I85PREP
⌘ K
CGRC study materials
CGRC study resources

CGRC practice questions

One question at a time. Build your CGRC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Privacy Governance, Risk Management, and Compliance Program

Which activity best exemplifies security governance rather than security management?

  1. Deploying firewall rules to segment the network
  2. Reviewing intrusion detection alerts each morning
  3. Approving the organization's enterprise risk appetite Correct answer.
  4. Applying operating system patches on a monthly cycle

Explanation

Governance establishes direction, decision rights, and oversight - including how much risk the organization is prepared to accept. The remaining activities are operational or tactical execution carried out under that direction.

Question 2Security and Privacy Governance, Risk Management, and Compliance Program

Which type of document provides step-by-step instructions for performing a specific task?

  1. Standard
  2. Charter
  3. Procedure Correct answer.
  4. Policy

Explanation

Procedures translate policy intent into detailed, repeatable operational steps. Policies state management intent, standards set mandatory measurable requirements, and charters authorize a body or function.

Question 3Security and Privacy Governance, Risk Management, and Compliance Program

Risk appetite is best described as:

  1. The maximum period of time a critical system may remain unavailable
  2. The amount and type of risk the organization is willing to accept Correct answer.
  3. The level of risk that remains after controls have been implemented
  4. The total value of assets exposed to a specific threat scenario

Explanation

Risk appetite expresses the amount and type of risk leadership is prepared to pursue or retain in order to meet objectives. It is set at the top of the organization and guides subsequent risk treatment decisions.

Question 4Security and Privacy Governance, Risk Management, and Compliance Program

An employee needs to connect an unsupported device to the corporate network. Who should approve an exception to the security policy?

  1. The policy owner accountable for the related risk Correct answer.
  2. The employee's immediate teammates
  3. The internal audit team
  4. The IT service desk manager

Explanation

A policy exception is a decision to accept risk, so it must be made by the role accountable for that risk and documented with a scope and expiry. Audit must remain independent and does not grant exceptions.

Question 5Security and Privacy Governance, Risk Management, and Compliance Program

Residual risk is:

  1. The risk exposure that exists before any controls or treatment are applied
  2. The risk that has been contractually transferred to a third party
  3. The risk that has been fully eliminated through treatment
  4. The risk remaining after controls and treatment are applied Correct answer.

Explanation

Residual risk is what remains once controls and other treatments are in place, and it is compared against risk tolerance to decide whether further action is needed. Pre-control exposure is termed inherent risk.

Question 6Security and Privacy Governance, Risk Management, and Compliance Program

The primary purpose of a data classification scheme is to:

  1. Ensure that all data at rest is encrypted with strong algorithms
  2. Apply protection proportionate to the sensitivity of the information Correct answer.
  3. Assign accountability for completing data backups on schedule
  4. Reduce the total volume of data stored by the organization

Explanation

Classification drives proportionate handling, access, and control requirements based on sensitivity and criticality. Encryption and backup schedules are specific controls selected after classification, not its purpose.

Question 7Security and Privacy Governance, Risk Management, and Compliance Program

A key risk indicator (KRI) is intended primarily to:

  1. Confirm that a control activity was performed on schedule
  2. Provide early warning that risk exposure is increasing Correct answer.
  3. Record the root cause of incidents that have already occurred
  4. Report financial results against the approved budget

Explanation

KRIs are forward-looking metrics that signal rising exposure before losses occur, allowing pre-emptive action. Control-completion measures are key control indicators and incident analyses are lagging by nature.

Question 8Security and Privacy Governance, Risk Management, and Compliance Program

Which of the following is an internal compliance obligation?

  1. A statutory data retention requirement
  2. A contractual right-to-audit clause held by a client
  3. The organization's own acceptable use policy Correct answer.
  4. A regulator's breach notification deadline

Explanation

Internal obligations are self-imposed through policies, standards, and internal agreements, and are enforced by the organization itself. The other options originate from regulators, statutes, or contracts and are externally imposed.

Question 9Security and Privacy Governance, Risk Management, and Compliance Program

An organization buys a cyber insurance policy to cover breach response costs. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk transfer Correct answer.
  4. Risk mitigation

Explanation

Insurance shifts the financial consequence of an event to a third party, which is the defining characteristic of risk transfer. Some residual retention usually remains through deductibles and exclusions.

Question 10Security and Privacy Governance, Risk Management, and Compliance Program

A contract with a critical SaaS provider should include which provision to allow the organization to verify the provider's security controls?

  1. A most-favored-customer pricing clause
  2. A unilateral termination-for-convenience clause
  3. A service credit schedule
  4. A right-to-audit clause Correct answer.

Explanation

A right-to-audit or right-to-assess clause preserves the customer's ability to obtain evidence and test provider controls. Pricing, credits, and termination rights address commercial outcomes rather than control assurance.

Question 11Security and Privacy Governance, Risk Management, and Compliance Program

A gap analysis compares:

  1. the current control environment against a target framework or requirement Correct answer.
  2. the security capability of one vendor against that of a competing vendor
  3. the number of incidents this year against last year
  4. actual spending against the approved security budget

Explanation

Gap analysis measures the distance between the present state and a defined target, such as a framework, regulation, or contractual requirement. Its output feeds remediation planning and risk prioritization.

Question 12Security and Privacy Governance, Risk Management, and Compliance Program

Which set of elements is essential in a risk register entry?

  1. Control test script, statistical sampling method, evidence repository, and reviewer sign-off
  2. Risk description, owner, likelihood and impact rating, and treatment status Correct answer.
  3. Budget line item, purchase order reference, vendor name, and depreciation schedule
  4. Incident ticket number, assigned analyst name, containment date, and closure approval

Explanation

A risk register must identify each risk, assign accountability, record assessed likelihood and impact, and track treatment status so the risk can be managed over time. Test scripts, incident tickets, and financial records support other processes.

Question 13Security and Privacy Governance, Risk Management, and Compliance Program

Which measure is a leading indicator of security program risk?

  1. Percentage of staff failing simulated phishing tests Correct answer.
  2. Total regulatory fines paid year to date
  3. Count of incidents closed beyond the remediation SLA
  4. Number of confirmed data breaches in the last quarter

Explanation

Phishing simulation failure rates signal susceptibility that may produce future incidents, making them predictive. Breach counts, fines paid, and overdue closures all describe outcomes that have already occurred.

Question 14Security and Privacy Governance, Risk Management, and Compliance Program

A retailer collects customers' birth dates to verify age eligibility for restricted products but then retains them indefinitely to build marketing profiles. Which fair information principle is most directly violated?

  1. Purpose limitation Correct answer.
  2. Data accuracy
  3. Security safeguards
  4. Individual participation

Explanation

Purpose limitation requires personal data to be used only for the purposes for which it was collected, unless a new lawful basis exists. Reusing age-verification data for marketing without a new basis breaches that principle.

Question 15Security and Privacy Governance, Risk Management, and Compliance Program

The primary role of a security steering committee is to:

  1. Perform independent testing of security controls and report findings to the board
  2. Provide cross-functional oversight and prioritize security initiatives Correct answer.
  3. Approve individual firewall change requests submitted by the network team
  4. Administer day-to-day user access provisioning and deprovisioning tasks

Explanation

A steering committee brings business, IT, risk, and legal stakeholders together to set priorities, resolve conflicts, and align security investment with business objectives. It operates at a governance level rather than performing technical or assurance work.

Question 16Security and Privacy Governance, Risk Management, and Compliance Program

An internal audit reports that access reviews were not performed for a critical system. The most appropriate GRC response is to:

  1. Remove the system from the audit scope for the next cycle
  2. Reassign the finding to the vendor that hosts the system
  3. Close the finding because no security incident resulted
  4. Assign a remediation owner and track a corrective action plan to closure Correct answer.

Explanation

Findings require an accountable owner, agreed corrective actions, target dates, and tracked verification of completion. Absence of an incident does not eliminate the deficiency, and narrowing audit scope would undermine assurance.

Question 17Security and Privacy Governance, Risk Management, and Compliance Program

Mapping multiple regulatory obligations to a single set of common controls primarily helps an organization to:

  1. Eliminate the need for external audits
  2. Guarantee that no compliance gaps exist
  3. Transfer regulatory accountability to its service providers
  4. Reduce duplicated compliance effort and unify evidence collection Correct answer.

Explanation

A common control set lets one control and one piece of evidence satisfy several obligations, lowering cost and improving consistency. It cannot remove legal accountability, eliminate audits, or guarantee the absence of gaps.

Question 18Security and Privacy Governance, Risk Management, and Compliance Program

Which of the following is a detective control?

  1. Reviewing privileged-access logs for anomalies Correct answer.
  2. Encrypting data at rest with AES-256
  3. Requiring multi-factor authentication at logon
  4. Segregating development and production networks

Explanation

Detective controls identify and report events after or while they occur, enabling response. The other options are preventive because they stop or block unauthorized activity before it succeeds.

Question 19Security and Privacy Governance, Risk Management, and Compliance Program

Who is accountable for classifying a data set and deciding which roles may access it?

  1. The business data owner Correct answer.
  2. The security operations center analyst
  3. The internal audit function
  4. The data custodian who operates the storage platform

Explanation

The data owner is the business role accountable for the information, including classification and authorization decisions. Custodians implement those decisions, and audit provides independent assurance.

Question 20Security and Privacy Governance, Risk Management, and Compliance Program

A legacy application cannot support multi-factor authentication and will remain in service for two more years. The most appropriate GRC action is to:

  1. Waive the requirement permanently for all legacy systems
  2. Record the gap in the audit report and take no further action
  3. Disable the application until it can be upgraded
  4. Document a time-bound exception with compensating controls and formal risk acceptance Correct answer.

Explanation

Where a requirement cannot be met, the risk should be reduced through compensating controls, formally accepted by the accountable owner, and limited in duration with a remediation date. Permanent or blanket waivers remove accountability without addressing exposure.

Question 21Security and Privacy Governance, Risk Management, and Compliance Program

In the three lines model, which function provides independent assurance over the effectiveness of risk management and controls?

  1. Internal audit, reporting to the governing body Correct answer.
  2. Operational management that owns and executes the controls
  3. The risk and compliance function that monitors the first line
  4. The external service provider hosting the controls

Explanation

Internal audit forms the third line and gives independent, objective assurance directly to the governing body. The first line owns and performs the work, while the second line sets frameworks and monitors.

Question 22Security and Privacy Governance, Risk Management, and Compliance Program

A proposed control costs $30,000 per year. It is expected to reduce annualized loss expectancy from $120,000 to $45,000. What is the net annual benefit of the control?

  1. $15,000
  2. $75,000
  3. $30,000
  4. $45,000 Correct answer.

Explanation

The control reduces expected annual loss by $75,000 ($120,000 minus $45,000). Subtracting the $30,000 annual cost yields a net benefit of $45,000, which justifies the investment on a purely quantitative basis.

Question 23Security and Privacy Governance, Risk Management, and Compliance Program

An assessor inspects the documented configuration of a control once to determine whether, as designed, it can achieve the control objective. This test evaluates:

  1. Design effectiveness Correct answer.
  2. Control maturity level
  3. Operating effectiveness
  4. Risk appetite alignment

Explanation

Design effectiveness asks whether a control, as specified and implemented, is capable of meeting the objective. Operating effectiveness instead asks whether it actually performed consistently over the review period.

Question 24Security and Privacy Governance, Risk Management, and Compliance Program

A subsidiary's local law requires that customer records be stored only within the country, while a global contract commits the company to a single centralized data lake. The GRC analyst's best first step is to:

  1. Move the records to the centralized data lake and monitor for any regulatory action
  2. Ask the local regulator to waive the data residency requirement on an informal basis
  3. Terminate the global contract immediately without further analysis of the options
  4. Document the conflict as a compliance risk and escalate to legal and the risk owner Correct answer.

Explanation

Conflicting obligations are a compliance risk that must be recorded, assessed, and escalated to those with authority to decide, such as legal and the accountable risk owner. Taking unilateral operational or contractual action before that analysis creates avoidable legal exposure.

Question 25Security and Privacy Governance, Risk Management, and Compliance Program

Two business units each rate a shared vendor as medium risk, but the vendor supports a service on which both depend. An enterprise risk assessment should:

  1. Average the two ratings and report medium enterprise risk
  2. Assess concentration and correlated impact, which may raise the aggregate rating Correct answer.
  3. Report the lower of the two ratings to avoid duplication
  4. Exclude the vendor because each unit has already assessed it

Explanation

Enterprise risk management looks beyond unit-level ratings to concentration, interdependency, and correlated impact. A shared dependency can make a moderate unit-level risk materially higher at the organizational level.

Question 26Security and Privacy Governance, Risk Management, and Compliance Program

Risk tolerance is best described as:

  1. the complete inventory of risks that the organization identified and recorded during its most recent enterprise risk assessment
  2. the threshold at which a risk must be transferred to a third party before the project can proceed to production
  3. the maximum financial loss an insurer will reimburse in a single claim under the organization's cyber liability policy
  4. the acceptable variation the organization can withstand around its stated risk appetite Correct answer.

Explanation

Risk appetite is the amount and type of risk an organization is willing to pursue or retain to meet its objectives; risk tolerance is the acceptable level of variation around that appetite within a specific area. Tolerance therefore operates as an operational boundary that tells risk owners when escalation or treatment is required, rather than as an inventory, an insurance limit, or a mandatory transfer trigger.

Question 27Security and Privacy Governance, Risk Management, and Compliance Program

A business unit cannot meet the new 16-character password standard on a legacy manufacturing system and needs 12 months to replace the system. What is the most appropriate GRC action?

  1. Close the associated audit finding once the business unit confirms that it understands the intent of the password standard
  2. Record a time-bound exception that documents compensating controls and acceptance by the accountable risk owner Correct answer.
  3. Lower the enterprise password standard to 12 characters so that the legacy system is brought into compliance immediately
  4. Accept the deviation informally and record it in the project team's meeting minutes so the decision is visible to those who attended

Explanation

A deviation from a mandatory standard is governed through a formal exception or waiver process: the residual risk is documented, compensating controls are identified, a risk owner with authority formally accepts the risk, and an expiry date forces re-evaluation. This preserves the integrity of the standard while allowing a controlled, auditable path for a known constraint.

Question 28Security and Privacy Governance, Risk Management, and Compliance Program

Two business units assess the same shared application. Unit A uses a 3-point likelihood scale based on annual event frequency, while Unit B uses a 5-point scale based on exploitability. Leadership wants one ranked view of enterprise risk. What is the most significant consequence of the current approach?

  1. The assessment will be performed twice, which doubles the cost of the risk assessment process without any other effect
  2. The resulting scores cannot be reliably compared or aggregated into a single enterprise risk view Correct answer.
  3. Unit B's result will be more accurate because exploitability is always a stronger predictor of loss than event frequency
  4. Both units will have to acquire a dedicated risk management platform before their results can be discussed at all

Explanation

Scores produced on different scales, with different rating criteria, are not commensurable; combining them produces an enterprise ranking that reflects methodological differences rather than actual exposure. Consistent likelihood and impact definitions, plus a common scoring method, are prerequisites for aggregating risk data across units.

Question 29Security and Privacy Governance, Risk Management, and Compliance Program

An assessor tests a quarterly access recertification control across 40 samples drawn from four quarters. In three samples, the reviewer approved access with no evidence that any review was performed. Which conclusion is most defensible?

  1. The control has an operating deficiency because the failures show the review step was not consistently performed Correct answer.
  2. The control is operating effectively because 37 of the 40 samples, or 92.5 percent, passed testing with no exceptions noted
  3. No conclusion can be drawn from the sample until every access recertification performed in the period has been tested
  4. The control is ineffective as designed and must be redesigned before any further testing of the control can take place

Explanation

Design effectiveness asks whether a control, as constructed, can achieve the objective; operating effectiveness asks whether it actually worked throughout the period. Evidence that the review step was skipped indicates an operating failure in execution, and sampling is an accepted basis for drawing that conclusion without testing the full population.

Question 30Scope of the System

What is the primary purpose of establishing an authorization boundary for an information system?

  1. To satisfy network segmentation requirements imposed by the firewall architecture
  2. To document which vendors are contractually obligated to deliver security updates
  3. To define the resources for which the authorizing official accepts risk Correct answer.
  4. To determine the final security categorization of every data element stored

Explanation

The authorization boundary defines what is inside the system for risk-management purposes: the people, processes, technologies, and data for which the authorizing official renders an authorization decision. Everything outside that boundary is either another system, a shared service, or the environment of operation. Accurate boundaries prevent unassessed risk from being shifted outside the accreditation decision.

Question 31Scope of the System

A system processes three information types. Their FIPS 199 confidentiality impacts are low, moderate, and low; all three have moderate integrity impact; availability impacts are low, moderate, and high. What is the system's overall security category?

  1. Confidentiality moderate, integrity low, availability high
  2. Confidentiality moderate, integrity moderate, availability high Correct answer.
  3. Confidentiality low, integrity low, availability high
  4. Confidentiality moderate, integrity moderate, availability moderate

Explanation

FIPS 199 requires selecting the highest impact for each security objective across all information types processed by the system, then taking the high-water mark of those three values as the overall category. Confidentiality is moderate, integrity is moderate, and availability is high. The overall security category is therefore high.

Question 32Scope of the System

Which NIST publication provides provisional impact values that organizations can use when mapping information types to security categories?

  1. NIST SP 800-30
  2. NIST SP 800-53
  3. NIST SP 800-37
  4. NIST SP 800-60 Correct answer.

Explanation

NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, supplies example information types with provisional confidentiality, integrity, and availability impact values. Organizations use these as a starting point and then adjust them for their own mission context.

Question 33Scope of the System

A security control is implemented once at the organization level and is inherited by many information systems. This control is best described as:

  1. A common control Correct answer.
  2. A system-specific control
  3. A compensating control
  4. A hybrid control

Explanation

Common controls are implemented, managed, and assessed at the organizational or program level and can be relied upon by multiple systems. Each inheriting system documents the control as inherited and identifies the responsible provider. System-specific and hybrid controls involve work done at or for the individual system.

Question 34Scope of the System

Which statement best describes a hybrid security control?

  1. A control that combines technical and physical safeguards into one procedure
  2. A control required only when a system is categorized moderate or high
  3. A control that substitutes for a baseline control that cannot be implemented
  4. A control partly implemented by a common provider and partly by the system Correct answer.

Explanation

A hybrid control has both a common portion delivered by an organizational provider and a system-specific portion implemented locally. The security plan must clearly allocate responsibility for each portion so that no part of the control goes unassessed. This allocation is central to accurate scoping and inheritance documentation.

Question 35Scope of the System

A control that is implemented entirely within one information system and cannot be inherited by other systems is called:

  1. A program-level control
  2. An inherited control
  3. A common control
  4. A system-specific control Correct answer.

Explanation

System-specific controls are implemented and assessed within the boundary of one system and are unique to that system's mission, architecture, or data. They cannot be claimed as inherited by other systems. Common and program-level controls, by contrast, are shared across the organization.

Question 36Scope of the System

Which element is essential to capture when registering a new information system in the organization's system inventory for scoping purposes?

  1. The marketing name under which the system is offered to customers
  2. The authorization boundary and assigned security categorization Correct answer.
  3. The physical dimensions of the data center hosting the hardware
  4. The name of the developer who coded the primary application

Explanation

The system inventory is the authoritative record used to track which systems exist, what their boundaries are, and how they are categorized. Boundary and categorization data drive baseline selection, assessment planning, and continuous monitoring. Without them the organization cannot determine which systems require authorization.

Question 37Scope of the System

Two systems exchange production data over a direct network connection. What must be in place to formally document the security terms and responsibilities of this relationship?

  1. A memorandum of understanding limited to billing
  2. A service level agreement covering uptime only
  3. An interconnection security agreement approved by both parties Correct answer.
  4. A privacy impact assessment for each individual user

Explanation

Direct connections between systems require an interconnection security agreement that documents the security requirements, responsibilities, and rules of behavior for each party. It also supports recording the interconnection in the security plans of both systems. Billing or availability documents do not address security obligations.

Question 38Scope of the System

A system initially categorized moderate adds a module that stores data whose FIPS 199 availability impact is high. The moderate baseline lacks the controls needed for that high availability objective. What is the most appropriate action?

  1. Defer the decision until the next scheduled annual assessment cycle
  2. Recategorize the system and select and tailor the high baseline Correct answer.
  3. Split the module into a separate system with a low categorization to reduce assessment effort
  4. Keep the moderate categorization and rely on compensating controls documented in the SSP

Explanation

Introducing information with a higher impact changes the system's security category, and the control baseline must follow the category. The correct response is to recategorize, select the high baseline, and tailor it to remove controls that genuinely do not apply. Deferring or artificially splitting the system leaves the authorizing official's risk decision unaligned with actual impact.

Question 39Scope of the System

How is scoping guidance used when building a control baseline for a system?

  1. It removes all controls the organization finds difficult to implement
  2. It replaces the security categorization as the basis for control selection
  3. It adds supplemental controls beyond the baseline for every information type
  4. It determines which baseline controls apply given the system's architecture and operating environment Correct answer.

Explanation

Scoping guidance allows an organization to decide which controls in a baseline are applicable based on factors such as technology, physical environment, and how the system is deployed. Controls deemed not applicable are documented with justification rather than silently dropped. Categorization remains the starting point for baseline selection.

Question 40Scope of the System

A community-specific set of security controls, supplemental guidance, and assessment procedures built upon an existing baseline is known as a(n):

  1. Control baseline
  2. Overlay Correct answer.
  3. Compensating control
  4. Security category

Explanation

An overlay tailors a baseline for a specific community, technology, or mission, adding or strengthening controls and assessment procedures as needed. Overlays are applied after the baseline is selected and are documented so that assessors know what is expected. They are not a substitute for the baseline itself.

Question 41Scope of the System

When a baseline control cannot be implemented as specified in a given operating environment, the organization may:

  1. Waive the requirement informally without documenting the decision
  2. Transfer responsibility for the control to the authorizing official
  3. Implement an alternative control with comparable protection and document it Correct answer.
  4. Delete the control from the system security plan and proceed to assessment

Explanation

An alternative or compensating control may be used when the specified control is not feasible, provided it delivers equivalent or comparable protection. The security plan must record the alternative, the rationale, and any residual risk. The authorizing official then weighs that residual risk in the authorization decision.

Question 42Scope of the System

A system hosted in an authorized cloud environment relies on the provider for physical security and personnel screening. How should these provider controls be treated in the system's documentation?

  1. As compensating controls requiring a formal waiver from the authorizing official
  2. As system-specific controls that the system owner must assess independently
  3. As out of scope because the provider's infrastructure sits outside the boundary
  4. As inherited controls documented by reference to the provider's package Correct answer.

Explanation

Controls delivered by an authorized provider are inherited by the consuming system and are documented with reference to the provider's authorization package. The system owner confirms that the inherited controls meet the system's categorization and that any customer-responsibility controls are implemented. This avoids duplicate assessment while preserving traceability.

Question 43Scope of the System

Which activity best supports accurate scoping during the categorization step?

  1. Reviewing only the screens and menus presented to end users
  2. Interviewing only the executive sponsor and program manager
  3. Counting the number of servers hosted in each data center
  4. Mapping where information is created, processed, stored, and transmitted Correct answer.

Explanation

Understanding information flows reveals which components, interfaces, and external services participate in processing the data, and therefore what belongs inside the boundary. This mapping also exposes information types that might otherwise be overlooked during categorization. Counting hardware or reviewing screens alone cannot establish where data actually travels.

Question 44Scope of the System

In NIST SP 800-60, information types are organized primarily by:

  1. The contractual tier of the service provider
  2. The technology platform on which they are processed
  3. Mission area and business area Correct answer.
  4. The classification of the network segment

Explanation

SP 800-60 groups information types under mission areas and business areas so organizations can locate comparable types and adopt provisional impact values. The taxonomy is mission-oriented rather than technology-oriented. Organizations then adjust the provisional values to reflect their own circumstances.

Question 45Scope of the System

Under FIPS 199, which security objective addresses protection against unauthorized modification or destruction of information?

  1. Confidentiality
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Availability

Explanation

FIPS 199 defines three security objectives: confidentiality, integrity, and availability. Integrity means guarding against improper modification or destruction of information and includes ensuring information non-repudiation and authenticity. Non-repudiation is a supporting concept within integrity rather than a separate FIPS 199 objective.

Question 46Scope of the System

During an assessment, an assessor finds that a production database used by the system was left outside the authorization boundary, although the same system owner manages it. What is the most significant consequence?

  1. The authorization decision did not account for that component's exposure Correct answer.
  2. The assessment results become invalid only if the database is internet-facing
  3. The database must immediately be reclassified as a common control
  4. The system automatically moves to the high security category

Explanation

The authorization boundary must capture every component whose compromise could affect the system, because the authorizing official accepts risk only for what is inside the boundary. A component omitted from the boundary is effectively unassessed, and its weaknesses are absent from the risk decision. The remedy is to correct the boundary and reassess the affected controls.

Question 47Scope of the System

How does enterprise architecture information support scoping of information systems?

  1. It determines the final approval date of the authorization package
  2. It replaces the need for a security categorization
  3. It lists the individual training records of system administrators
  4. It documents boundaries, interconnections, and shared services Correct answer.

Explanation

Enterprise architecture provides an organization-wide view of systems, interfaces, and shared services that helps define boundaries consistently and identify inheritance opportunities. It also reveals dependencies that might otherwise be missed when a single system is scoped in isolation. It informs, but never replaces, categorization and control selection.

Question 48Scope of the System

A system depends on an external provider for identity and access management services. What should the system's documentation capture about this relationship?

  1. The provider's financial rating and stock performance history
  2. The provider's responsibilities, supplied controls, and the boundary Correct answer.
  3. A separate authorization package for each individual user account
  4. Only the provider's marketing collateral and sales brochure

Explanation

External dependencies must be documented well enough to show where the boundary lies, which controls the provider supplies, and what the system owner remains accountable for. This supports inheritance claims and lets the authorizing official see the full risk picture. Commercial or financial information does not serve that purpose.

Question 49Scope of the System

Which change to an operating system most likely requires re-examination of its security categorization and scope?

  1. Replacing a monitor with an identical model
  2. Updating the user interface theme of the system
  3. Adding a new data field to an existing report
  4. Adding a new information type with a higher impact rating Correct answer.

Explanation

Categorization reflects the highest impact of the information types the system handles, so introducing a higher-impact information type can raise the security category. A raised category may in turn require a different baseline and a revised boundary. The other listed changes do not alter the impact of the information processed.

Question 50Scope of the System

An organization adopts provisional impact values from NIST SP 800-60 for a newly proposed system. What is the next required step?

  1. Use the highest possible impact for all three objectives to be conservative
  2. Review and adjust the provisional values for the specific system Correct answer.
  3. Treat the provisional values as final without further review
  4. Submit the provisional values to the vendor for sign-off

Explanation

Provisional values are a starting point drawn from a generic taxonomy and must be reviewed against the system's actual mission, data, and dependencies. The organization adjusts them where warranted and obtains management approval of the resulting categorization. Only then is the baseline selected.