Free ISC2 CGRC Exam Questions

Become ISC2 Certified with updated CGRC exam questions and correct answers

Page: 1 / 79

Total 393 Questions | Updated On: Sep 25, 2026

Add To Cart

Question 1

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

A : Implement only those controls that are required by regulation or policy

B : Implement only those controls that are relevant to the organization's risk management strategy

C : Implement only those controls that are easy to implement

D : Outsource the implementation of all security controls to a third-party vendor

Answer: B

Question 2

What is the purpose of a security control baseline?

A : To establish a standard set of security controls that can be applied to all federal information systems and organizations

B : To define the criticality of information assets and systems within an organization

C : To establish the requirements for compliance with legal and regulatory frameworks

D : To define the rules for incident response and reporting

Answer: A

Question 3

Which of the following is NOT typically included in the system description for the purpose of authorizing an information system in the NIST RMF process?

A : The system's hardware and software components

B : The system's information flows and processing activities

C : The system's network architecture and connectivity

D : The organization's information security policies and procedures

Answer: D

Question 4

Which of the following is a key consideration when implementing security controls for an information system?

A : The system's hardware and software components

B : The budget and resource constraints of the organization

C : The potential risks to the information system

D : The organizational structure of the system's users

Answer: C

Question 5

Ratio Corp is in the process of selecting security controls for a new information system. Which of the following is NOT a valid control selection method according to NIST guidelines?

A : Using a risk-based approach to determine the appropriate controls

B : Selecting controls based solely on cost-effectiveness

C : Implementing controls that are required by law, regulation, or policy

D : Adopting controls that are consistent with industry standards and best practices

Answer: B

Page: 1 / 79

Total 393 Questions | Updated On: Sep 25, 2026

Add To Cart