CGRC Exam Training Practice Tests (ISC Certified in Governance Risk and Compliance)]

Question 1

Developmental testing and evaluation is a type of control Assessment and its activities include the following except one.
Response:

A. Design and code reviews B. Application scanning C. Regression testing D. Audits

Correct Answer: D

Question 2

What is not a responsibility of the Risk Executive (Function) in an organization's ISCM?
Response:

A. Review status reports from the ISCM process as input to information security risk posture and risk tolerance B. Oversee the organization's ISCM program C. Participate in the configuration management process D. Provide input to mission/business process and information tier entities on ISCM strategy

Correct Answer: C

Question 3

__________ of Effort will drive size of testing team, rigor of testing, & amount of documentation required.
Response:

A. Antecedent B. Side C. Level D. Worst

Correct Answer: C

Question 4

One of the main objectives of testing is to avoid ______________ of normal operations.
Response:

A. Defend B. Orderliness C. Disruption D. Stand still

Correct Answer: C

Question 5

The authorization approach that is employed when multiple organizational officials either from the same organization or different organizations, have a shared interest in authorizing an information system.
Response:

A. Mingle B. Joint C. Single D. Double

Correct Answer: B

Question 6

What essential documentation should be included in the system authorization package?
Response:

A. System impact analysis B. Execution plan C. Remediation plan (or plan of action and milestones) D. Certification statement E. Requirement analysis F. Risk assessment (which includes a minimum security baseline assessment, and which may be an attachment to the system security plan) G. System security plan H. Certification test plan and results report (might also be referred to as a security assessment report)

Correct Answer: C,D,F,G,H

Question 7

What does avoidance mean with respect to risk response?
Response:

A. It can mean bying an insurance B. It means simply ignoring risk C. It means implementing security controls D. It means not venturing in a project due to high risk

Correct Answer: D

Question 8

Which National Institute of Standards and Technology Special Publication (NIST SP) 800 series document is concerned with continuous monitoring for federal information systems and organizations? Response:

A. SP 800-64 B. SP 800-144 C. SP 800-26 D. SP 800-137

Correct Answer: D

Question 9

Amy is the project manager for her company. In her current project the organization has a very low tolerance for risk events that will affect the project schedule. Management has asked Amy to consider the affect of all the risks on the project schedule.
What approach can Amy take to create a bias against risks that will affect the schedule of the project? Response:

A. She can shift risk-laden activities that affect the project schedule from the critical path as much as possible. B. She can filter all risks based on their affect on schedule versus other project objectives. C. She can have the project team pad their time estimates to alleviate delays in the project schedule. D. She can create an overall project rating scheme to reflect the bias towards risks that affect the project schedule.

Correct Answer: D

Question 10

A continuous monitoring strategy for a new system is developed during which phase of the system development life cycle?
Response:

A. Development/Acquisition B. Initiation C. Operations/Maintenance D. Concept/requirements definition

Correct Answer: A

Question 11

Who is primarily responsible for categorizing the Information System? Response:

A. System architect B. IS program manager C. CIO D. Information system owner

Correct Answer: D

ISC Certified in Governance Risk and Compliance - CGRC Exam Practice Test