, interview, and testing as the three assessment methods; implementation is not an assessment method.
- Question 3Interactive
Given the approval logic in the code snippet, whose approval is required before the assessment plan can be approved?
- AAuthorizing OfficialCorrect answer
- BAssessor
- CSystem Owner
- DControl Implementer
Why this is the answer
Only the Authorizing Official approves the assessment plan; the assessor develops it but cannot approve it.
- Question 4Single Choice
Which system documentation is explicitly reviewed by the assessor to understand architecture and data flows during preparation?
- ASystem Security and Privacy PlanCorrect answer
- BSecurity Assessment Report
- CPlan of Action and Milestones
- DContinuous Monitoring Strategy
Why this is the answer
The assessor reviews system documentation including the System Security and Privacy Plan, network diagrams, and architectural models.
- Question 5Multiple Select
Which tasks are part of logistics and coordination when preparing an assessment?
- AScheduling assessment activitiesCorrect answer
- BArranging personnel interviewsCorrect answer
- CPreparing test toolsCorrect answer
- DImplementing security controls
Why this is the answer
Logistics includes scheduling, arranging interviews, and preparing test tools; implementing controls is not part of the assessor's preparation role.
- Question 6Interactive
Given the evidence evaluation snippet, which three qualities must evidence have to support a finding?
- ASufficiencyCorrect answer
- BCompetenceCorrect answer
- CRelevanceCorrect answer
- DPopularity
Why this is the answer
Evidence must be sufficient, competent, and relevant; popularity is not a valid evidence quality.
- Question 7Single Choice
Who must remain independent from control implementation and operation teams?
- AAssessorCorrect answer
- BSystem Owner
- CControl Implementer
- DCommon Control Provider
Why this is the answer
The assessment team must be independent from implementation and operation teams to avoid bias and conflicts of interest.
Compliance Maintenance
6 questions in this domain
- Question 8Single Choice
What is the primary purpose of continuous monitoring after a system is authorized?
- ATo continually verify that controls remain effective and aligned with risk toleranceCorrect answer
- BTo replace the initial authorization with a one-time audit
- CTo eliminate every vulnerability in real time
- DTo wait until the next reauthorization before taking action
Why this is the answer
Continuous monitoring is an ongoing, evidence-driven process that verifies controls remain effective and aligned with organizational risk tolerance.
- Question 9Multiple Select
Which items should be defined in a continuous monitoring strategy?
- AThe security and privacy controls to be monitoredCorrect answer
- BThe frequency and collection methods for monitoringCorrect answer
- CThe roles responsible for monitoring activitiesCorrect answer
- DA guarantee that no vulnerabilities will appear
Why this is the answer
A continuous monitoring strategy defines controls, frequency, collection methods, and roles; it also covers security and privacy controls. It cannot guarantee absence of vulnerabilities.
- Question 10Interactive
Review the monitoring data in the code block. Which control requires POA&M documentation?
- AAC-2Correct answer
- BMP-4
- CRA-5
- DNone of the controls
Why this is the answer
The failed high-risk control, AC-2, must be recorded as a weakness in the POA&M. The other controls passed.
- Question 11Single Choice
Which NIST publication specifically defines continuous monitoring strategy?
- ANIST SP 800-137Correct answer
- BNIST SP 800-53
- CNIST SP 800-30
- DNIST SP 800-145
Why this is the answer
NIST SP 800-137 is the continuous monitoring publication; SP 800-53, SP 800-30, and SP 800-145 cover other areas.
- Question 12Multiple Select
Which actions are part of RMF Step 6 continuous monitoring?
- AImplement the continuous monitoring strategyCorrect answer
- BPerform ongoing risk assessmentsCorrect answer
- CTrack weaknesses in the POA&MCorrect answer
- DWait for the three-year reauthorization without interim work
Why this is the answer
RMF Step 6 requires continuous monitoring, ongoing risk assessments, and POA&M updates, not waiting for the next reauthorization.
- Question 13Interactive
The monitoring strategy snippet lacks which required element?
- APrivacy controlsCorrect answer
- BSIEM tool
- CPatch schedule
- DIncident response plan
Why this is the answer
The monitoring strategy must address both security and privacy controls; the snippet only lists security-related controls, so privacy controls are missing.
Implementation of Security and Privacy Controls
7 questions in this domain
- Question 14Single Choice
Which step of the NIST RMF follows the selection of controls?
- AImplementCorrect answer
- BAssess
- CAuthorize
- DMonitor
Why this is the answer
The RMF sequence is Categorize, Select, Implement, Assess, Authorize, Monitor; so Implement is Step 4 and precedes assessment.
- Question 15Multiple Select
Which activities are part of managing security and privacy control implementation?
- ADocumented configuration managementCorrect answer
- BChange controlCorrect answer
- COngoing awareness of control instantiationCorrect answer
- DDeferring documentation until assessment
Why this is the answer
Implementation management requires documented configuration management, change control, and ongoing awareness; documentation is required, not deferred.
- Question 16Interactive
Based on the code block, which implementation activity is indicated?
- ADeployed with updated baselineCorrect answer
- BUnder assessment
- CAwaiting authorization
- DIn monitoring only
Why this is the answer
Deployment Enabled and Baseline Updated show the control was implemented and the configuration baseline was revised during Step 4.
- Question 17Single Choice
Who is responsible for developing, implementing, and assessing common controls?
- ACommon control providerCorrect answer
- BSystem owner
- CISSO
- DAuthorizing official
Why this is the answer
The common control provider develops, implements, and assesses common controls; system owners consume or inherit them.
- Question 18Multiple Select
Which actions are part of implementing privacy controls?
- AConducting privacy trainingCorrect answer
- BProviding notices and SORNsCorrect answer
- CApplying encryption and access restrictionsCorrect answer
- DIssuing the authorization decision
Why this is the answer
Privacy implementation includes administrative actions such as training and notices plus technical controls like encryption and access restrictions.
- Question 19Interactive
What control implementation category does the code block show?
- ASystem-specificCorrect answer
- BCommon
- CHybrid
- DInherited
Why this is the answer
The owner field is the system owner and the type field says system-specific, so this is a local implementation.
- Question 20Single Choice
Which artifact must be updated to show the actual as-implemented state of controls?
- AControl implementation tableCorrect answer
- BSecurity Assessment Report
- CAuthorization decision document
- DPlan of Action and Milestones
Why this is the answer
Implementation tables record the actual as-implemented state of controls and feed directly into the assessment step.
Scope of the System
4 questions in this domain
- Question 21Single Choice
Which statement best defines the system boundary within the NIST Risk Management Framework for an information system being authorized?
- AExplicit logical or physical perimeter defining included componentsCorrect answer
- BEntire physical network owned by the organization
- CDiagram created only after security controls are selected
- DHardware and software inventory of the data center
Why this is the answer
The boundary is the explicit logical or physical perimeter defining included components. It shapes categorization, control allocation, risk assessment, and the authorization decision.
- Question 22Multiple Select
Which elements must be documented when identifying the system boundary in the system security and privacy plan? Select all that apply.
- ATrust relationshipsCorrect answer
- BData flowsCorrect answer
- CExternal services and interconnectionsCorrect answer
- DVendor marketing materials
Why this is the answer
Boundary documentation must include trust relationships, data flows, and external services so assessors can identify risk, inherited controls, and interconnections requiring agreements.
- Question 23Interactive
Examine the system description in the code block and identify which item must be documented as an interconnection requiring an agreement.
- AVendor APICorrect answer
- BDatabase
- CAuthentication service
- DWeb application
Why this is the answer
The vendor API is an external service crossing the boundary. Interconnections such as APIs require agreements like ISAs, MOUs, or SLAs to define security responsibilities.
- Question 24Single Choice
Why might a system boundary include assets in different physical locations while excluding devices on the same subnet?
- AManagement control, data flows, and ownershipCorrect answer
- BFirewall and router placement
- CPhysical data center boundaries
- DSubnet address range
Why this is the answer
The boundary is based on management control, data flows, and ownership, not solely on physical location. Logical boundaries may cross physical facilities or exclude co-located devices.
Security and Privacy Governance, Risk Management, and Compliance Program
7 questions in this domain
- Question 25Single Choice
In the CGRC context, what is the primary purpose of establishing a governance and risk management program?
- ADirects and controls risk aligned with business missionsCorrect answer
- BPurchase security tools quickly
- CEliminate all risk from information systems
- DReplace continuous monitoring
Why this is the answer
Governance is a structural framework that aligns risk management with strategic objectives; it does not eliminate risk or focus on tooling.
- Question 26Multiple Select
According to NIST SP 800-37, which two items are part of risk framing?
- AAssumptions, constraints, and risk prioritiesCorrect answer
- BSystem-level vulnerability scan outputs
- CCredible threats and acceptable uncertaintyCorrect answer
- DSpecific security control implementation details
Why this is the answer
Risk framing develops the context for risk decisions, including assumptions, constraints, priorities, threats, and uncertainty. Vulnerability scans and control details belong to system-level assessment.
- Question 27Interactive
Refer to the code block. Which step must occur first when establishing a governance and risk management program?
- ASelect risk assessment tools
- BDraft security policies
- CObtain executive sponsorship and formal charterCorrect answer
- DAssess residual risk
Why this is the answer
The process begins with executive sponsorship and a formal charter; tools, policies, and assessments come after direction and authority are established.
- Question 28Single Choice
Which role has final accountability for accepting residual risk on an information system?
- AAuthorizing OfficialCorrect answer
- BChief Information Security Officer
- CSystem Owner
- DCommon Control Provider
Why this is the answer
The Authorizing Official evaluates the authorization package and accepts residual risk. The CISO advises, while the System Owner implements and operates controls.
- Question 29Multiple Select
Which two statements correctly distinguish governance from management?
- AGovernance sets direction and policies; management implements controlsCorrect answer
- BGovernance is board-owned; management is executed by security managersCorrect answer
- CGovernance focuses on installing technical safeguards
- DManagement approves the enterprise risk appetite
Why this is the answer
Governance is strategic and establishes direction, accountability, and policy. Management is operational; it implements and operates controls to achieve that direction.
- Question 30Interactive
Refer to the code block. Which description best matches the Authorizing Official role?
- AEvaluates risk and issues the authorization decisionCorrect answer
- BImplements and maintains security controls
- CProvides common controls shared by several systems
- DEnsures legal and regulatory compliance
Why this is the answer
The Authorizing Official evaluates risk and issues the authorization decision. The other descriptions match the System Owner, Common Control Provider, and Compliance Officer.
- Question 31Single Choice
What is the relationship between risk appetite and risk tolerance?
- ABroad enterprise appetite; measurable toleranceCorrect answer
- BAppetite is the exact limit for one system
- CRisk appetite and risk tolerance are identical
- DRisk tolerance applies only to legal compliance
Why this is the answer
Risk appetite is the aspirational amount of risk an organization accepts; risk tolerance is its operational, measurable threshold for a specific mission, system, or control.
Selection and Approval of Framework, Security, and Privacy Controls
6 questions in this domain
- Question 32Single Choice
Which publication defines the initial low, moderate, and high control baselines for security and privacy controls?
- AFIPS 199
- BNIST SP 800-53BCorrect answer
- CNIST SP 800-37
- DFedRAMP
Why this is the answer
NIST SP 800-53B supplies the initial security and privacy control baselines; FIPS 199 supports categorization, not baseline content.
- Question 33Multiple Select
Which activities are part of control tailoring? (Select all that apply.)
- AScopingCorrect answer
- BParameterizationCorrect answer
- CSpecifying compensating controlsCorrect answer
- DIssuing the ATO
Why this is the answer
Tailoring includes scoping, parameterization, compensating controls, and common or hybrid assignments. ATO issuance is a separate authorization step.
- Question 34Interactive
Based on the impact values in the block, which initial control baseline should be selected?
- AHighCorrect answer
- BModerate
- CLow
- DPrivacy baseline
Why this is the answer
When impacts are mixed, the highest impact across objectives determines the baseline; High confidentiality drives High.
- Question 35Single Choice
Who must approve the tailored control baseline before implementation can begin?
- ASystem Owner
- BAuthorizing OfficialCorrect answer
- CInformation System Security Officer
- DControl Assessor
Why this is the answer
The AO approves the security and privacy plan and accepts risk; the system owner proposes tailoring, not approval.
- Question 36Multiple Select
Which of the following are recognized frameworks for security and governance? (Select all that apply.)
- ANIST CSFCorrect answer
- BISO/IEC 27001Correct answer
- CCOBITCorrect answer
- DSQL Server
Why this is the answer
NIST CSF, ISO/IEC 27001, and COBIT are frameworks; SQL Server is a database product, not a framework.
- Question 37Interactive
According to the statement in the block, which role is accountable?
- AAuthorizing OfficialCorrect answer
- BSystem Owner
- CControl Assessor
- DCommon Control Provider
Why this is the answer
The AO is held accountable for accepting risk; the system owner proposes controls and the assessor tests them.
System Compliance
6 questions in this domain
- Question 38Single Choice
In the CGRC framework, how is failure to comply with an internal policy primarily classified?
- AInternal governance issueCorrect answer
- BLegal liability issue
- CCriminal offense
- DRegulatory violation
Why this is the answer
Policy noncompliance is an internal governance issue, while noncompliance with a law or regulation carries legal liability.
- Question 39Multiple Select
Which three documents are core components of the authorization package under the NIST Risk Management Framework?
- ASystem Security Plan (SSP)Correct answer
- BSecurity Assessment Report (SAR)Correct answer
- CPlan of Action and Milestones (POA&M)Correct answer
- DAuthorization decision letter
Why this is the answer
The authorization package includes the SSP, SAR, and POA&M. The authorization decision letter is issued separately after AO review.
- Question 40Interactive
Review the code block. Which compliance concept does the conditional logic illustrate in the CGRC context?
- AExtraterritorial applicabilityCorrect answer
- BInternal policy classification
- CControl inheritance
- DRisk acceptance
Why this is the answer
GDPR may apply extraterritorially when an organization processes EU residents' personal data, regardless of the organization's location.
- Question 41Single Choice
Who is accountable for the final authorization decision and for accepting residual risk under RMF?
- AAuthorizing OfficialCorrect answer
- BSystem Owner
- CSecurity Assessor
- DInformation System Security Officer
Why this is the answer
The Authorizing Official is accountable for accepting residual risk and issuing the authorization decision; other roles support but do not decide.
- Question 42Multiple Select
Which of the following are valid authorization decisions that an Authorizing Official may issue under RMF?
- AAuthorization to Operate (ATO)Correct answer
- BInterim Authorization to Operate (IATO)Correct answer
- CDenial of AuthorizationCorrect answer
- DPlan of Action and Milestones (POA&M)
Why this is the answer
ATO, IATO, and Denial of Authorization are possible AO decisions. A POA&M is a remediation tracking tool, not a decision.
- Question 43Interactive
Review the code block. What type of requirement is represented by the object shown in the code?
- ALawCorrect answer
- BRegulation
- CPolicy
- DContract
Why this is the answer
A law is enacted by a legislative body, such as Congress passing the Sarbanes-Oxley Act.
Frequently asked questions
Everything about the ISC2 CGRC question bank and how to use it.