Question 1

During the security controls assessment phase, the security control assessor at Ratio Corp is responsible for testing the effectiveness of the security controls. Which of the following is the most important consideration when conducting security control testing?

Options :

A : The number of security controls implemented

B : The potential risks to the information system

C : The availability of skilled personnel to conduct the testing

D : The number of positive reviews of the implemented controls

Answer: B

Question 2

During what phase of the SDLC does authorization reporting for new systems take place?

Options :

A : Operations/Maintenance

B : Development/Acquisition

C : Implementation/Assessment

D : Initiation (concept/requirements definition)

Answer: C

Question 3

What is the purpose of a security control baseline?

Options :

A : To establish a standard set of security controls that can be applied to all federal information systems and organizations

B : To define the criticality of information assets and systems within an organization

C : To establish the requirements for compliance with legal and regulatory frameworks

D : To define the rules for incident response and reporting

Answer: A

Question 4

During a system authorization process, the authorizing official is not satisfied with the risk assessment report's level of detail. What should the system owner do in this situation?

Options :

A : Proceed with the authorization process without addressing the concern.

B : Revise the risk assessment report to address the authorizing official-s concerns.

C : Request a third-party assessment of the system-s risks.

D : Consult the information security officer for guidance.

Answer: B

Question 5

Which of the following is the best example of a common control?

Options :

A : A security policy that is tailored to a specific information system

B : A system administrator who is responsible for the security of a specific information system

C : A firewall that is used to protect multiple information systems

D : A security assessment that is conducted for a specific information system

Answer: C

Free CGRC Mock Exam – Practice Online Confidently

Buying Options: