CGRC Security Assessment 2

Question 1

Which penetration testing methodology specifically maps attack techniques to defensive controls using a structured knowledge base?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques used to map attacks to defensive controls.

Question 2

A security assessor is evaluating an organization's web application. Which technique involves sending unexpected input to test for injection vulnerabilities?

Accepted Answer

Fuzzing

Answer

Fuzzing involves sending unexpected, malformed, or random data inputs to an application to discover vulnerabilities like injection flaws.

Question 3

Under NIST SP 800-53, which control family is primarily responsible for security assessment and authorization activities?

Accepted Answer

CA - Assessment, Authorization, and Monitoring

Answer

The CA (Assessment, Authorization, and Monitoring) control family in NIST SP 800-53 covers security assessments, authorization, and continuous monitoring.

Question 4

What is the primary purpose of a System Security Plan (SSP) in the context of security assessments?

Accepted Answer

To provide an overview of security requirements and controls implemented

Answer

An SSP documents the security requirements for an information system and describes how controls are implemented to meet those requirements.

Question 5

During a security assessment, an assessor discovers that a critical patch has not been applied but the organization has documented compensating controls. What should the assessor do?

Accepted Answer

Document the vulnerability and evaluate whether compensating controls adequately mitigate the risk

Answer

Assessors must document findings and evaluate whether compensating controls sufficiently reduce risk to an acceptable level rather than automatically marking items compliant.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Security Assessment 2