ISC2 CGRC Practice Test

CGRC practice test: what's covered

• Governance
• Scope
• Control Selection
• Implementation
• Assessment
• Continuous Monitoring

Free CGRC sample questions

1. A Chief Information Security Officer (CISO) at a financial institution is establishing an enterprise GRC program. The executive board requests clarification on how organizational risk tolerance should be formally documented. Which governance action BEST aligns security decisions with business objectives?

   • A. Draft an enterprise GRC charter defining roles, risk appetite metrics, approved framework mappings, and executive escalation boundaries
   • B. Delegate risk acceptance decisions to individual project managers without establishing centralized risk evaluation criteria
   • C. Perform technical vulnerability scans across endpoints before establishing senior leadership risk tolerance thresholds
   • D. Adopt a single framework checklist without mapping regulatory, legal, or industry-specific compliance requirements
   Show answer

   Correct: A. Drafting an enterprise GRC charter defining roles, risk appetite metrics, approved framework mappings, and executive escalation boundaries is correct because governance requires top-level strategic alignment and clear accountability prior to control execution. Delegating risk acceptance to individual project managers is incorrect because it leads to inconsistent risk decisions without executive oversight. Performing technical vulnerability scans before establishing risk thresholds is wrong because control assessment depends on governance parameters. Adopting a single framework checklist without regulatory mapping is incorrect because it fails to satisfy legal and contractual compliance manda

2. During an RMF governance planning phase, a lead security architect must determine the primary responsibility of the Authorizing Official (AO). Which statement accurately describes the AO's role?

   • A. Accepting operational risk for a system and issuing the formal authorization decision (ATO or DATO)
   • B. Conducting independent hands-on vulnerability testing and writing technical remediation scripts
   • C. Managing day-to-day firewall configurations and reviewing endpoint antivirus logs
   • D. Drafting individual software code pull requests and managing continuous integration pipelines
   Show answer

   Correct: A. Accepting operational risk for a system and issuing the formal authorization decision (ATO or DATO) is correct because NIST SP 800-37 explicitly assigns risk acceptance authority to senior executive AOs. Conducting independent vulnerability testing is incorrect because that is the role of the Security Control Assessor (SCA). Managing day-to-day firewall configurations is wrong because that belongs to system administrators. Drafting software code is incorrect because developers and DevOps engineers handle code repositories.

3. A GRC analyst is reviewing a cloud migration strategy for a federal system processing Sensitive Personally Identifiable Information (SPII). Which privacy document MUST be completed first to evaluate whether full privacy impact analysis is required?

   • A. Privacy Threshold Analysis (PTA) to identify whether PII is collected, stored, or processed
   • B. System Security Plan (SSP) control baseline definition for physical access controls
   • C. Plan of Action and Milestones (POA&M) tracking document for legacy server deprecation
   • D. Interconnection Security Agreement (ISA) for external third-party data exchange
   Show answer

   Correct: A. Privacy Threshold Analysis (PTA) is correct because the PTA is the initial questionnaire used to determine if personal data is present, which then dictates if a Privacy Impact Assessment (PIA) or SORN is mandatory. Defining physical access control baselines in an SSP is incorrect because physical security does not evaluate privacy thresholds. A POA&M tracks known vulnerabilities, which is wrong for initial privacy scoping. An ISA governs system interconnections, which is incorrect as an initial privacy evaluation step.

4. An organization operates under NIST SP 800-37 Rev. 2 (RMF). The Information System Security Officer (ISSO) is assigned to coordinate security tasks. Which duty is the ISSO primarily accountable for?

   • A. Maintaining the operational security posture of the system and ensuring RMF documentation remains current
   • B. Serving as the independent audit entity with exclusive authority to grant system authorization
   • C. Funding organizational cloud infrastructure and approving capital expenditure for hardware
   • D. Writing vendor contract clauses and enforcing international trade compliance regulations
   Show answer

   Correct: A. Maintaining operational security posture and ensuring current RMF documentation is correct because the ISSO is responsible for day-to-day security management and SSP maintenance. Serving as the independent audit entity is incorrect because independent assessment is performed by the Security Control Assessor (SCA). Funding infrastructure is wrong because system owners and executive sponsors handle budget allocation. Writing legal vendor clauses belongs to corporate legal and procurement teams.

5. A healthcare provider subject to HIPAA and NIST standards is integrating a third-party SaaS solution. What governance mechanism BEST ensures the vendor maintains required privacy and security controls?

   • A. Execute a Business Associate Agreement (BAA) alongside Service Level Agreements (SLAs) with explicit security audit rights
   • B. Rely on public marketing disclosures from the vendor website without demanding third-party audit reports
   • C. Allow the vendor to self-certify compliance through an informal verbal attestation during sales calls
   • D. Waive annual continuous monitoring reviews if the vendor provides a single ISO certificate
   Show answer

   Correct: A. Executing a Business Associate Agreement (BAA) with audit rights is correct because HIPAA mandates BAAs for third-party entities processing PHI, backed by enforceable SLAs and audit access. Relying on marketing disclosures is incorrect because vendor claims are not legally binding audit evidence. Verbal attestations are wrong because regulatory compliance requires documented, contractual proof. Waiving continuous monitoring based on a single certificate is incorrect because security posture changes over time.

Last updated: 2026-10-19

CGRC practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 SSCP practice test