Free ISC2 CGRC Exam Questions

Become ISC2 Certified with updated CGRC exam questions and correct answers

Page: 1 / 79

Total 393 Questions | Updated On: Sep 11, 2025

Add To Cart

Question 1

During the security controls assessment phase, the security control assessor at Ratio Corp is responsible for testing the effectiveness of the security controls. Which of the following is the most important consideration when conducting security control testing?

A : The number of security controls implemented

B : The potential risks to the information system

C : The availability of skilled personnel to conduct the testing

D : The number of positive reviews of the implemented controls

Answer: B

Question 2

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

A : Implement only those controls that are required by regulation or policy

B : Implement only those controls that are relevant to the organization's risk management strategy

C : Implement only those controls that are easy to implement

D : Outsource the implementation of all security controls to a third-party vendor

Answer: B

Question 3

A system owner is considering the use of compensating controls to address a specific vulnerability. What factor should be taken into account when selecting compensating controls?

A : The cost of implementing the compensating controls

B : The ability of the compensating controls to mitigate the risk

C : The preferences of the system owner

D : The expertise of the information security officer

Answer: B

Question 4

Which of the following is NOT typically included in the system registration process in the NIST RMF?

A : System identification information, such as the system name and owner

B : The security categorization of the system

C : Organizational policy on system registration

D : The selection and implementation of security controls for the system

Answer: D

Question 5

Which of the following is the best example of a common control?

A : A security policy that is tailored to a specific information system

B : A system administrator who is responsible for the security of a specific information system

C : A firewall that is used to protect multiple information systems

D : A security assessment that is conducted for a specific information system

Answer: C

Page: 1 / 79

Total 393 Questions | Updated On: Sep 11, 2025

Add To Cart