CGRC CGRC Information Security Controls

Question 1

Which NIST publication provides a catalog of security and privacy controls for federal information systems?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the catalog of security and privacy controls used to protect federal information systems.

Question 2

In the context of CGRC, what is the primary purpose of a security control baseline?

Accepted Answer

To provide a starting set of controls for a given impact level

Answer

A security control baseline provides a pre-defined set of minimum controls selected based on the system's impact level (Low, Moderate, or High).

Question 3

Which control family in NIST SP 800-53 addresses identification and authentication requirements?

Accepted Answer

IA – Identification and Authentication

Answer

The IA (Identification and Authentication) control family addresses requirements for uniquely identifying and authenticating users and devices.

Question 4

What term describes the process of selecting and adjusting security controls to meet the specific needs of an organization or system?

Accepted Answer

Control tailoring

Answer

Tailoring is the process of modifying a baseline by adding, removing, or adjusting controls to fit the system's specific environment and risk profile.

Question 5

Which type of control is implemented through hardware, software, or firmware to protect information systems?

Accepted Answer

Technical control

Answer

Technical controls (also called logical controls) use technology such as encryption, firewalls, and access control software to protect systems.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC CGRC Information Security Controls