CGRC Security Assessment 4

Question 1

Which assessment method involves evaluating security controls by reviewing documentation, interviewing personnel, and observing system behavior?

Accepted Answer

Security control assessment

Answer

Security control assessments use three methods—examine, interview, and test—to determine if controls are implemented correctly and operating as intended.

Question 2

What is the primary risk associated with conducting a penetration test without a signed rules of engagement (ROE) document?

Accepted Answer

The assessor may face legal liability for activities that would otherwise be authorized

Answer

Without a signed ROE, penetration testing activities lack explicit authorization, which could expose assessors to criminal liability under computer fraud laws.

Question 3

During continuous monitoring, an organization detects a significant change to a critical system. What is the most appropriate immediate action?

Accepted Answer

Assess the impact of the change on the system's security posture and update authorization documents

Answer

Significant changes trigger impact analysis to determine whether existing security controls remain adequate and whether reauthorization is needed.

Question 4

Which FedRAMP security assessment concept requires cloud service providers to maintain a continuously updated inventory of their security posture?

Accepted Answer

Continuous Monitoring (ConMon)

Answer

FedRAMP Continuous Monitoring (ConMon) requires CSPs to maintain ongoing visibility into their security posture through regular vulnerability scanning and reporting.

Question 5

An assessor is evaluating network segmentation controls. Which technique would best validate that segments are properly isolated?

Accepted Answer

Conducting network traffic analysis and attempting cross-segment connections

Answer

Actively testing network segments by attempting cross-segment connections provides empirical evidence that segmentation controls are functioning as intended.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Security Assessment 4