CGRC Risk Management Framework 4

Question 1

Which type of security control assessment method involves reviewing policy documents and system configuration files to verify control implementation?

Accepted Answer

Examine

Answer

The Examine method involves reviewing documentation, specifications, and records to assess whether controls are in place as described.

Question 2

A federal agency's information system processes personally identifiable information (PII). Which RMF consideration becomes especially important during the Categorize step?

Accepted Answer

Privacy impact must be assessed alongside security categorization

Answer

NIST SP 800-37 Rev. 2 integrated privacy into the RMF, requiring privacy impact assessment alongside security categorization for systems processing PII.

Question 3

What is the significance of a 'common control' in the RMF context?

Accepted Answer

A control whose implementation is inherited by multiple information systems

Answer

Common controls are security controls whose implementation is managed centrally and inherited by multiple systems, reducing redundant implementation efforts.

Question 4

During which phase of the RMF does the Security Control Assessor (SCA) determine whether controls are implemented correctly and operating as intended?

Accepted Answer

Assess

Answer

The Assess step involves independent assessment of security controls by the SCA to determine their effectiveness before the authorization decision.

Question 5

When an Authorizing Official issues a 'denial of authorization to operate,' what is the immediate required action?

Accepted Answer

The system must cease operations or implement mitigations to reduce risk to acceptable levels

Answer

A denial of ATO means the system cannot operate as-is; either operations must stop or sufficient mitigations must be applied to bring risk to an acceptable level.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Management Framework 4