CGRC Security Assessment 3 — Questions and Answers
Question 1: What is the key distinction between a vulnerability assessment and a penetration test?
- Vulnerability assessments use automated tools; penetration tests are always manual
- Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact (Correct answer)
- Penetration tests are less comprehensive than vulnerability assessments
- Vulnerability assessments require user credentials; penetration tests do not
Correct answer: Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact
Vulnerability assessments identify and classify weaknesses, while penetration tests go further by actively exploiting vulnerabilities to demonstrate real-world impact.
Question 2: In the RMF process, which step involves formally granting authorization to operate based on assessment results?
- Categorize
- Select
- Authorize (Correct answer)
- Monitor
Correct answer: Authorize
The Authorize step involves an authorizing official reviewing assessment results and the risk determination to formally grant or deny authorization to operate.
Question 3: Which document formally communicates the results of a security control assessment to organizational leadership?
- Plan of Action and Milestones (POA&M)
- Security Assessment Report (SAR) (Correct answer)
- System Security Plan (SSP)
- Privacy Impact Assessment (PIA)
Correct answer: Security Assessment Report (SAR)
The Security Assessment Report (SAR) documents the findings and recommendations from a security control assessment for organizational decision-makers.
Question 4: An organization needs to assess 500 endpoints for known vulnerabilities. Which approach is most appropriate?
- Manual inspection of each endpoint
- Authenticated network vulnerability scanning (Correct answer)
- Physical inspection of hardware configurations
- Review of vendor documentation only
Correct answer: Authenticated network vulnerability scanning
Authenticated network vulnerability scanning efficiently assesses large numbers of endpoints using credentials to perform thorough checks without manual inspection.
Question 5: What is the purpose of scope definition in a security assessment engagement?
- To identify the budget allocated for the assessment
- To establish which systems, networks, and testing methods are included or excluded (Correct answer)
- To determine which assessors will lead each phase of testing
- To schedule the timeline for remediation of findings
Correct answer: To establish which systems, networks, and testing methods are included or excluded
Scope definition establishes clear boundaries for what is included and excluded in the assessment to prevent unintended disruption or legal issues.
Question 6: Which security assessment technique examines application source code to identify vulnerabilities without executing the program?
- Dynamic Application Security Testing (DAST)
- Static Application Security Testing (SAST) (Correct answer)
- Interactive Application Security Testing (IAST)
- Runtime Application Self-Protection (RASP)
Correct answer: Static Application Security Testing (SAST)
SAST analyzes application source, bytecode, or binary code for vulnerabilities without requiring the application to be running.
Question 7: A Plan of Action and Milestones (POA&M) is primarily used to:
- Define the security architecture for a new system
- Track and manage identified security weaknesses and remediation schedules (Correct answer)
- Authorize system interconnections between organizations
- Document baseline security configurations
Correct answer: Track and manage identified security weaknesses and remediation schedules
A POA&M is a corrective action plan that tracks identified security weaknesses, resources needed, and scheduled completion dates for remediation.
CGRC Security Assessment 3
What is the key distinction between a vulnerability assessment and a penetration test?