Free ISC2 CGRC Exam Questions

In the NIST RMF, who is responsible for developing the system security plan and ensuring that the appropriate security controls are selected and implemented?

Which of the following is a key factor in the success of a security awareness and training program?

The purpose of the asset identification task is to identify assets that require protection. Which of the following is not a potential input for this task?

In the prepare step of the NIST RMF, which of the following should be established to ensure an effective risk management process?

A system owner is considering the use of compensating controls to address a specific vulnerability. What factor should be taken into account when selecting compensating controls?