ISC2 Certified in Governance, Risk and Compliance (CGRC) — Questions and Answers

Question 1: A system security categorization was completed and approved two years ago as Moderate. The organization now plans to migrate the system to a multi-tenant cloud environment and add a new data feed that includes personally identifiable information (PII) about a vulnerable population. Which action is most appropriate with respect to the categorization?

No action is needed because categorization is performed only once during the initial Categorize step
Revisit the categorization, evaluating the new information types and PII impact, and update the security plan and any dependent control selections (Correct answer)
Update only the privacy impact assessment, since PII does not affect FIPS 199 categorization
Downgrade the categorization to Low because cloud providers assume responsibility for impact levels

Correct answer: Revisit the categorization, evaluating the new information types and PII impact, and update the security plan and any dependent control selections

Categorization must be reviewed when significant changes occur, such as new information types or a changed operating environment. Adding PII for a vulnerable population can raise confidentiality (and possibly integrity) impact, and the revised categorization must flow through to the security plan, baseline selection, and authorization decision. Impact levels are never transferred to a cloud provider.

Question 2: A multinational organization is subject to both HIPAA and GDPR for a shared patient-data platform. A compliance program team is mapping the two regimes into a unified control framework. Which approach is MOST defensible when requirements conflict, for example on breach notification timing and data retention?

Apply HIPAA everywhere because it is the older regulation
Apply the most stringent applicable requirement for each control objective, document the legal basis and any jurisdiction-specific exceptions, and obtain legal counsel review (Correct answer)
Adopt the less stringent requirement to reduce operational burden, since both are legally valid
Let each regional office choose independently without a common baseline

Correct answer: Apply the most stringent applicable requirement for each control objective, document the legal basis and any jurisdiction-specific exceptions, and obtain legal counsel review

A harmonized control set normally uses the most stringent applicable requirement per control objective (e.g., the 72-hour GDPR notification window versus HIPAA's 60 days), with documented legal rationale and counsel review for true conflicts such as retention limits versus record-keeping duties. Choosing the weaker standard risks non-compliance in the stricter jurisdiction.

Question 3: What is the relationship between theory and practice in Certified Governance Risk and Compliance regulatory requirements?

Theory and practice are completely unrelated
Theory provides the foundation and framework that guides effective practical application (Correct answer)
Practice is only important; theory is unnecessary
Theory replaces the need for any practical experience

Correct answer: Theory provides the foundation and framework that guides effective practical application

Theory and practice are complementary: theoretical knowledge provides the conceptual framework and understanding that guides effective, evidence-based practical application in professional settings.

Question 4: Which key risk term is defined as any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image or reputation), organizational assets, individuals, other organizations or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information and/or denial of service?

Risk determination
Impact
Threat (Correct answer)
Vulnerability

Correct answer: Threat

Explanation: <br> In the context of risk assessment and management, a threat is defined as any circumstance or event with the potential to adversely impact organizational operations, assets, individuals, or other entities through unauthorized access, destruction, disclosure, modification of information, or denial of service. Thorough understanding and identification of threats are crucial for effective risk management practices.

Question 5: Which document formally captures the selected controls, tailoring decisions, and planned implementation details for an information system during the NIST RMF Select step?

Plan of Action and Milestones (POA&M)
Security Assessment Report (SAR)
Authorization to Operate (ATO)
System Security Plan (SSP) (Correct answer)

Correct answer: System Security Plan (SSP)

The System Security Plan (SSP) is the primary document produced and updated during Step 3 (Select) of the RMF. It documents the system boundary, control baseline, tailoring decisions, control implementation descriptions, and responsibilities. The POA&M tracks remediation of weaknesses; the SAR documents assessment findings; the ATO is the authorization decision itself.

Question 6: A CGRC practitioner is advising on control selection for a system shared by multiple programs within an agency. Several of the required controls are already implemented at the organizational level and maintained by a central team. How should these be treated?

Documented as compensating controls in the system's POA&M
Removed from the system's control baseline since they are redundant
Inherited as common controls, referencing the providing system's SSP (Correct answer)
Re-implement them at the system level to ensure layered defense

Correct answer: Inherited as common controls, referencing the providing system's SSP

Common controls are controls that are implemented at an organizational, site, or program level and inherited by multiple systems. When a system can inherit a control from a common control provider, it should document this inheritance in its SSP, referencing the authoritative source. This avoids duplication of effort and leverages centrally managed security capabilities. Common controls must be documented and authorized, not simply assumed.

Question 7: What is the purpose of scope definition in a security assessment engagement?

To identify the budget allocated for the assessment
To determine which assessors will lead each phase of testing
To schedule the timeline for remediation of findings
To establish which systems, networks, and testing methods are included or excluded (Correct answer)

Correct answer: To establish which systems, networks, and testing methods are included or excluded

Scope definition establishes clear boundaries for what is included and excluded in the assessment to prevent unintended disruption or legal issues.

Question 8: A federal agency is authorizing a system whose inherited common controls come from a shared services provider. The provider's most recent assessment is 14 months old, and the system owner wants to rely on it without reassessment. Under the RMF, what is the MOST appropriate action by the authorizing official's team?

Accept the inherited control assessment as-is, because common controls are assessed only once at provider onboarding
Review the provider's current assessment evidence and continuous monitoring status, and determine whether the inherited control assessment results remain valid for this authorization decision (Correct answer)
Require the system owner to reassess all inherited controls independently, since inheritance never transfers assurance
Reclassify the inherited controls as system-specific controls so the system owner assumes full responsibility

Correct answer: Review the provider's current assessment evidence and continuous monitoring status, and determine whether the inherited control assessment results remain valid for this authorization decision

Inherited (common) controls remain subject to ongoing authorization and monitoring by the provider. The system's AO must consider the currency and validity of the provider's assessment evidence and monitoring results, not blindly accept stale results or duplicate the effort. Inherited control assessment results are reused when current and adequate.

Question 9: An organization with a mature governance program finds that risk executive (function) decisions are inconsistently applied: two AOs accepted materially different residual risk for near-identical systems with the same threat exposure. What governance mechanism BEST addresses this inconsistency?

Eliminate risk acceptance and require full remediation of every weakness before any authorization
Have the risk executive (function) establish and communicate organization-wide risk tolerance, risk-acceptance criteria, and a consistent, organization-level view of risk to inform and calibrate individual authorization decisions (Correct answer)
Replace both AOs with a single enterprise AO for all systems
Require system owners to hide residual-risk values from AOs so decisions are not biased

Correct answer: Have the risk executive (function) establish and communicate organization-wide risk tolerance, risk-acceptance criteria, and a consistent, organization-level view of risk to inform and calibrate individual authorization decisions

The risk executive (function) provides a consistent, organization-wide perspective on risk, ensuring that authorization decisions align with organizational risk tolerance and strategy. Establishing clear tolerance and acceptance criteria promotes consistency without removing AO accountability. Hiding data, eliminating risk acceptance, or centralizing every decision is impractical or counterproductive.

Question 10: During a CGRC risk assessment, a system owner proposes accepting a residual risk rated High for a moderate-impact system because remediation would exceed the system's annual budget. Under the NIST RMF (SP 800-37 Rev. 2) authorization process, who holds the authority to formally accept this risk on behalf of the organization?

The chief information officer, because the CIO owns all information technology risk decisions
The system owner, because they are accountable for the system's operational budget
The authorizing official, because they are the senior official who accepts risk to organizational operations, assets, and individuals (Correct answer)
The information system security officer, because they manage day-to-day security controls

Correct answer: The authorizing official, because they are the senior official who accepts risk to organizational operations, assets, and individuals

Under the RMF, the authorizing official (AO) is the senior management official with the authority to formally accept the risk to organizational operations and assets, individuals, other organizations, and the Nation. The system owner and ISSO provide information and recommendations, but they cannot accept risk on the organization's behalf. The CIO may be involved in risk executive functions, but the authorization decision itself belongs to the AO.

Question 11: During a FISMA-driven continuous monitoring review, an agency discovers a system was authorized under an Authorization to Operate (ATO) with an ongoing, ongoing-authorization approach per NIST SP 800-37 Rev. 2. A significant change occurs: the system is migrated to a new hosting environment that alters the boundary and introduces new external interconnections. Which action is MOST consistent with regulatory and RMF expectations?

Document the change in the POA&M only and defer assessment to the next annual control review
Immediately revoke the ATO and shut down the system until a full reauthorization is completed regardless of impact
Continue operating under the existing ongoing authorization because ongoing authorization eliminates the need for reassessment after changes
Conduct a security impact analysis, update the SSP and interconnection agreements, assess affected controls, and have the AO determine whether the change requires reauthorization or can be addressed within ongoing authorization (Correct answer)

Correct answer: Conduct a security impact analysis, update the SSP and interconnection agreements, assess affected controls, and have the AO determine whether the change requires reauthorization or can be addressed within ongoing authorization

Under NIST SP 800-37 Rev. 2, ongoing authorization still requires change management: significant changes trigger a security impact analysis, updates to authorization documents (SSP, ISAs/MOUs), assessment of affected controls, and an AO determination of whether the risk remains acceptable or reauthorization is needed. Ongoing authorization does not waive assessment, nor does it automatically mandate shutdown.

Question 12: An organization operates two systems: System A (HIGH impact) and System B (LOW impact). System B's ISSO proposes leveraging System A's AC-2 (Account Management) implementation as a common control to satisfy System B's AC-2 requirement. The organization's CISO approves this arrangement. During System B's assessment, the assessor finds that System A's AC-2 implementation does not enforce a 45-day inactive account disablement policy — a parameter System B requires based on its specific risk profile. What is the CORRECT conclusion?

The CISO's approval of the common control arrangement overrides the system-specific ODP requirement, making the 45-day parameter inapplicable to System B.
The assessor should flag this as a finding against System A, not System B, since System A is the common control provider responsible for the implementation.
System B's AC-2 is satisfied because the common control provider (System A) operates at a higher impact level, which presumptively meets lower-impact requirements.
System B must implement a system-specific AC-2 control or a hybrid control arrangement to address the 45-day requirement that the inherited common control does not fulfill. (Correct answer)

Correct answer: System B must implement a system-specific AC-2 control or a hybrid control arrangement to address the 45-day requirement that the inherited common control does not fulfill.

When an inherited common control does not fully satisfy a system's control requirements (including ODPs), the system must implement the gap through a system-specific control or hybrid arrangement. The fact that System A operates at a higher impact level does not guarantee coverage of every parameter System B requires — impact levels reflect overall baseline stringency, not specific ODP values. Option A incorrectly assumes higher impact equals a superset of all lower-impact configurations. Option C misdirects the finding — System B has a control gap regardless of System A's posture. Option D misrepresents CISO authority; approving a common control arrangement does not override system-specific tailoring requirements or ODPs.

Question 13: A policy has been approved by the governing committee, but a review of the rollout plan shows that no mechanism exists to confirm that affected personnel have read and understood it. Which control gap is MOST critical to remedy before the policy is considered effectively implemented?

Absence of a documented communication and acknowledgment process tied to training and attestation records (Correct answer)
Lack of a graphic design template for the policy document
Failure to translate the policy into every language spoken by external vendors
Absence of an archive of prior drafts

Correct answer: Absence of a documented communication and acknowledgment process tied to training and attestation records

A policy is effective only if it is communicated and understood. Documented communication, training, and recorded acknowledgment provide evidence of awareness and support enforcement and audit. Design templates, archival of drafts, and universal translation are secondary to demonstrable awareness among those bound by the policy.

Question 14: A federal agency's system processes records subject to the Privacy Act. The system owner has completed an assessment and the security controls are satisfactory, but no System of Records Notice (SORN) has been published. From a compliance standpoint, which statement is MOST accurate?

The ATO can proceed because SORN publication is a privacy office concern separate from authorization
The system may not lawfully operate as a system of records until the SORN is published in the Federal Register and the comment period requirements are met, so the AO should account for this before granting authorization (Correct answer)
A SORN is satisfied by completing a Privacy Threshold Analysis alone
A SORN is only needed if the system uses High-impact controls under FIPS 199

Correct answer: The system may not lawfully operate as a system of records until the SORN is published in the Federal Register and the comment period requirements are met, so the AO should account for this before granting authorization

The Privacy Act requires agencies to publish a SORN in the Federal Register for systems of records retrieving information by personal identifier, and new or significantly modified uses require advance notice and a comment period. Privacy requirements are part of the authorization decision under the RMF, so the AO should not authorize operation while this statutory requirement is unmet. The SORN does not depend on impact level, and a PTA only helps determine whether a PIA or SORN is needed.

Question 15: Which approach is most effective for mastering continuous monitoring in Certified Governance Risk and Compliance?

Relying solely on on-the-job experience
Memorizing textbook definitions without understanding
Studying only immediately before examinations
Combining theoretical study with practical application and regular review (Correct answer)

Correct answer: Combining theoretical study with practical application and regular review

The most effective approach combines theoretical understanding with practical application, reinforced by regular review and assessment, enabling deeper comprehension and long-term retention.

Question 16: Which of the following is an objective of the System Characterization step under SP 800-30?

Establish Threat and Vulnerability Matrix
Establish System Control Framework
Establish Data and Information Sensitivity Level (Correct answer)
Establish System Testing Procedures

Correct answer: Establish Data and Information Sensitivity Level

Explanation: <br> One of the objectives of the System Characterization step under SP 800-30 is to establish the data and information sensitivity level. This involves identifying and categorizing the sensitivity of data and information processed, stored, or transmitted by the system. Understanding the sensitivity level helps in determining appropriate security controls and risk management measures to protect the information adequately.

Question 17: During continuous monitoring, an organization discovers that a system component began collecting additional PII elements (precise geolocation) under a feature update that did not change the system's authorization boundary or security categorization. Which action is MOST appropriate under RMF and the Privacy Act/OMB guidance?

No action is required because the FIPS 199 security categorization has not changed
Update only the POA&M with a low-priority item and review it at the next annual assessment
Treat it as a significant change to the privacy risk posture: reassess privacy risk, update the PIA and applicable SORN if the records or purposes change, and revise the control selection and the SSP/privacy plan accordingly (Correct answer)
Immediately revoke the ATO and require a full reauthorization from the beginning of the Prepare step

Correct answer: Treat it as a significant change to the privacy risk posture: reassess privacy risk, update the PIA and applicable SORN if the records or purposes change, and revise the control selection and the SSP/privacy plan accordingly

Privacy risk is distinct from security categorization. New PII collection can alter the privacy risk assessment, require a PIA update, and potentially require a new or modified SORN under the Privacy Act. These changes should flow through the change management and continuous monitoring process, including updates to control selection and authorization documents. An unchanged FIPS 199 category does not exempt the change, and automatic ATO revocation is not required.

Question 18: Who is primarily responsible for reviewing and accepting the risk associated with items listed on a POA&M?

The Authorizing Official (AO) (Correct answer)
The System Owner
The Security Control Assessor (SCA)
The Information System Security Officer (ISSO)

Correct answer: The Authorizing Official (AO)

The Authorizing Official is responsible for accepting the risk of operating a system with known weaknesses documented in the POA&M. The ISSO and System Owner manage the POA&M day-to-day, and the SCA identifies findings — but formal risk acceptance belongs to the AO.

Question 19: After receiving the draft security assessment report, the system owner disagrees with a finding and believes the assessor misread the configuration evidence. What is the appropriate RMF way for the system owner to respond?

Edit the SAR to remove the disputed finding before it goes into the authorization package
Escalate to the SAISO to have the assessor replaced and the control reassessed by a new team
Accept the finding as risk in the POA&M and mark it closed so it does not affect the authorization decision
Give the assessor additional evidence. If the disagreement remains, add an addendum to the assessment report explaining the owner's position, without changing the assessor's findings. (Correct answer)

Correct answer: Give the assessor additional evidence. If the disagreement remains, add an addendum to the assessment report explaining the owner's position, without changing the assessor's findings.

SP 800-37 Rev. 2 lets system owners and common control providers respond to assessment findings by adding an addendum to the assessment report. The addendum can include clarifying evidence, rationale, or remediation actions already taken. The assessor's findings remain the assessor's, which protects the integrity and independence of the assessment. The AO sees both the findings and the owner's response. Editing the SAR, closing the item without fixing it, or replacing the assessor all undermine the assessment's credibility.

Question 20: A payroll vendor gives you a clean SOC 2 Type II report. The report states that the vendor's colocation data center provider is presented using the carve-out method. What does this mean for your third-party risk assessment?

The carve-out method means the auditor found exceptions at the data center and removed them from the report
The data center's controls are excluded from the auditor's testing, so you should review the complementary subservice organization controls (CSOCs) and get separate assurance over the data center (Correct answer)
The report is invalid for third-party risk purposes because SOC 2 reports must use the inclusive method
The data center's controls were tested by the vendor's auditor and are covered by the opinion, so no further action is needed

Correct answer: The data center's controls are excluded from the auditor's testing, so you should review the complementary subservice organization controls (CSOCs) and get separate assurance over the data center

Under the carve-out method, the subservice organization's controls are left out of the scope of the description and the testing. The report lists the controls the vendor expects the subservice organization to perform (CSOCs). The user entity has to assess those separately, for example by getting the data center's own SOC report. The inclusive method would bring them into scope. Carve-out is a valid, common choice and does not mean exceptions were found.

Question 21: A cloud-hosted system relies on a FedRAMP-authorized IaaS. The customer's SSP lists SC-13 (Cryptographic Protection) as 'inherited' in full. During assessment, the assessor discovers the customer encrypts application-layer data using its own library with a non-validated cryptographic module before storing it in the IaaS. What is the most accurate finding?

SC-13 should be designated as hybrid or system-specific, since the customer implements its own cryptographic functionality that must use validated modules and be assessed separately (Correct answer)
SC-13 is correctly inherited because the CSP's FedRAMP authorization covers all cryptography
SC-13 is not applicable because encryption at the application layer is optional under the Moderate baseline
SC-13 is satisfied as long as the algorithm (e.g., AES-256) is strong, regardless of module validation

Correct answer: SC-13 should be designated as hybrid or system-specific, since the customer implements its own cryptographic functionality that must use validated modules and be assessed separately

Inheritance covers only what the provider implements. The customer's own application-layer cryptography is a customer responsibility, so the control is hybrid (or system-specific for that portion) and must use FIPS-validated cryptographic modules under SC-13. Algorithm strength alone does not satisfy validation requirements, and CSP authorization does not extend to customer-built components.

Question 22: In NIST SP 800-53, what does the CM control family address?

Change Monitoring
Contingency Management
Compliance Measurements
Configuration Management (Correct answer)

Correct answer: Configuration Management

The CM (Configuration Management) family includes controls for establishing and maintaining baseline configurations and tracking changes to systems.

Question 23: What is the key distinction between a vulnerability assessment and a penetration test?

Vulnerability assessments use automated tools; penetration tests are always manual
Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact (Correct answer)
Vulnerability assessments require user credentials; penetration tests do not
Penetration tests are less comprehensive than vulnerability assessments

Correct answer: Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact

Vulnerability assessments identify and classify weaknesses, while penetration tests go further by actively exploiting vulnerabilities to demonstrate real-world impact.

Question 24: A cloud service provider (CSP) holds a FedRAMP Moderate authorization. A federal agency wants to use the service for a system that requires a mission-specific control not included in the FedRAMP Moderate baseline. How should the agency BEST handle this?

Leverage the existing FedRAMP authorization package, identify the gap, and have the agency implement or obtain assurance for the additional control as part of its own agency authorization and customer responsibilities (Correct answer)
Require the CSP to obtain a new FedRAMP High authorization before any use
Disregard the FedRAMP package and conduct a full independent assessment from scratch
Add the control to the FedRAMP baseline for all agencies by notifying the PMO

Correct answer: Leverage the existing FedRAMP authorization package, identify the gap, and have the agency implement or obtain assurance for the additional control as part of its own agency authorization and customer responsibilities

FedRAMP follows a 'do once, use many times' approach. Agencies leverage the CSP's authorization package, then address agency-specific controls, parameters, and customer responsibilities in their own authorization decision. This avoids duplicate assessment while still covering mission-specific needs. It does not require a High authorization or a change to the FedRAMP baseline.

Question 25: Which concept refers to a system's ability to inherit security controls implemented by a common control provider?

Control delegation
Control inheritance (Correct answer)
Control abstraction
Control aggregation

Correct answer: Control inheritance

Control inheritance allows a system to leverage and rely on controls already implemented by a shared infrastructure or service provider without re-implementing them.

Question 26: A system processes personally identifiable information, and a privacy risk assessment finds that individuals could suffer embarrassment and loss of trust if data were disclosed, even though the data would not cause financial loss or identity theft. How does the NIST Privacy Framework and NISTIR 8062 thinking differ from a traditional security-only risk model in analyzing this situation?

It treats privacy risk as identical to the FIPS 199 high-water mark
It considers problematic data actions that cause adverse effects on individuals, such as embarrassment or loss of autonomy, separate from the organizational security impact (Correct answer)
It limits privacy risk to legal noncompliance penalties for the organization
It ignores the issue, because privacy risk is measured only by confidentiality, integrity, and availability impact

Correct answer: It considers problematic data actions that cause adverse effects on individuals, such as embarrassment or loss of autonomy, separate from the organizational security impact

NISTIR 8062 and the NIST Privacy Framework focus on problematic data actions and their adverse effects on individuals, including dignity-type harms, which differ from security risk to the organization. Privacy risk therefore needs its own analysis alongside security categorization.

Question 27: A system is categorized as moderate, but it processes data that, when aggregated with an adjacent system's data, produces a high-impact aggregate. Which authorization consideration is MOST relevant?

The authorization package should be waived for aggregation risks since they fall under enterprise risk management only
Aggregation is irrelevant because categorization is based only on each system's individual FIPS 199 values
The AO should evaluate whether the system's categorization and authorization decision should account for aggregation effects, since impact may exceed the individual system's baseline (Correct answer)
Only the adjacent system's AO needs to consider the aggregate impact

Correct answer: The AO should evaluate whether the system's categorization and authorization decision should account for aggregation effects, since impact may exceed the individual system's baseline

Categorization under FIPS 199 and SP 800-60 requires consideration of aggregation, where combined information types or connected systems may raise the impact level. The authorizing official should confirm the categorization reflects such effects, and the authorization decision should address the resulting risk. Ignoring aggregation or limiting it to only one AO leaves risk unaddressed.

Question 28: A system's significant change (migration from on-premises to a containerized microservices architecture) occurs after an ATO has been granted with a 3-year ongoing authorization. Which action is most consistent with SP 800-37 Rev. 2 guidance?

Immediately start a full reauthorization from the Prepare step, discarding all existing artifacts
Only update the POA&M and notify the AO after the migration is complete
Perform a security impact analysis, update the SSP and risk assessment, reassess affected controls, and have the AO determine whether the change requires reauthorization or can be addressed through ongoing authorization (Correct answer)
No action is required because ongoing authorization permits any architectural changes without reassessment

Correct answer: Perform a security impact analysis, update the SSP and risk assessment, reassess affected controls, and have the AO determine whether the change requires reauthorization or can be addressed through ongoing authorization

SP 800-37 Rev. 2 requires organizations to analyze the security impact of changes. Affected controls are reassessed and documentation updated, and the AO decides whether the risk posture still falls within acceptable levels or whether reauthorization is needed. Ongoing authorization does not exempt significant changes, and a restart from scratch is unnecessary because existing artifacts can be reused where still valid.

Question 29: What is the relationship between theory and practice in Certified Governance Risk and Compliance continuous monitoring?

Theory provides the foundation and framework that guides effective practical application (Correct answer)
Theory replaces the need for any practical experience
Theory and practice are completely unrelated
Practice is only important; theory is unnecessary

Correct answer: Theory provides the foundation and framework that guides effective practical application

Theory and practice are complementary: theoretical knowledge provides the conceptual framework and understanding that guides effective, evidence-based practical application in professional settings.

Question 30: What is a Privacy Breach, as commonly defined in federal guidance?

The loss, theft, or unauthorized access, use, or disclosure of PII (Correct answer)
Failure to complete annual privacy awareness training
A vulnerability found during a security scan of a PII database
Any failed login attempt on a system containing PII

Correct answer: The loss, theft, or unauthorized access, use, or disclosure of PII

A privacy breach involves the compromised security, confidentiality, or integrity of PII, including unauthorized access, use, disclosure, modification, or destruction.

ISC2 Certified in Governance, Risk and Compliance (CGRC)

The CGRC certifies professionals in applying risk management frameworks (RMF) to authorize and maintain information systems, covering governance, compliance, and control selection across the system authorization lifecycle.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isc2.org — Test delivery, eligibility, passing score, time limit, renewal, score validity, score release, fees, exam information · verified Nov 2026