Free ISC2 CGRC Practice Questions

Q1.Under FIPS 199, a loss that would cause serious adverse effect, including significant degradation of mission capability or real financial loss, corresponds to which impact level?

• A.The low impact level under the standard
• B.The moderate impact level under the standard
• C.The high impact level under the standard
• D.The critical impact level under the standard

Domain: Scope of the System

Q2.A program has capacity to work one finding this quarter. Finding A is rated high likelihood and high impact and will take three months. Finding B is rated low likelihood and low impact and can be fixed in an afternoon. Which should be worked first?

• A.Finding B, because closing it frees capacity for the larger effort
• B.Finding B, because a shorter remediation lowers overall risk faster
• C.Neither, until the Authorizing Official sequences both findings
• D.Finding A, because combined likelihood and impact drive the order

Domain: Assessment/Audit of Security and Privacy Controls

Q3.A case management system's package is well built: the plan is solid, the assessment is thorough and nine open items are tracked cleanly. It still comes back once, because the attached continuous monitoring plan describes the system as it was eight months ago, before a new external interconnection was added. What does this outcome represent?

• A.A denial of authorization requiring the system to return to Select
• B.Evidence that the assessment was performed dishonestly by the team
• C.Routine rework, fixed by updating the monitoring plan and resubmitting
• D.A reason to drop the continuous monitoring plan from the package

Domain: System Compliance

Q4.A contained security incident affects an authorized system. The controls involved held, but the event revealed unexpected behavior. What is the appropriate response?

• A.Redo a full assessment of every control in the system's approved security baseline
• B.Review the controls the incident touched and document what the event revealed
• C.Wait for the next scheduled periodic reassessment, since it was contained
• D.Close the incident with no further review, because the controls held

Domain: Compliance Maintenance

Q5.Midway through testing, an assessor spots a concern in a subsystem that falls outside the approved assessment scope. What should the assessor do?

• A.Test the subsystem now, since a real concern outranks the scope
• B.Ignore the concern entirely because it falls outside the scope
• C.Record the in-scope control as other than satisfied instead
• D.Note the concern separately and seek approval to expand scope

Domain: Assessment/Audit of Security and Privacy Controls

Q6.A system collects personal information directly from members of the public, and the control set needs to address consent, authority to collect, and how the organization tells people what it does with their data. Which SP 800-53 Rev 5 control family is built around those concerns?

• A.Access Control (AC), which decides who may reach the personal data
• B.PII Processing and Transparency (PT), the family built around privacy
• C.Audit and Accountability (AU), which records what users did
• D.Planning (PL), which holds the security and privacy plans

Domain: Selection and Approval of Framework, Security, and Privacy Controls

Q7.Which statements about compensating controls are correct? (Select two.)

• A.It removes any need to document the control it has replaced.
• B.It must provide equivalent or better protection than the original.
• C.It may be applied informally once the implementation team agrees.
• D.It is appropriate whenever a control is merely inconvenient.
• E.It needs Authorizing Official approval before it is relied upon.
• F.It is available only to systems categorized at low impact.

Domain: Selection and Approval of Framework, Security, and Privacy Controls

Q8.Which statement describes the traditional, fixed-cycle model of authorization?

• A.The Authorizing Official confirms the decision continuously from live data
• B.A single decision covers every identical deployment of the same design
• C.The authorization renews automatically unless the system is found deficient
• D.Full reassessment and a fresh decision at a fixed interval set by policy

Domain: System Compliance

Q9.A control that requires verifying the authenticity of hardware components before installation belongs to which SP 800-53 Revision 5 control family?

• A.Configuration Management
• B.Supply Chain Risk Management
• C.System and Information Integrity
• D.Audit and Accountability

Domain: Implementation of Security and Privacy Controls

Q10.What is an overlay in the context of control selection?

• A.A replacement baseline issued when a system moves to a different impact level.
• B.A packaged set of controls and guidance for a category of systems or technology.
• C.A one-off adjustment made to a single control for one particular system.
• D.A list of baseline controls the Authorizing Official has agreed to waive.

Domain: Selection and Approval of Framework, Security, and Privacy Controls