Free ISC2 CGRC Exam Questions

In the prepare step of the NIST RMF, which of the following should be established to ensure an effective risk management process?

What are the types of authorization decisions that can be given by an authorizing official? Select all that apply.

Which of the following roles is responsible for implementing security controls in an information system in accordance with the NIST RMF?

ABC Corporation is considering implementing a new information system that will be critical to its business operations. The system is expected to cost $1 million to implement, and will be used to process sensitive customer information. The chief information officer (CIO) is concerned about the risks associated with the new system, and wants to ensure that the organization's risk appetite is taken into account. Which of the following factors should be considered when determining the risk appetite for the new system?

Which of the following statements about OMB Circular A-130 is true?