CGRC Security Assessment 5

Question 1

Which NIST publication provides guidance on conducting security and privacy control assessments?

Accepted Answer

NIST SP 800-53A

Answer

NIST SP 800-53A provides assessment procedures for evaluating the effectiveness of security and privacy controls documented in NIST SP 800-53.

Question 2

What is the concept of 'assessment objectivity' in the context of security control assessments?

Accepted Answer

Ensuring assessors are independent from the system owners they are evaluating

Answer

Assessment objectivity requires that assessors maintain independence from system owners to prevent conflicts of interest that could bias findings.

Question 3

During a vulnerability scan, a system returns a 'false positive' result. What does this mean?

Accepted Answer

The scanner reported a vulnerability that does not actually exist on the system

Answer

A false positive occurs when a vulnerability scanner incorrectly reports a vulnerability that does not exist, requiring manual validation to confirm findings.

Question 4

Which of the following best describes the 'examine' assessment method defined in NIST SP 800-53A?

Accepted Answer

Reviewing, inspecting, and analyzing specifications, documentation, and mechanisms

Answer

The examine method involves reviewing and analyzing documents, specifications, mechanisms, and activities to understand or clarify security control implementation.

Question 5

A security assessor finds that an organization's risk register lists a high-severity vulnerability as 'accepted.' What is the assessor's appropriate response?

Accepted Answer

Document the finding, verify the acceptance is formally approved, and include it in the report with the acceptance status

Answer

Accepted risks must still be documented in assessment reports with evidence of formal approval, allowing leadership to make informed authorization decisions.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Security Assessment 5