Which document establishes the overall security and privacy posture of an organization and defines the framework for managing risk?
Cgrc Governance Risk
Question · Easy
New hire access: Expectation vs Reality
Short
According to NIST SP 800-37 Rev. 2, who is ultimately responsible for the security and privacy risks associated with an information system?
Question · Medium
Introduction & Exam Overview
0.1 ISC2 CGRC Exam Structure, Logistics & Passing Strategy
Study guide
What is the primary purpose of a risk assessment in the context of security and privacy governance?
Tech Exam Prep Podcast
Listen on Spotify
Podcast
In the NIST Risk Management Framework, during which step does the organization categorize the information system based on impact analysis?
An organization is establishing its compliance program and needs to define the acceptable level of risk that aligns with its business objectives. What document should be created first?
Which of the following BEST describes the relationship between governance, risk management, and compliance (GRC)?
0.2 NIST RMF 7-Step Lifecycle & GRC Architecture
A multinational corporation needs to align its privacy program with international requirements. Which framework would be MOST appropriate for establishing a baseline privacy governance program?
Question · Hard
What is the primary difference between risk appetite and risk tolerance?
According to FIPS 199, how many potential impact levels are defined for categorizing information systems?
Cgrc Scope System
An organization is categorizing a system that processes public information but requires high availability for business operations. What is the resulting FIPS 199 categorization?
Chapter 1: Security and Privacy Governance, Risk Management, and Compliance Program
1.1 Enterprise Governance & GRC Frameworks
What document provides guidance for mapping types of information and information systems to security categories?
During system boundary definition, which of the following is MOST important to identify?
A federal agency is categorizing a system that contains personally identifiable information (PII) of U.S. citizens. According to OMB guidance, what is the MINIMUM potential impact level for confidentiality?
What document specifies minimum security requirements for federal information and information systems?
Cgrc Select Controls
1.2 Security and Privacy Objectives: CIA, Non-Repudiation and Privacy Concepts
Which NIST publication provides the catalog of security and privacy controls for federal information systems?
An organization needs to apply additional controls for a system processing highly sensitive data beyond the standard baseline. What process should be used?
Which of the following is an example of a compensating control?
In NIST SP 800-53 Rev. 5, how many control families are defined?
1.3 Multi-Tier Risk Management & Assessment Methodologies
What is the purpose of a Privacy Impact Assessment (PIA)?
An organization is selecting controls for a cloud-based system. Which SP 800-53 control family would be MOST relevant for addressing cloud-specific supply chain risks?
Which document describes how security controls are implemented in a specific information system?
Cgrc Implement Controls
What type of evidence is MOST appropriate for demonstrating that a technical control has been properly implemented?
1.4 System Development Life Cycle and Information Life Cycle Management
An organization is implementing multifactor authentication (MFA) for system access. Which NIST SP 800-53 control family does this primarily map to?
What is the PRIMARY purpose of security configuration baselines (e.g., CIS Benchmarks, DISA STIGs)?
During control implementation, an organization discovers that a planned technical control cannot be implemented as designed due to system architecture limitations. What should be the FIRST step?
Which role is typically responsible for documenting how specific security controls are implemented in the System Security Plan?
1.5 Establishing and Operating the Compliance Program
What is the PRIMARY purpose of encryption at rest controls?
A healthcare organization is implementing controls to protect patient data. Which regulation must be considered in addition to NIST controls?
Which implementation consideration is MOST important when deploying security controls in a DevOps environment?
What document guides the assessment of security controls by defining the methods, procedures, and resources to be used?
Cgrc Assess Controls
1.6 Legal, Regulatory & Federal Compliance Drivers
Which type of assessment evaluates whether security controls are implemented correctly and operating as intended?
According to NIST SP 800-53A, what are the three types of assessment methods?
An assessor reviews system configuration files to verify that password complexity requirements are properly configured. What assessment method is being used?
What does the Security Assessment Report (SAR) document?
1.7 Privacy Governance, Organizational Roles & ISC2 Code of Ethics
A control assessment reveals that a required security patch was not applied to a critical server. How should this finding be documented?
Which assessment approach involves attempting to exploit vulnerabilities to determine the actual risk to the organization?
In a FedRAMP assessment, who is responsible for conducting the independent assessment of cloud service provider controls?
Loading more…