Online Access Free CGRC Exam Questions

Which of the following assessment methods involves observing or conducting the operation of physical devices?
Response:

• A.Examination
• B.Deviation
• C.Interview
• D.Testing

Which three classifications of security controls have been identified by NIST based on the responsibility for their provision?
Response:

• A.System-specific, hybrid, and common
• B.Technical, operational, and managerial
• C.Preventive, detective, and corrective
• D.AC, IA, and MP

Tailoring refers to the process by which a security control baseline is modified based on all but one of the following:
Response:

• A.The specification of compensating controls
• B.The specification of organization-defined parameters in controls via explicit assignement and selection statements.
• C.The application of scoping guidance
• D.The security categorization of the information system

Which of the following is an example of the test assessment Method according to NIST SP 800-
37 Rev 2? Response:

• A.Asking administrators about the scanning process
• B.Reviewing the most recent scan reports
• C.Reading vulnerability scan policies and procedure
• D.Conducting a vulnerability scan on web applications

In which of the following phases does the change management process start? Response:

• A.Phase 4
• B.Phase 3
• C.Phase 2
• D.Phase 1