Try ISC2 CGRC
Try 10 questions now. No account, no card.
A free account unlocks 25 questions per course plus readiness tracking.
Get full access to ISC2 CGRC
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
ISC2 · Exam reference
About the ISC2 CGRC exam
CGRC is the ISC2 certification for governance, risk and compliance work, centred on authorizing and maintaining information systems inside a risk management framework. Its seven domains follow the authorization lifecycle: set the system scope, select and implement controls, assess them, reach an authorization decision, then keep that decision current as the system changes.
10
Sample questions
180 min
Exam time limit
70%
Practice pass mark
$599
Exam voucher
CGRC is the ISC2 certification for the people who decide whether a system is allowed to operate. ISC2 renamed it from Certified Authorization Professional (CAP) in February 2023, and the change was to the name alone: the exam and the qualifications behind it stayed as they were. The credential still centres on the authorization process that turns a set of implemented controls into a documented, accepted risk decision. The exam is 125 items in three hours, scored out of 1000 with 700 to pass. Seven domains follow the lifecycle of a system authorization. You categorise the system and fix its boundary, select and tailor a control framework, implement the controls, assess or audit them, assemble the evidence that supports an authorization decision, and then hold compliance together while the system changes underneath you. Implementation of Security and Privacy Controls carries the most weight at 17 percent. Scope of the System carries the least at 10 percent, which understates it: draw the boundary wrong and every control decision after it is aimed at the wrong system. CGRC is approved under U.S. DoDM 8140.03, which is why it appears in federal and defence contractor job requirements. Outside government it maps onto any role where someone has to prove to an auditor or a regulator that a control works, including compliance officer, risk and controls analyst, third party risk manager and GRC architect. ISC2 asks for two years of cumulative paid work experience in at least one domain. Pass without it and you hold Associate of ISC2 status while you earn the experience.
Exam Domains Covered
Exam Format & Details
125 items in 180 minutes, made up of multiple choice plus advanced item types. Scored on a scaled 1000-point range with 700 to pass, which the practice exams here present as 70 percent. Delivered in English at Pearson VUE test centres, U.S. $599 in the Americas. ISC2 asks for two years of cumulative paid work experience in at least one of the seven domains; candidates who pass without it hold Associate of ISC2 status while they accrue it.
Why Practice Questions Matter
CGRC questions rarely ask you to recall a definition. They drop you at a point in the authorization lifecycle and ask what happens next, or who signs it. The line between the system owner, the authorizing official and the control assessor is worth real marks, and it is the sort of distinction that feels obvious until four plausible roles are on the screen together. Working through questions is how you find out whether you know which artifact belongs to which step, or whether you have only been recognising the vocabulary. Every explanation here says why the near-miss answer fails, not just why the right one is right.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the ISC2 CGRC exam — not actual exam content.
Q1.Under FIPS 199, a loss that would cause serious adverse effect, including significant degradation of mission capability or real financial loss, corresponds to which impact level?
- A.The low impact level under the standard
- B.The moderate impact level under the standard
- C.The high impact level under the standard
- D.The critical impact level under the standard
Domain: Scope of the System
Q2.A program has capacity to work one finding this quarter. Finding A is rated high likelihood and high impact and will take three months. Finding B is rated low likelihood and low impact and can be fixed in an afternoon. Which should be worked first?
- A.Finding B, because closing it frees capacity for the larger effort
- B.Finding B, because a shorter remediation lowers overall risk faster
- C.Neither, until the Authorizing Official sequences both findings
- D.Finding A, because combined likelihood and impact drive the order
Domain: Assessment/Audit of Security and Privacy Controls
Q3.A case management system's package is well built: the plan is solid, the assessment is thorough and nine open items are tracked cleanly. It still comes back once, because the attached continuous monitoring plan describes the system as it was eight months ago, before a new external interconnection was added. What does this outcome represent?
- A.A denial of authorization requiring the system to return to Select
- B.Evidence that the assessment was performed dishonestly by the team
- C.Routine rework, fixed by updating the monitoring plan and resubmitting
- D.A reason to drop the continuous monitoring plan from the package
Domain: System Compliance
Q4.A contained security incident affects an authorized system. The controls involved held, but the event revealed unexpected behavior. What is the appropriate response?
- A.Redo a full assessment of every control in the system's approved security baseline
- B.Review the controls the incident touched and document what the event revealed
- C.Wait for the next scheduled periodic reassessment, since it was contained
- D.Close the incident with no further review, because the controls held
Domain: Compliance Maintenance
Q5.Midway through testing, an assessor spots a concern in a subsystem that falls outside the approved assessment scope. What should the assessor do?
- A.Test the subsystem now, since a real concern outranks the scope
- B.Ignore the concern entirely because it falls outside the scope
- C.Record the in-scope control as other than satisfied instead
- D.Note the concern separately and seek approval to expand scope
Domain: Assessment/Audit of Security and Privacy Controls
Frequently Asked Questions
What is included in the free ISC2 CGRC sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full ISC2 CGRC course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the ISC2 CGRC course page.
Are these official ISC2 exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by ISC2.
Which domains does the ISC2 CGRC course cover?
The course covers 7 exam domains: Security and Privacy Governance, Risk Management, and Compliance Program, Scope of the System, Selection and Approval of Framework, Security, and Privacy Controls, Implementation of Security and Privacy Controls, Assessment/Audit of Security and Privacy Controls, System Compliance, Compliance Maintenance.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.