Free ISC2 CGRC Exam Questions

Become ISC2 Certified with updated CGRC exam questions and correct answers

Page: 1 / 79

Total 393 Questions | Updated On: Jun 15, 2026

Add To Cart

Question 1

What are some common indicators of insider risk? Select all that apply

A : Sudden lifestyle changes or financial difficulties

B : Disgruntlement or dissatisfaction with job or management

C : Lack of technical expertise or knowledge

D : Poor performance or disciplinary issues

E : Unusual access to sensitive information or systems

Answer: A,B,D,E

Question 2

In the NIST RMF, who is responsible for developing the system security plan and ensuring that the appropriate security controls are selected and implemented?

A : System owner

B : Information security officer

C : Authorizing official

D : Security control assessor

Answer: A

Question 3

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

A : Implement only those controls that are required by regulation or policy

B : Implement only those controls that are relevant to the organization's risk management strategy

C : Implement only those controls that are easy to implement

D : Outsource the implementation of all security controls to a third-party vendor

Answer: B

Question 4

During a system authorization process, the authorizing official is not satisfied with the risk assessment report's level of detail. What should the system owner do in this situation?

A : Proceed with the authorization process without addressing the concern.

B : Revise the risk assessment report to address the authorizing official's concerns.

C : Request a third-party assessment of the system's risks.

D : Consult the information security officer for guidance.

Answer: B

Question 5

During the security controls assessment phase, the security control assessor at Ratio Corp is responsible for testing the effectiveness of the security controls. Which of the following is the most important consideration when conducting security control testing?

A : The number of security controls implemented

B : The potential risks to the information system

C : The availability of skilled personnel to conduct the testing

D : The number of positive reviews of the implemented controls

Answer: B

Page: 1 / 79

Total 393 Questions | Updated On: Jun 15, 2026

Add To Cart