Free ISC2 CGRC Exam Questions

Become ISC2 Certified with updated CGRC exam questions and correct answers

Page: 1 / 79

Total 393 Questions | Updated On: Mar 28, 2025

Add To Cart

Question 1

What is the purpose of a security control baseline?

A : To establish a standard set of security controls that can be applied to all federal information systems and organizations

B : To define the criticality of information assets and systems within an organization

C : To establish the requirements for compliance with legal and regulatory frameworks

D : To define the rules for incident response and reporting

Answer: A

Question 2

A system owner is considering the use of compensating controls to address a specific vulnerability. What factor should be taken into account when selecting compensating controls?

A : The cost of implementing the compensating controls

B : The ability of the compensating controls to mitigate the risk

C : The preferences of the system owner

D : The expertise of the information security officer

Answer: B

Question 3

What NIST special publication provides guidance on continuous monitoring?

A : NIST SP 800-53

B : NIST SP 800-37

C : NIST SP 800-137

D : NIST SP 800-160

Answer: C

Question 4

ABC Corporation is considering implementing a new information system that will be critical to its business operations. The system is expected to cost $1 million to implement, and will be used to process sensitive customer information. The chief information officer (CIO) is concerned about the risks associated with the new system, and wants to ensure that the organization's risk appetite is taken into account. Which of the following factors should be considered when determining the risk appetite for the new system?

A : The cost of implementing additional security controls

B : The impact on the organization's reputation if the system is compromised

C : The risk management knowledge of the system owners

D : The level of risk tolerance among the organization's employees

Answer: B

Question 5

What should be included in the security control assessment plan?

A : The names of all authorized users who will be involved in the assessment

B : The specific security controls that will be assessed and the criteria for their evaluation

C : The timeline for completing the assessment and any required reporting deadlines

D : The location of all data centers and server rooms that will be assessed

Answer: B

Page: 1 / 79

Total 393 Questions | Updated On: Mar 28, 2025

Add To Cart