Free CGRC Questions for ISC Certified in Governance Risk and Compliance CGRC Exam as PDF & Practice Test Engine

Which of the following best defines a general support system? Response:

Aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information.
Response:

Documenting the description of the system in the SSP is the primary responsibility of which RMF role? Response:

A System Owner (SO) is implementing a new system with their existing organization Information Technology (IT) environment. What objectives are considered when determining possible impact to risk? Response:

In accordance with NIST SP 800-59 a National Security System is a system that its function, operation, or use must fulfil some of the following criteria.
CHOOSE ALL THAT APPLY.
Response:

Which of the following statements about System Access Control List (SACL) is true? Response:

The use of automation to conduct security control assessments should be maximized to do the following except one.
Response:

Eric is the project manager of the MTC project for his company. In this project a vendor has offered Eric a sizeable discount on all hardware if his order total for the project is more than
$125,000. Right now, Eric is likely to spend $118,000 with vendor. If Eric spends $7,000 his cost savings for the project will be $12,500, but he cannot purchase hardware if he cannot implement the hardware immediately due to organizational policies. Eric consults with Amy and Allen, other project managers in the organization, and asks if she needs any hardware for their projects.
Both Amy and Allen need hardware and they agree to purchase the hardware through Eric's relationship with the vendor. What positive risk response has happened in this instance?
Response:

Assessment plans should be prepared _______ of the testing and forwarded to all involved for review and approval.
Response:

"The authorization for the system or the common control is approved or denied" is an an outcome of which of the ensuing tasks?
Response:

Which of the following acts is used to recognize the importance of information security to the economic and national security interests of the United States?
Response:

Which of the following are phases of the National Institute of Standards and Technology (NIST) Risk Management Framework?
Response:

One of the primary goals in conducting analysis of the test results from a scan during Security Control Assessment (SCA) is to Response:

An information system is currently in the initiation phase of the system development life cycle (SDLC) and has been categorized high impact. The information system owner wants to inherit common controls provided by another organizational information system that is categorized moderate impact. How does the information system owner ensure that the common controls will provide adequate protection for the information system?
Response:

Adrian is the project manager of the NHP Project. In her project there are several work packages that deal with electrical wiring. Rather than to manage the risk internally she has decided to hire a vendor to complete all work packages that deal with the electrical wiring. By removing the risk internally to a licensed electrician Adrian feels more comfortable with project team being safe.
What type of risk response has Adrian used in this example? Response: