CGRC Control Selection 2

Question 1

During control selection for a federal information system, a security team identifies a required control from NIST SP 800-53 that is technically unfeasible due to legacy hardware constraints. What is the MOST appropriate next step according to the RMF?

Accepted Answer

Document a control tailoring decision and identify a compensating control

Answer

When a required control cannot be implemented due to technical or operational constraints, the RMF process allows for tailoring decisions, which must be documented in the System Security Plan (SSP). A compensating control should be identified to provide equivalent or comparable protection. Removing the control without documentation or justification violates RMF requirements, and deferring without documentation leaves an undocumented gap.

Question 2

A security engineer is evaluating whether to implement a network intrusion detection system (NIDS) as a security control. The NIDS monitors traffic but does not actively block threats. Which control type best describes this implementation?

Accepted Answer

Detective control

Answer

A network intrusion detection system that monitors and alerts but does not block traffic is a detective control. Detective controls identify and record security events after or as they occur, but do not prevent them. Preventive controls stop threats before they happen, corrective controls restore systems after an incident, and compensating controls substitute for primary controls when they cannot be implemented.

Question 3

An organization is selecting controls for a system that processes Controlled Unclassified Information (CUI) and has been assigned a MODERATE impact level. Which baseline from NIST SP 800-53 should serve as the starting point for control selection?

Accepted Answer

Moderate baseline

Answer

NIST SP 800-53 provides three control baselines — Low, Moderate, and High — corresponding to the system's impact level as determined through FIPS 199 categorization. A system categorized as MODERATE should begin with the Moderate baseline. Organizations then tailor this baseline by adding, removing, or modifying controls based on their specific environment, threat landscape, and operational requirements.

Question 4

A CGRC practitioner is reviewing a control that requires multi-factor authentication (MFA) for all privileged accounts. The organization currently uses a single-factor hardware token that generates a time-based one-time password (TOTP). How should this control be characterized?

Accepted Answer

Partially satisfied — a Plan of Action and Milestones (POA&M) should document the gap

Answer

A username combined with a TOTP token represents something you know (username/password) plus something you have (the token), which typically constitutes two factors. However, if the organization is only using the token without a separate password, it remains single-factor. In the common implementation where a password plus TOTP is used, MFA is satisfied. If the control is not fully met — for example, if some privileged accounts are excluded — a POA&M should document the gap and remediation timeline. Given the ambiguity in the scenario about the full implementation, partial satisfaction with a POA&M is the most prudent answer.

Question 5

When applying control tailoring during the RMF Select step, which of the following actions is NOT a recognized tailoring activity per NIST SP 800-53B?

Accepted Answer

Replacing all baseline controls with custom controls developed in-house

Answer

Recognized tailoring activities in NIST SP 800-53B include applying scoping considerations, specifying parameter values for organization-defined parameters, and supplementing the baseline with additional controls when risk warrants it. Wholesale replacement of all baseline controls with custom in-house controls is not a recognized tailoring activity — the established baseline exists to ensure a minimum protection standard, and replacing it entirely would undermine the RMF's risk management framework.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Control Selection 2