ISC CGRC Dumps - The Sure Way To Pass Exam

CGRC Exam Questions (Updated 2024) 100% Real Question Answers

NEW QUESTION # 121
Which Certification Level of Effort is indicated by exercise-based and independent assessments?
Response:

• A. Moderate
• B. Medium
• C. High
• D. Low

Answer: C

NEW QUESTION # 122
All of the following except one are assessment objects.
Response:

• A. Mechanisms
• B. Specifications
• C. Examine
• D. Activities and individuals

Answer: C

NEW QUESTION # 123
An official public notice of an organization's system(s) of records, as required by the Privacy Act of 1974, that identifies: (i) the purpose for the system of records; (ii) the individuals covered by information in the system or records; (iii) the categories of records maintained about individuals; and (iv) the ways in which the information is shared.
Response:

• A. System Inventory Process
• B. System of Record
• C. System of Records Notice
• D. System Interconnection

Answer: C

NEW QUESTION # 124
An environmentally conditioned workspace that is partially equipped with information systems and telecommunications equipment to support relocated operations in the event of a significant disruption.
Response:

• A. Cold Site
• B. Hot Site
• C. Data Site
• D. Warm Site

Answer: D

NEW QUESTION # 125
A continuous monitoring strategy for a new system is developed during which phase of the system development life cycle?
Response:

• A. Concept/requirements definition
• B. Initiation
• C. Development/Acquisition
• D. Operations/Maintenance

Answer: C

NEW QUESTION # 126
NIST SP 800-53 describes a family of controls as:
Response:

• A. A grouping of controls that when applied provides a complete protection package for a single network
• B. A grouping of interoperating controls from all three classes of controls
• C. A grouping of control tests from NIST SP 800-53A that corresponds to a class of controls in NIST SP 800-53
• D. A grouping of like controls covering the same subject

Answer: D

NEW QUESTION # 127
All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which the information system is connected best defines:
Response:

• A. Authorization Boundary
• B. Network Boundary
• C. System Boundary
• D. Creditation Boundary

Answer: A

NEW QUESTION # 128
Which of the following is NOT a responsibility of a data owner? Response:

• A. Maintaining and protecting data
• B. Approving access requests
• C. Ensuring that the necessary security controls are in place
• D. Delegating responsibility of the day-to-day maintenance of the data protection mechanisms to the data custodian

Answer: A

NEW QUESTION # 129
Five keys to successful Risk Management Program?
Response:

• A. 1 - Competence of the risk assessment team
  2 - User community awareness and cooperation
  3 - An ongoing evaluation and assessment of the IT-relate mission risks
  4. - Junior managements commitment
  5. - Full support and participation IT team
• B. 1 - Senior management's commitment
  2 - Full support and participation IT team
  3 - Competence of the risk assessment team
  4. - An ongoing evaluation and assessment of the HR-relate mission risks 5.- User community awareness and cooperation
• C. 1 - Senior managements commitment
  2 - Full support and participation IT team
  3 - Competence of the risk assessment team
  4 - User community awareness and cooperation
  5 - An ongoing evaluation and assessment of the IT-relate mission risks
• D. 1 - Full support and participation IT team
  2 - Competence of the risk assessment team
  3 - User community awareness and cooperation
  4. - Senior managements commitment
  5. - An ongoing evaluation and assessment of the IT-relate mission safe.

Answer: C

NEW QUESTION # 130
Which organizational official is responsible for the procurement, development, integration, modification, operation, maintenance, and disposal of an information system? Response:

• A. Information system owner (ISO)
• B. Chief information officer (CIO)
• C. Information system security engineer (ISSE)
• D. Information security architect

Answer: A

NEW QUESTION # 131
A project team member has just identified a new project risk. The risk event is determined to have significant impact but a low probability in the project. Should the risk event happen it'll cause the project to be delayed by three weeks, which will cause new risk in the project. What should the project manager do with the risk event?
Response:

• A. Add the identified risk to the issues log.
• B. Add the identified risk to a quality control management control chart.
• C. Add the identified risk to the risk register.
• D. Add the identified risk to the low-level risk watchlist.

Answer: C

NEW QUESTION # 132
Which publication primarily targets activities in Tier 3 of Risk Management approach/pyramid?
Response:

• A. NIST SP 800-53A
• B. NIST SP 800-38
• C. NIST SP 800-53
• D. NIST SP 800-37

Answer: D

NEW QUESTION # 133
Process of controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modification prior to, during, and after system implementation.
Response:

• A. Security Controls
• B. Configuration Control
• C. Operations Plan
• D. Contingency Plan

Answer: B

NEW QUESTION # 134
The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.
Response:

• A. Security Controls
• B. System-Specific Control
• C. Configuration Controls
• D. Hybrid Controls

Answer: A

NEW QUESTION # 135
A set of specifications for a system, or Configuration Item (CI) within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures. The baseline configuration is used as a basis for future builds, releases, and/or changes.
Response:

• A. Baseline Configuration
• B. Configuration Management
• C. System Configuration
• D. Software Configuration

Answer: A

NEW QUESTION # 136
When a Information System Owner applies a risk based approach to his selection of specific controls; this adjustment is called __________. The revised/tailored control baseline is documented in the system security plan.
Response:

• A. Tailoring
• B. Scoping
• C. Failing
• D. Passing

Answer: A

NEW QUESTION # 137
What is the purpose of the monitor step?
Response:

• A. To maintain an ongoing situational awareness about the security and privacy posture of the information system and the organization
• B. To monitor changes in the system and the environment of operation
• C. To maintain the system in support of risk management decisions
• D. All of the above

Answer: A

NEW QUESTION # 138
The Security Category that guards against the improper modification or destruction of information and includes ensuring information non-repudiation & authenticity.
Response:

• A. Availability
• B. Confidentiality
• C. Integrity
• D. Authenticity

Answer: C

NEW QUESTION # 139
What assessment procedure is designed to work with and complement the assessment procedures to contribute to the grounds for confidence in the effectiveness of the security controls employed in the information system?
Response:

• A. Extended
• B. Based
• C. Cross control
• D. Subordinate

Answer: A

NEW QUESTION # 140
Which if the following is an example of the test assessment method? Response:

• A. Reading vulnerability scan policies and procedures
• B. Conducting a vulnerability scan on web applications
• C. Reviewing the most recent scan reports
• D. Asking administrators about the scanning process

Answer: B

NEW QUESTION # 141
You work as a project manager for SoftTech Inc. You are working with the project stakeholders to begin the qualitative risk analysis process.
You will need all of the following as inputs to the qualitative risk analysis process except for which one? Response:

• A. Risk register
• B. Risk management plan
• C. Stakeholder register
• D. Project scope statement

Answer: C

NEW QUESTION # 142
The security controls (i.e., safeguards or countermeasures) for an information system that primarily are implemented and executed by people (as opposed to systems).
Response:

• A. Embedded controls
• B. Common Control
• C. Visual controls
• D. Operational Controls

Answer: D

NEW QUESTION # 143
Besides the System Owner (SO), what role has the PRIMARY responsibility for implementing the security controls in the security and privacy plans for an Information Systems (IS)? Response:

• A. Information System Security Officer (ISSO)
• B. System administrator
• C. Information Owner (IO)
• D. Common Control Provider (CPP)

Answer: D

NEW QUESTION # 144
System authorization programs are marked by frequent failure due to, among other things, poor planning, poor systems inventory, failure to fix responsibility at the system level, and Response:

• A. inability to work with remote teams.
• B. lack of management support.
• C. lack of a program management office.
• D. insufficient system rights.

Answer: B

NEW QUESTION # 145
Organization official that's responsible for procurement, development, integration, modification, operation, maintenance, and disposal of an Information System.
Response:

• A. Chief Information Officer
• B. Authorizing Official
• C. Information Security Architect
• D. Information System Owner

Answer: D

NEW QUESTION # 146
......

Pass ISC CGRC Exam Quickly With VCE4Dumps: https://passguide.vce4dumps.com/CGRC-latest-dumps.html