CGRC Authorization Process 3

Question 1

An Authorizing Official Designated Representative (AODR) may perform all AO functions EXCEPT:

Accepted Answer

Signing the authorization decision document

Answer

The AODR can perform most AO functions but cannot sign the actual authorization decision — that responsibility cannot be further delegated.

Question 2

What is the primary purpose of the Plan of Action and Milestones (POA&M) in the authorization process?

Accepted Answer

To track remediation of identified security weaknesses

Answer

The POA&M documents known security weaknesses and the plans, resources, and milestones for correcting them.

Question 3

A cloud service provider seeks authorization to serve multiple federal agencies through a single assessment. This approach is called:

Accepted Answer

FedRAMP Authorization

Answer

FedRAMP provides a standardized approach for cloud service providers to obtain a single authorization that multiple federal agencies can leverage.

Question 4

When an agency accepts the existing authorization of a system operated by another agency, this is known as:

Accepted Answer

Authorization reciprocity

Answer

Authorization reciprocity allows agencies to accept each other's authorizations, reducing duplicative assessment effort.

Question 5

Which factor most directly determines the length of an ATO authorization period?

Accepted Answer

Organizational policy and the AO's risk acceptance decision

Answer

The ATO period is determined by organizational policy and the AO's judgment about acceptable risk over time, not automatically by categorization.

CGRC - Certified Governance Risk and Compliance Practice Test