CGRC Security Assessment 3

Question 1

What is the key distinction between a vulnerability assessment and a penetration test?

Accepted Answer

Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact

Answer

Vulnerability assessments identify and classify weaknesses, while penetration tests go further by actively exploiting vulnerabilities to demonstrate real-world impact.

Question 2

In the RMF process, which step involves formally granting authorization to operate based on assessment results?

Accepted Answer

Authorize

Answer

The Authorize step involves an authorizing official reviewing assessment results and the risk determination to formally grant or deny authorization to operate.

Question 3

Which document formally communicates the results of a security control assessment to organizational leadership?

Accepted Answer

Security Assessment Report (SAR)

Answer

The Security Assessment Report (SAR) documents the findings and recommendations from a security control assessment for organizational decision-makers.

Question 4

An organization needs to assess 500 endpoints for known vulnerabilities. Which approach is most appropriate?

Accepted Answer

Authenticated network vulnerability scanning

Answer

Authenticated network vulnerability scanning efficiently assesses large numbers of endpoints using credentials to perform thorough checks without manual inspection.

Question 5

What is the purpose of scope definition in a security assessment engagement?

Accepted Answer

To establish which systems, networks, and testing methods are included or excluded

Answer

Scope definition establishes clear boundaries for what is included and excluded in the assessment to prevent unintended disruption or legal issues.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Security Assessment 3