Free Practice ISC2 CGRC Exam Questions 2025

Stay ahead with 100% Free Certified in Governance Risk and Compliance CGRC Dumps Practice Questions

Page: 1 / 79

Total 393 Questions | Updated On: Apr 11, 2025

Add To Cart

Question 1

During a system authorization process, the authorizing official is not satisfied with the risk assessment report's level of detail. What should the system owner do in this situation?

A : Proceed with the authorization process without addressing the concern.

B : Revise the risk assessment report to address the authorizing official's concerns.

C : Request a third-party assessment of the system's risks.

D : Consult the information security officer for guidance.

Answer: B

Question 2

Which of the following is the MOST challenging aspect of asset identification in the context of information security risk management?

A : Identifying all assets within the organization's network

B : Determining the value of each asset in terms of its importance to the organization

C : Identifying and categorizing assets based on their criticality to the organization's operations

D : Determining the level of risk associated with each asset

Answer: A

Question 3

What are the types of authorization decisions that can be given by an authorizing official? Select all that apply.

A : Authorization to operate

B : Interim authorization to operate

C : Common control authorization

D : Authorization to use

E : Denial of authorization

Answer: A,C,D,E

Question 4

Which of the following is NOT a best practice for implementing security controls according to NIST SP 800-53?

A : Implementing security controls in a phased approach

B : Providing security awareness training to personnel

C : Using automated tools to monitor security controls

D : Implementing only those security controls that are required by regulation or policy

Answer: D

Question 5

In the NIST RMF, who is responsible for developing the system security plan and ensuring that the appropriate security controls are selected and implemented?

A : System owner

B : Information security officer

C : Authorizing official

D : Security control assessor

Answer: A

Page: 1 / 79

Total 393 Questions | Updated On: Apr 11, 2025

Add To Cart