CGRC practice questions 1–10

1. Question 1 · 27 in bank

   Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

   • ASenior Agency Information Security Officer
   • BAuthorizing Official
   • CCommon Control Provider
   • DChief Information Officer

   Show answer

   Answer: C

   Next question

2. Question 2 · 27 in bank

   Select 3

   The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise. What are the responsibilities of a Chief Information Officer? Each correct answer represents a complete solution. Choose all that apply.

   • APreserving high-level communications and working group relationships in an organization
   • BFacilitating the sharing of security risk-related information among authorizing officials
   • CEstablishing effective continuous monitoring program for the organization
   • DProposing the information technology needed by an enterprise to achieve its goals and then working within a budget to implement the plan

   Show answer

   Answer: ACD

   Next question

3. Question 3 · 27 in bank

   Select 3

   The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.

   • AAn ISSE provides advice on the impacts of system changes.
   • BAn ISSE manages the security of the information system that is slated for Certification & Accreditation (C&A).
   • CAn ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).
   • DAn ISSO takes part in the development activities that are required to implement system changes.
   • EAn ISSE provides advice on the continuous monitoring of the information system.

   Show answer

   Answer: ACE

   Next question

4. Question 4 · 27 in bank

   Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process?

   • AInformation system owner
   • BAuthorizing Official
   • CChief Risk Officer (CRO)
   • DChief Information Officer (CIO)

   Show answer

   Answer: A

   Next question

5. Question 5 · 27 in bank

   Which of the following assessment methodologies defines a six-step technical security evaluation?

   • AFITSAF
   • BFIPS 102
   • COCTAVE
   • DDITSCAP

   Show answer

   Answer: B

   Next question

6. Question 6 · 27 in bank

   Select 4

   DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December 1997. What phases are identified by DIACAP? Each correct answer represents a complete solution. Choose all that apply.

   • AAccreditation
   • BIdentification
   • CSystem Definition
   • DVerification
   • EValidation
   • FRe-Accreditation

   Show answer

   Answer: CDEF

   Next question

7. Question 7 · 27 in bank

   Select 4

   System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process. What are the different phases of System Authorization Plan? Each correct answer represents a part of the solution. Choose all that apply.

   • APost-Authorization
   • BPre-certification
   • CPost-certification
   • DCertification
   • EAuthorization

   Show answer

   Answer: ABDE

   Next question

8. Question 8 · 27 in bank

   Select 2

   Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation? Each correct answer represents a complete solution. Choose two.

   • AAccreditation is the official management decision given by a senior agency official to authorize operation of an information system.
   • BAccreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.
   • CCertification is the official management decision given by a senior agency official to authorize operation of an information system.
   • DCertification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

   Show answer

   Answer: AD

   Next question

9. Question 9 · 27 in bank

   Ben is the project manager of the YHT Project for his company. Alice, one of his team members, is confused about when project risks will happen in the project. Which one of the following statements is the most accurate about when project risk happens?

   • AProject risk can happen at any moment.
   • BProject risk is uncertain, so no one can predict when the event will happen.
   • CProject risk happens throughout the project execution.
   • DProject risk is always in the future.

   Show answer

   Answer: D

   Next question

10. Question 10 · 27 in bank

    You are the project manager of the NKJ Project for your company. The project's success or failure will have a significant impact on your organization's profitability for the coming year. Management has asked you to identify the risk events and communicate the event's probability and impact as early as possible in the project. Management wants to avoid risk events and needs to analyze the cost-benefits of each risk event in this project. What term is assigned to the low-level of stakeholder tolerance in this project?

    • ARisk avoidance
    • BMitigation-ready project management
    • CRisk utility function
    • DRisk-reward mentality

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CGRC practice, question 1. 27 questions available.