Free CGRC Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CGRC Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which security objective is affected when information is disclosed to an unauthorized recipient?

   1. A. Confidentiality
   2. B. Integrity
   3. C. Availability
   4. D. Authenticity

   Answer: A

   Explanation: FIPS 199 states, "A loss of confidentiality is the unauthorized disclosure of information." The unauthorized recipient makes this a disclosure issue.

   Reference: FIPS Publication 199: Standards for Security Categorization of Federal Information and Information Systems — Section 3, Security Objectives

2. 2When describing a system for its security plan, what should the general description explain?

   1. A. The system's function and purpose.
   2. B. The control assessment findings and corrective actions.
   3. C. The security impact level of each information type.
   4. D. The chosen control baseline and tailoring rationale.

   Answer: A

   Explanation: NIST states, "Prepare a brief description (one to three paragraphs) of the function and purpose of the system" The description identifies what the system does and why.

   Reference: NIST SP 800-18 Revision 1: Guide for Developing Security Plans for Federal Information Systems — Section 3.9, General Description/Purpose

3. 3What is a control baseline in NIST SP 800-53B?

   1. A. A collection of controls selected for shared protection needs.
   2. B. A set of findings from assessing those controls.
   3. C. A system's customized implementation of the controls.
   4. D. The authorization decision based on those controls.

   Answer: A

   Explanation: NIST states, "A control baseline is a collection of controls from [SP 800-53] assembled to address the protection needs of a group, organization, or community of interest." A baseline is an assembled control set for protection needs.

   Reference: NIST SP 800-53B: Control Baselines for Information Systems and Organizations — Section 2.1, Control Baselines

4. 4How should an RMF control implementation strategy relate to an organization's architecture?

   1. A. Remain consistent with enterprise, security, and privacy architectures
   2. B. Ignore the enterprise architecture after control selection
   3. C. Use only a vendor's reference architecture
   4. D. Use the same design for every system regardless of context

   Answer: A

   Explanation: NIST states, "The control implementation is consistent with the organization’s enterprise architecture and associated security and privacy architectures." Implementation must fit the organization's established architecture.

   Reference: NIST SP 800-37 Revision 2: Risk Management Framework for Information Systems and Organizations — Task I-1, Discussion

5. 5During assessment preparation, what must the team define to establish what the assessment will cover?

   1. A. The assessment objective and scope, including its purpose and what is being assessed.
   2. B. The final authorization decision and residual risk for each control.
   3. C. The remediated control baseline and final compliance notification.
   4. D. The final audit findings and completed corrective action milestones.

   Answer: A

   Explanation: NIST states, "Establishing the objective and scope of assessments (i.e., the purpose of the assessments and what is being assessed);" The objective and scope define the purpose and coverage before assessment; the other choices are later outcomes.

   Reference: NIST SP 800-53A Revision 5: Assessing Security and Privacy Controls in Information Systems and Organizations — Section 3.1, Preparatory activities, p. 20

6. 6Which materials form the core RMF authorization package submitted for a system compliance decision?

   1. A. Security and privacy plans, assessment reports, POA&M, and an executive summary.
   2. B. Security and privacy plans, control baselines, and no assessment reports.
   3. C. Assessment reports, but no plans or remediation information.
   4. D. An executive summary alone, without plans or reports.

   Answer: A

   Explanation: NIST states, "Authorization packages 96 include security and privacy plans, security and privacy assessment reports, plans of action and milestones, and an executive summary." These are the package components used to inform the decision.

   Reference: NIST SP 800-37 Revision 2: Risk Management Framework for Information Systems and Organizations — Task R-1, Discussion, p. 70

7. 7What should an organization define before applying configuration change control to a system?

   1. A. The types of system changes subject to configuration control.
   2. B. Only changes already approved, excluding rejected proposals.
   3. C. Only software upgrades, excluding other controlled changes.
   4. D. Only unauthorized changes, excluding proposed changes.

   Answer: A

   Explanation: NIST states, "Determine and document the types of changes to the system that are configurationcontrolled;" Defining controlled change types establishes the scope of change control.

   Reference: NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations — CM-3(a), p. 98

8. 8Which security objective is affected when a record is modified without authorization?

   1. A. Availability
   2. B. Integrity
   3. C. Confidentiality
   4. D. Non-repudiation

   Answer: B

   Explanation: FIPS 199 states, "A loss of integrity is the unauthorized modification or destruction of information." The unauthorized change concerns integrity.

   Reference: FIPS Publication 199: Standards for Security Categorization of Federal Information and Information Systems — Section 3, Security Objectives

9. 9For a general support system, what should its description include about the applications it supports?

   1. A. The applications supported by that general support system.
   2. B. Only applications that failed a recent assessment.
   3. C. Only applications hosted by a different system.
   4. D. Only applications proposed for later retirement.

   Answer: A

   Explanation: NIST states, "If the system is a general support system, list all applications supported by the general support system." The application list describes the general support system's service scope.

   Reference: NIST SP 800-18 Revision 1: Guide for Developing Security Plans for Federal Information Systems — Section 3.9, General Description/Purpose

10. 10For a federal system using the NIST baseline selection approach, what drives the choice among low, moderate, and high security baselines?

    1. A. The system impact level from security categorization
    2. B. The calendar age of the information system
    3. C. The number of users with administrator accounts
    4. D. The number of common control providers

    Answer: A

    Explanation: NIST states, "The selection of the security control baseline is based on the [FIPS 200] impact level of the system as determined by the security categorization process" The category's impact level determines the baseline.

    Reference: NIST SP 800-53B: Control Baselines for Information Systems and Organizations — Section 2.2, Security Control Baselines