Free ISC2 CGRC Exam Questions

Become ISC2 Certified with updated CGRC exam questions and correct answers

Page: 1 / 79

Total 393 Questions | Updated On: Jan 08, 2025

Add To Cart

Question 1

What is the purpose of a security control baseline?

A : To establish a standard set of security controls that can be applied to all federal information systems and organizations

B : To define the criticality of information assets and systems within an organization

C : To establish the requirements for compliance with legal and regulatory frameworks

D : To define the rules for incident response and reporting

Answer: A

Question 2

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

A : Implement only those controls that are required by regulation or policy

B : Implement only those controls that are relevant to the organization's risk management strategy

C : Implement only those controls that are easy to implement

D : Outsource the implementation of all security controls to a third-party vendor

Answer: B

Question 3

Which of the following is true about common controls?

A : Common controls promote more cost-effective and consistent information security across the organization

B : Common controls are easier to implement

C : Common controls are the same as hybrid controls

D : Common controls cannot be implemented in the cloud

Answer: A

Question 4

Which of the following is a key factor in the success of a security awareness and training program?

A : Use of technical jargon and complex language

B : Delivery of training in a one-time, stand-alone format

C : Alignment with organizational goals and culture

D : Restriction of training to high-risk employees only

Answer: C

Question 5

In the prepare step of the NIST RMF, which of the following should be established to ensure an effective risk management process?

A : A communication process for risk-related information

B : A continuous monitoring strategy

C : A system security plan

D : An incident response plan

Answer: A

Page: 1 / 79

Total 393 Questions | Updated On: Jan 08, 2025

Add To Cart