ISC CGRC Exam Dumps

ISC CGRC Sample Question Answers

Question # 1

The System Owner (SO) of Colvine Tech is implementing a new system in the organization's Information Technology (IT) environment. What objectives are considered when determining possible impact to risk? Response:

A. Integrity, Confidentiality, and Availability (CIA) 
B. Common, Hybrid, and System-Specific 
C. Authentication, Authorization, and Accountability 
D. Low, Moderate, and High 

Show Answer

Question # 2

Which of the following provides instructions for annual FISMA reporting and emphasizes monitoring the security state of information systems on an ongoing bases with a frequency sufficient to make ongoing, risk-based decisions? Response:

A. Clinger-Cohen Act 
B. OMB memorandum M-11-33, FY 2011 
C. OMB Circular A-130, Appendix III, 1997 
D. FISMA, 2002 

Show Answer

Question # 3

Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Response: 

A. Personally Identifiable Information (PII) 
B. Privacy Impact Assessment (PIA) 
C. Core Nodal Switching Subsystem (CNSS) 
D. Industry Standard Architecture (ISA) 

Show Answer

Question # 4

Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Response: 

A. Personally Identifiable Information (PII) 
B. Privacy Impact Assessment (PIA) 
C. Core Nodal Switching Subsystem (CNSS) 
D. Industry Standard Architecture (ISA) 

Show Answer

Question # 5

An organizational official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal is known as the: Response:

A. Information System Owner 
B. Authorizing Official 
C. Information Owner 
D. Common Control Provider 

Show Answer

Question # 6

Aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information. Response: 

A. Information Security Policy 
B. National Security System 
C. Information System Owner 
D. System Security Authorization 

Show Answer

Question # 7

The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the baselines described in NIST Special Publication 800-53 and CNSS Instruction 1253, that provide equivalent or comparable protection for an information system. Response: 

A. Compensating Security Controls 
B. Common Security Controls 
C. Network Security Controls 
D. Hybrid Security Controls 

Show Answer

Question # 8

Security control assessors can reuse past assessment results to satisfy the annual FISMA security assessment requirement provided the assessment results are: CHOOSE ALL THAT APPLY Response: 

A. Relevant to the determination of control effectivemess 
B. Obtained by assessors with the required degree of independence 
C. Current 
D. Complete 

Show Answer

Question # 9

What may Colvine Tech do if they determine that the root cause of an unauthorized change is an adversarial attack? Response: 

A. Implement additional controls to reduce the risk of future attacks 
B. Adjust intrusion detection and prevention system 
C. Invoke incident response 
D. All of the above  

Show Answer

Question # 10

The security controls (i.e., safeguards or countermeasures) for an information system that primarily are implemented and executed by people (as opposed to systems). Response:

A. Operational Controls 
B. Common Control 
C. Visual controls 
D. Embedded controls 

Show Answer

Question # 11

A situation in which an information system or application receives protection from security controls (or portions of security controls) that are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application; entities either internal or external to the organization where the system or application resides. Response: 

A. Security Control Inheritance 
B. Network Security Controls 
C. Hybrid Security Controls 
D. System-Specific Security Control 

Show Answer

Question # 12

An occurrence that actually jeopardizes the CIA of an information system or the information system processes that stores or transmits information or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. Response:

A. Incident 
B. Data breach 
C. Compromise 
D. Event 

Show Answer

Question # 13

What role ensures the selection of security controls is consistent with the enterprise architecture, including reference models and segment and solution architectures Response:

A. Information Security Architect 
B. Information System Owner 
C. Authorizing Official 
D. Chief Information Officer 

Show Answer

Question # 14

Why is security control volatility an important consideration in the development of a security control monitoring strategy? Response: 

A. It identifies needed security control monitoring exceptions. 
B. It indicates a need for compensating controls. 
C. It establishes priority for security control monitoring. 
D. It provides justification for revisions to the configuration management and control plan. 

Show Answer

Question # 15

The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the Nation. Response:

A. Security Category 
B. Security Controls 
C. Adequate Security 
D. Security Categorization 

Show Answer

Question # 16

A group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual defines which of the following? Response: 

A. System of Record 
B. System Interconnection 
C. System of Records Notice 
D. System Inventory Process 

Show Answer

Question # 17

Which of the following is an entry in an object's discretionary access control list (DACL) that grants permissions to a user or group? Response:

A. Access control entry (ACE) 
B. Discretionary access control entry (DACE) 
C. Access control list (ACL) 
D. Security Identifier (SID) 

Show Answer

Question # 18

Gary is the project manager for his project. He and the project team have completed the qualitative risk analysis process and are about to enter the quantitative risk analysis process when Mary, the project sponsor, wants to know what quantitative risk analysis will review. Which of the following statements best defines what quantitative risk analysis will review? Response: 

A. The quantitative risk analysis seeks to determine the true cost of each identified risk event and the probability of each risk event to determine the risk exposure. 
B. The quantitative risk analysis process will review risk events for their probability and impact on the project objectives
C. The quantitative risk analysis reviews the results of risk identification and prepares the project for risk response management. 
D. The quantitative risk analysis process will analyze the effect of risk events that may substantially impact the project's competing demands.

Show Answer

Question # 19

Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three. Response: 

A. Administrative 
B. Automatic 
C. Technical 
D. Physical 

Show Answer

Question # 20

Any circumstance or event with the potential to adversely impact organizational operations, assets, personnel, etc..? Response: 

A. Threat 
B. Event 
C. Attribute 
D. System 

Show Answer

Question # 21

What are the six steps of the RMF? Response: 

A. Categorize Select Implement Assess Authorize Monitor
B. Categorize Implement Authorize Select Assess Monitor 
C. Monitor Categorize Assess Authorize Implement Select 
D. Assess Categorize Implement Monitor Select Authorize

Show Answer

Question # 22

Which of the following groups represents the most likely source of an asset loss through the inappropriate use of computers? Response: 

A. Hackers 
B. Visitors 
C. Customers 
D. Employees 

Show Answer

Question # 23

What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process? Each correct answer represents a complete solution. Choose all that apply. Response: 

A. Develop DIACAP strategy. 
B. Assign IA controls. 
C. Assemble DIACAP team. 
D. Initiate IA implementation plan. 
E. Register system with DoD Component IA Program. 
F. Conduct validation activity. 

Show Answer

Question # 24

In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed? Response:

A. Phase 0 
B. Phase 1 
C. Phase 2 
D. Phase 3 

Show Answer

Question # 25

One of the main objectives of testing is to avoid --------- of normal operations.Response:

A. Disruption 
B. Defend 
C. Orderliness 
D. Stand still 

Show Answer

Question # 26

According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability? Response:

A. Confidential, Secret, and High 
B. Minimum, Moderate, and High 
C. Low, Normal, and High 
D. Low, Moderate, and High 

Show Answer

Question # 27

Which of the following guidance documents is useful in determining the impact level of a particular threat on agency systems? Response: 

A. NIST SP 800-41 
B. NIST SP 800-37 
C. FIPS 199 
D. NIST SP 800-14 

Show Answer

Question # 28

An environmentally conditioned workspace that is partially equipped with information systems and telecommunications equipment to support relocated operations in the event of a significant disruption. Response: 

A. Warm Site 
B. Hot Site 
C. Cold Site 
D. Data Site 

Show Answer

Question # 29

What RMF role is primarily responsible for Tasks 1, 2, and 3 in Assessing Security Controls? Response: 

A. Security Control Assessor 
B. Security Assessment Report 
C. Security Control Assessment 
D. Assess Security Controls 

Show Answer

Question # 30

The threats to an information system and its environment of operation have been classified as human, natural, and machine threats. Which of the following threats is refferred to as the number one threat? Response: 

A. Human threat 
B. Advanced persistent threats 
C. Natural threat 
D. Machine threats 

Show Answer

Question # 31

Which NIST guide authorizes an organization to tailor system authorization activities to the level of effort and rigor that is suitable for the IS being tested? Response: 

A. NIST SP 800-37 
B. NIST SP 800-53 
C. NIST SP 800-39 
D. NIST SP 800-37A 

Show Answer

Question # 32

What is FIPS 199? Response: 

A. Standards for Security Categorization of Federal Information and Information Systems 
B. Law for Security Categorization of Federal Information and Information Systems 
C. Terminology for Security Categorization for Federal Information and Information Systems 
D. Data for Security definition for Federal Information and Information Systems 

Show Answer

Question # 33

The physical surroundings in which an information system processes, stores, transmits, or disseminates information is referred to as Response:

A. IT infrastructure 
B. Information System 
C. Environment of Operation 
D. Facility 

Show Answer

Question # 34

Who is primarily responsible for the development of system-specific procedures? Response: 

A. The system owner 
B. The information systems security officer (ISSO) 
C. The system architect 
D. The system administrator 

Show Answer

Question # 35

Which of the following is not an example of automation activity? Response: 

A. Enabling security configurations based on a checklist of security settings 
B. Scanning for compliance against a pre-configured checklist of security settings 
C. Scanning for vulnerabilities and applying the appropriate patches 
D. Conducting table-top exercises 

Show Answer

Question # 36

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that the procedures and controls have been implemented? Response: 

A. Level 4 
B. Level 1 
C. Level 3 
D. Level 5 
E. Level 2

Show Answer

Question # 37

What is included in a POA&M that is presented to the Approving Authority as part of the initial authorization package? Response: 

A. All failed controls identified throughout the RMF process 
B. Only volatile findings that require prioritization in remediation 
C. Deficiencies that have not yet been remediated and verified throughout the RMF process 
D. Only findings that have been evaluated as moderate or high 

Show Answer

Question # 38

According to NIST SP 800-37 Rev 2, What is step five of the Risk Management Framework (RMF) process? Response: 

A. Monitor 
B. Select 
C. Assess 
D. Categorize 

Show Answer

Question # 39

Which of the following statements correctly describes DIACAP residual risk? Response: 

A. It is the remaining risk to the information system after risk palliation has occurred. 
B. It is a process of security authorization. 
C. It is the technical implementation of the security design. 
D. It is used to validate the information system. 

Show Answer

Question # 40

Who determines the required level of independence for security control assessors? Response: 

A. Information system owner (ISO) 
B. Information system security manager (ISSM) 
C. Authorizing official (AO) 
D. Information system security officer (ISSO) 

Show Answer

Question # 41

One of the primary goals in conducting analysis of the test results from a scan during Security Control Assessment (SCA) is to Response:

A. Categorize vulnerabilities 
B. Determine threats to the system 
C. Identify false negative findings 
D. Validate system boundaries 

Show Answer

Question # 42

FIPS 199, Standards for Security Categorization of Federal Systems defines which 3 Security Categories? Response: 

A. Confidentiality, Integrity, Availability 
B. Architectural descriptions & Organizational 
C. Sensitivity, Criticality, availability 
D. Familiarity, Sensitivity, Criticality 

Show Answer

Question # 43

FIPS 199, Standards for Security Categorization of Federal Systems defines which 3 Security Categories? Response: 

A. Confidentiality, Integrity, Availability 
B. Architectural descriptions & Organizational 
C. Sensitivity, Criticality, availability 
D. Familiarity, Sensitivity, Criticality 

Show Answer

Question # 44

Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements? Response:

A. Chief Information Security Officer 
B. Senior Management 
C. Information Security Steering Committee 
D. Business Unit Manager 

Show Answer

Question # 45

An information system's boundary definition resides with who? Response: 

A. The Information System Owner, in which he or she would must be careful to consult with authorizing officials (AO), the CIO, CISO, and the risk executive (function).
B. The Information System Owner, in which he would must be careless to consult with authorizing officials (AO), the CIO, CISO, and the risk executive (function).. 
C. The Information System Owner, in which she would must be careful to consult with authorizing officials (AO), the CIO, CISO, and the risk executive (function)..
C. The Information System Owner, in which she would must be careful to consult with authorizing officials (AO), the CIO, CISO, and the risk executive (function)..
D. The Information System Owner, in which he or she would must be careful to consult with authorizing officials (AO), the CIO, CISO, and the safe executive (function).. 

Show Answer

Question # 46

If an organization shares financial and personal details of a client to other companies without prior consent of the individuals that organization is violating what following Internet law? Response: 

A. Security law 
B. Copyright law 
C. Privacy law 
D. Trademark law 

Show Answer

Question # 47

nformation that has been determined pursuant to Executive Order 12958 as amended by Executive Order 13292, or any predecessor order, or by the Atomic Energy Act of 1954, as amended, to require protection against unauthorized disclosure and is marked to indicate its classified status. Response: 

A. National Security Information 
B. Information System Owner 
C. Information System Resilience 
D. Federal Information Security Management Act 

Show Answer

Question # 48

Information that has been determined pursuant to Executive Order 12958 as amended by Executive Order 13292, or any predecessor order, or by the Atomic Energy Act of 1954, as amended, to require protection against unauthorized disclosure and is marked to indicate its classified status. Response: 

A. National Security Information 
B. Information System Owner 
C. Information System Resilience 
D. Federal Information Security Management Act 

Show Answer

Question # 49

The authorization approach that is employed when multiple organizational officials either from the same organization or different organizations, have a shared interest in authorizing an information system. Response:

A. Joint 
B. Single 
C. Mingle 
D. Double 

Show Answer

Question # 50

When does monitoring security controls take place? Response: 

A. Before the initial system certification 
B. After the initial system security authorization 
C. Before and after the initial system security accreditation 
D. During the system design phase 

Show Answer

Question # 51

An instance of an information type. Response:

A. Information 
B. Operation 
C. Destruction 
D. Organization 

Show Answer

Question # 52

Significant changes to a system may trigger an event-driven authorization action which may include by are not limited to all of the following except one. Choose the exception. Response: 

A. Modifications to system ports protocols and services 
B. Installation of a new or upgraded operating system, middleware component, or application 
C. Modifications to how information, including PII, is processed 
D. Changes in information types processed, stored, or transmitted by the system 
E. Modifications to security and privacy controls 
F. Moving to a new facility 

Show Answer

Question # 53

As indicated in NIST SP 800-37, and NIST SP 800-53 the RMF provides inputs to the risk management strategy, including: laws, directives, and policy guidance; strategic goals and objectives; information security requirements; and: Response:

A. Segment and solution architecture 
B. FEA reference models 
C. Mission/business processes 
D. Priorities and resources availability 

Show Answer

Question # 54

What roles and responsibilities can only be occupied by a government employee? Response:

A. Risk Executive Chief Information Officer (CIO) Senior Information Security Officer (SISO) Authorizing Official (AO) 
B. Chief Information Officer (CIO) Senior Information Security Officer (SISO) Authorizing Official (AO) Risk Executive 
C. Risk Executive Chief Information Officer (CIO) Senior Information Security Officer (SO) Authorizing Official (AO)
D. Risk Executive Risk Mitigation Risk Assessment Authorizing Official (AO) 

Show Answer

Question # 55

Which NIST SP describes various sensitivity rankings for federal systems; Guide for Developing Security Plans for Federal Info Systems? Response: 

A. NIST SP 800-18 
B. NIST SP 800-15 
C. NIST SP 800-19 
D. NIST SP 800-20 

Show Answer

Question # 56

Which RMF role establishes risk management roles and responsibilities and provides advice and relevant information to authorizing officials concerning the risk management strategy to guide authorization decision making. Response:

A. Risk executive 
B. System owner 
C. Common control provider 
D. ISSE 

Show Answer

Question # 57

A measure of the degree to which an organization depends on the information or information system for the success of a mission or of a business function best defines which of the following? Response: 

A. Criticality 
B. Sensitivity 
C. Assurance 
D. Confidentiality 

Show Answer

Question # 58

Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution. Choose all that apply. Response:

A. Protect society, the commonwealth, and the infrastructure. 
B. Act honorably, honestly, justly, responsibly, and legally. 
C. Provide diligent and competent service to principals. 
D. Give guidance for resolving good versus good and bad versus baddilemmas. 

Show Answer

Question # 59

According to NIST SP 800-53 Rev 5, security controls are broken down into how many control families Response: 

A. 18 
B. 20 
C. 17 
D. 115 

Show Answer

Question # 60

What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope? Response:

A. Configuration Management System 
B. Project Management Information System 
C. Scope Verification 
D. Integrated Change Control 

Show Answer

Question # 61

Which plan documents objectives for the security control assessment & details how to conduct such an assessment and records assessment procedures (Security Plan, Assessment Plan, POAM)? Response: 

A. Assessment Plan 
B. Security Plan 
C. POAM 
D. Contingency Plan 

Show Answer

Question # 62

The primary responsibility to select control assessors rests on which roles? Response: 

A. Authorizing Official (AO) and Information System Security Officer (ISSO) 
B. Authorizing offical (AO), Authorizing Official Designated Representative (AODR) 
C. Authorizing offical (AO), Information System Owner (ISO) 
D. Information System Owner (ISO), Security Control Assessor (SCA) 

Show Answer

Question # 63

Who plays the Central role in that he is responsible for system operation, implementation of security controls, and continuous monitoring. Response:

A. Information System Owner  
B. Authorizing Official 
C. Industry Standard Architecture 
D. Information Systems Security Officer 

Show Answer

Question # 64

Which of the following processes is a structured approach to transitioning individuals, teams, and organizations from a current state to a desired future state? Response:

A. Procurement management 
B. Change management 
C. Risk management 
D. Configuration management 

Show Answer

Question # 65

Process of formally evaluating the degree of threat to an information system or enterprise and describing the nature of the threat. Response:

A. Threat Assessment 
B. Threat Event 
C. Threat Source 
D. Threat Scenario 

Show Answer

Question # 66

What’s another term that is synonymous with a common control? Response:

A. Inherited Control 
B. Security Controls 
C. Common Controls 
D. Common Controls Provider 

Show Answer

Question # 67

From a system authorization perspective, why are potential system software patches tested prior to deployment? Response: 

A. To ensure that the system documentation is current with the changes 
B. To support long-term investments 
C. To comply with Public Law 107-347 
D. To identify potential security impacts that may be caused by the patch 

Show Answer

Question # 68

Which of the following is a goal of Public Law? Response

A. Reduce cost of security controls 
B. Compartmentalization of security information to increase security within departments of the government 
C. Ensure that Authorizing Officials do not have budgetary authority over the systems they provide authorization decisions for thus preventing a conflict of interest. 
D. Complete, reliable, and trustworthy information for Authorizing Officials 

Show Answer

Question # 69

Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process? Response: 

A. Senior Agency Information Security Officer 
B. Authorizing Official 
C. Common Control Provider 
D. Chief Information Officer 

Show Answer

Question # 70

Anything that can exploit a vulnerability, intentionally or accidentally, and obtain, damage, or destroy an asset best describes Response: 

A. Risk 
B. Impac
C. Vulnerability 
D. Threat 

Show Answer

Question # 71

An official public notice of an organization's system(s) of records, as required by the Privacy Act of 1974, that identifies: (i) the purpose for the system of records; (ii) the individuals covered by information in the system or records; (iii) the categories of records maintained about individuals; and (iv) the ways in which the information is shared. Response: 

A. System of Records Notice 
B. System Interconnection 
C. System of Record 
D. System Inventory Process 

Show Answer

Question # 72

The implementation of the Assessment and the authorization process is an example of what type of risk response? Response

A. Transfer 
B. Remediate 
C. Share 
D. Mitigate 

Show Answer

Question # 73

The final Security Assessment Report (SAR) should contain findings from the security control assessment and which of the ensuing? Response:

A. Determination of residual risk 
B. Security control assessment plan 
C. System Security Plan (SSP) and Concept of Operations (CONOPS) 
D. Recommendations for control remediations 

Show Answer