CGRC Practice Exam December 2023

In determining system boundaries for systems either partially or wholly managed, maintained, or operated by external providers, an agreement clearly describing authorization boundaries ensures what?

• Security

• Interconnection agreements

• Accountability

• Understanding

What risk assessment approach typically employs a set of methods, principles, or rules for assessing risk based on nonnumerical categories or levels?

• A) Quantitative assessment

• B) Qualitative assessment

• C) Semi-quantitative assessment

• D) Empirical assessment

Which of the following is NOT a merit when an organization identifies and understands how information types are processed during all stages of the life cycle?

• It helps organizations identify considerations for protecting the information, informs the organization’s security and privacy risk assessments, and informs the selection and implementation of controls.

• Identification and understanding of the information life cycle facilitates the employment of practices to help ensure, for example, that organizations have the authority to collect or create information.

• Organizations that process highly classified information types can allow all organizational employees to identify and know the value and impact of the information they work with for safe keeping.

• It helps develop rules related to the processing of information in accordance with its impact level, create agreements for information sharing, and follow retention schedules for the storage and disposition of information.

Identify the entity that establishes the compliance schedules for the National Institutes of Standards and Technology security standards and guidelines.

• A) The Office of Management and Budget in policies, directives, or memoranda

• B) The department of Commerce

• C) The FedRAMP JAB

• D) Third party assessor organizations

The Prepare step has two risk assessment tasks: one for the organization level, and the other for the system level. The potential input for one of these risk assessments includes the following: assets to be protected; mission, business functions the system will support; business impact analyses or criticality analyses; system stakeholder information; and information about other systems that interact with the system. What will be the main output after the risk assessment?

• Organization-level risk assessment results.

• Organizational systems prioritized into low-, moderate-, and high-impact sub-categories.

• Security and privacy assessment report.

• Security and privacy risk assessment report.

What name is given to a risk management concept that is related to the level of risk or degree of uncertainty that is acceptable to organizations and is a key element of the organizational risk frame?

• A) Risk Monitoring

• B) Risk Response

• C) Risk tolerance

• D) Risk Assessment

The risk executive (function) coordinates with senior leaders to do the following, except:

• A) establish risk management roles and responsibilities.

• B) establish organization-wide forums to consider all types and sources of risk.

• C) ensure that security authorization decisions consider all factors necessary for mission and business success.

• D) authorizing the operation of an information system, thereby accepting the risk to the organization.

What task in the Risk Management Framework Prepare step identifies individuals and assigns key responsibilities for executing the Risk Management Framework?

• A) Risk assessment – organization

• B) Risk management roles

• C) Risk management strategy

• D) System Stakeholders

Risk is a measure of the extent to which an entity is threatened by a potential circumstance or event and is typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. Which of the following BEST describes where information security risks arise?

• A) From third party organizations having a stake in the information system.

• B) From organizational mission and business functions that support the system.

• C) From the loss of confidentiality, integrity, or availability of information or information systems, and reflect the potential adverse impacts to organizational operations, assets, and individuals.

• D) From residual risks that remain in a system after the major risks have been mitigated.

One of the primary objectives of the Prepare Step of the RMF is to facilitate better communication between senior leaders and executives in the C-suite, and system owners and operators, in aligning organizational priorities with resource allocation and prioritization at the system level. If this objective is achieved, the following could benefit the organization except: A) It will reduce the information technology footprint and the attack surface of organization.

• Guarantee a zero vulnerability of system level assets since security has been built from a top-down management approach.

• It will promote IT modernization objectives and prioritize security and privacy activities to focus protection strategies on the most critical assets and systems.

• Facilitate system readiness for system-specific tasks.