CGRC Risk Management Framework 5

Question 1

An organization identifies a high-severity vulnerability in a production system that has an active ATO. What RMF action is most appropriate?

Accepted Answer

Update the SSP and notify the AO; remediate based on POA&M timelines

Answer

Newly discovered vulnerabilities should be documented in the POA&M, the SSP updated as needed, and the AO notified so they can determine if the authorization remains valid.

Question 2

Which NIST publication provides guidance on conducting risk assessments as part of the RMF Prepare step?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 provides the Guide for Conducting Risk Assessments, which supports threat and vulnerability identification during the Prepare and Assess steps.

Question 3

A system undergoes a significant change — a new authentication module is added. What RMF action is required?

Accepted Answer

Conduct an impact analysis and potentially reassess affected controls

Answer

Significant changes trigger an impact analysis per NIST SP 800-37 to determine whether affected controls must be reassessed and whether reauthorization is needed.

Question 4

Which term describes the aggregated risk from multiple Low-impact systems that, combined, could have a significant security impact on an organization?

Accepted Answer

Aggregate risk

Answer

Aggregate risk refers to the combined risk from interconnected or related systems that may each individually pose Low risk but collectively create greater organizational exposure.

Question 5

In a multi-tier RMF implementation, which organizational tier is responsible for defining mission and business processes that drive information security requirements?

Accepted Answer

Tier 2 – Mission/Business Process

Answer

NIST SP 800-37 defines Tier 2 as the Mission/Business Process level, where enterprise architects and process owners translate organizational goals into security requirements.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Management Framework 5