CGRC Authorization Process 5

Question 1

Which risk response option is the AO implicitly choosing when issuing an ATO despite known residual risks?

Accepted Answer

Risk acceptance

Answer

By issuing an ATO knowing that residual risks exist, the AO is formally accepting those risks on behalf of the organization.

Question 2

What distinguishes a 'common control' from a 'system-specific control' in the context of authorization?

Accepted Answer

Common controls are inherited by multiple systems and authorized separately

Answer

Common controls are managed and authorized by a common control provider and can be inherited by multiple systems, reducing redundant implementation effort.

Question 3

An AO is reviewing an authorization package and finds that most HIGH-impact controls are satisfied, but two critical controls have open POA&M items. The BEST course of action is:

Accepted Answer

Issue an ATO with terms requiring timely remediation of the open items

Answer

An AO may issue an ATO with conditions requiring remediation of open items by specified milestones, balancing operational need against residual risk.

Question 4

Which activity marks the formal beginning of the Authorize step in the NIST RMF lifecycle?

Accepted Answer

Submission of the authorization package to the AO

Answer

The Authorize step formally begins when the complete authorization package (SSP, SAR, POA&M) is submitted to the Authorizing Official for review.

Question 5

A third-party assessment organization (3PAO) conducts the security assessment for a cloud system. This primarily strengthens the authorization process by:

Accepted Answer

Providing independence and objectivity in control evaluation

Answer

3PAOs provide independent, objective assessment of security controls, increasing confidence in the SAR findings used by the AO.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Authorization Process 5