Free CGRC sample questions

Correct answers: Configure the SIEM to generate alerts for indicators of compromise defined by the organization.; Establish and document procedures for security personnel to respond to SIEM alerts.

Correct answer: False

This statement is false. The selection of a control baseline (Low, Moderate, High) is directly driven by the FIPS 199 security categorization of the system. An organization cannot change the baseline itself due to cost. Tailoring allows for the modification or removal of specific controls *within* the selected baseline, provided there is a sound risk-based justification. However, the fundamental baseline corresponding to the system's impact level must be used as the starting point.

Correct answer: Establishing and communicating an organization-wide risk management strategy and risk tolerance levels.

The RMF 'Prepare' step begins at the organization level. Before any system-specific activities can be effectively carried out, the organization must establish its overarching risk management strategy. This includes defining risk tolerance, identifying common controls, and establishing the roles and responsibilities for risk management. This strategic foundation guides all subsequent RMF steps for all systems, including the wealth management platform. System registration and SSP development are system-level tasks that follow the establishment of this organizational strategy. Assessing common controls is part of the strategy but is not the strategy itself.

Correct answer: The control is not satisfied because it fails to meet the requirement to alert designated officials in the event of an audit failure.

NIST SP 800-53, control AU-5, explicitly requires the system to "Alert designated organizational officials in the event of an audit processing failure." The implemented solution of shutting down the system addresses part of the potential response, but without the required alerting mechanism, the control is not fully satisfied. A silent failure could lead to a prolonged, unnoticed outage. The conflict with availability is a separate risk consideration, but the direct reason the control is not satisfied is the missing alert function.

Correct answer: To provide the AO with a basis for making a risk-based decision by showing how identified deficiencies will be managed.

The POA&M is a critical document for risk management. Its inclusion in the authorization package acknowledges that the system is not perfect but demonstrates a formal plan to systematically address and mitigate identified weaknesses over time. This allows the Authorizing Official to understand the current residual risk and the organization's commitment to reducing it, enabling an informed, risk-based decision on whether to grant an ATO.

Correct answer: Return the SSP to the system owner and require a documented risk-based justification and proposed compensating controls for each omitted control.

The RMF process allows for tailoring, but it must be a deliberate, risk-based process. Simply omitting controls due to 'operational constraints' without analysis is unacceptable. The correct procedure is for the system owner to provide a formal justification for why a baseline control is not applicable or cannot be implemented, assess the residual risk, and propose compensating controls that provide an equivalent level of security. The ISSO's role is to enforce this process before the SSP is considered complete.

Correct answer: Moderate

FIPS 199 mandates the use of the 'high water mark' principle for determining the overall system categorization. The final categorization is the highest impact level assigned to any of the three security objectives (Confidentiality, Integrity, Availability). In this case, the impact levels are {Confidentiality: Moderate, Integrity: Moderate, Availability: Low}. The highest impact level is Moderate, so the overall system categorization is Moderate.

Correct answer: The system must undergo a full re-authorization, including a new assessment of all security controls.

A determination that a change has a 'significant' impact on the security posture of an authorized system is a primary trigger for re-authorization. This means the change is substantial enough to potentially invalidate the previous risk assessment and authorization decision. The system will likely need to go through the Assess and Authorize steps of the RMF again, focusing on the changes but often requiring a comprehensive re-assessment before a new ATO can be issued.

Correct answer: Analyze the specific PII processing activities to identify potential privacy risks and select additional controls or enhancements to mitigate them.

While the baseline provides a starting point, it is not sufficient for addressing all privacy risks. The RMF emphasizes that organizations must analyze the specific context in which PII is processed. This involves identifying the types of PII, the purpose of processing, and the potential problems (privacy risks) individuals could experience. Based on this analysis, the organization must select additional privacy controls and enhancements from the catalog in Appendix J of NIST SP 800-53 to supplement the baseline.

Correct answer: The agency is responsible for implementing and assessing all application-level and customer-specific controls not covered by the CSP.

The FedRAMP authorization for the IaaS platform covers controls at the infrastructure level (CSP responsibility). The agency, as the customer, retains responsibility for a significant number of controls related to the application itself, data, access management, and configurations (customer responsibility and shared controls). The agency must implement, document, and assess these controls as part of its own authorization process. Control inheritance is not total; it operates on a shared responsibility model.