[2026] CGRC Exam Dumps, Test Engine Practice Test Questions [Q54-Q77]

NEW QUESTION 54
An analysis of an information system’s requirements, functions, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption.
Response:

Business Impact Analysis (BIA)

Business Continuity Plan (BCP)

Business Recovery/Disruption Plan (BRP)

Disaster Recovery Plan (DRP)

NEW QUESTION 55
According to RMF which role has a primary responsibility to report the security status of the information system to the AO & other appropriate organizational officials on an ongoing basis IAW monitoring strategy (ISSO, CCP, ISSM, AO)?
Response:

Common Control Provider

Information system security officer (ISSO)

Independent assessor

Senior information assurance officer (SIAO)

NEW QUESTION 56
Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process?
Response:

Information system owner

Authorizing Official

Chief Risk Officer (CRO)

Chief Information Officer (CIO)

NEW QUESTION 57
Who is primarily responsible for the development of system-specific procedures? Response:

The system owner

The information systems security officer (ISSO)

The system architect

The system administrator

NEW QUESTION 58
Which of the following access control models uses a predefined set of access privileges for an object of a system?
Response:

Discretionary Access Control

Mandatory Access Control

Policy Access Control

Role-Based Access Control

NEW QUESTION 59
Which of the following NIST documents defines impact?
Response:

NIST SP 800-53

NIST SP 800-26

NIST SP 800-30

NIST SP 800-53A

NEW QUESTION 60
Which of the following recovery plans includes specific strategies and actions to deal with specific variances to assumptions resulting in a particular security problem, emergency, or state of affairs? Response:

Business continuity plan

Continuity of Operations Plan

Disaster recovery plan

Contingency plan

NEW QUESTION 61
Organizations implement safeguards and countermeasures to protect information resources from risks. One of the following is an administrative safeguard family implemented by the management of an organization.
Response:

Certification and accreditation

Ecryption and integrity checks

FIPS 199 and NIST SP 800-37

Implementation and Assessment

NEW QUESTION 62
The system authorization program often fails due to failure to separate and assign duties at the system level, poor planning, poor systems inventory and many other reasons including which of the following? Response:

Inability to work with remote teams.

Lack of management support.

Lack of project management office.

Insufficient system rights.

NEW QUESTION 63
Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person? Response:

Circumstantial

Incontrovertible

Direct

Corroborating

NEW QUESTION 64
In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur? Response:

Phase 2

Phase 3

Phase 1

Phase 4

NEW QUESTION 65
A level of collaboration may be required between security and privacy control assessors with respect to controls that implemented to achieve both security and privacy objectives. Assessor findings must be:
Response:

A factual reporting on control effectiveness and discovered vulnerabilities

Findings and recommendations for remediation

The results of the control assessment

All of the above

NEW QUESTION 66
According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Which of the following are among the eight areas of IA defined by DoD? Each correct answer represents a complete solution. Choose all that apply.
Response:

VI Vulnerability and Incident Management

DC Security Design & Configuration

EC Enclave and Computing Environment

Information systems acquisition, development, and maintenance

NEW QUESTION 67
Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?
Response:

Chief Information Security Officer

Senior Management

Information Security Steering Committee

Business Unit Manager

NEW QUESTION 68
Risk acceptance when the external subsystem owner or service provider cannot fully meet security expectations should be based on the implementation of……..
Response:

compensating controls. Otherwise, the organization may have to accept a greater degree of risk or determine that the risk is too great to accept and decline use of the external service or subsystem.
Guidance on

compensating controls. Otherwise, the unorganization may have to accept a greater degree of risk or determine that the risk is too great to accept and decline use of the external service or subsystem.
Guidance on

compensating controls. Otherwise, the organization may have to reject a greater degree of risk or determine that the risk is too great to accept and decline use of the external service or subsystem.
Guidance on

compensating controls. Otherwise, the organization may have to accept a greater degree of risk or determine that the risk is too great to reject and decline, use of the external service or system.
Guidance on

NEW QUESTION 69
The process of determining the security category for information or an information system.
Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS 199 for other than national security systems Response:

Security Categorization

Security Category

Security Controls

Adequate Security

NEW QUESTION 70
Frank is the project manager of the NHH Project. He is working with the project team to create a plan to document the procedures to manage risks throughout the project. This document will define how risks will be identified and quantified.
It will also define how contingency plans will be implemented by the project team. What document is Frank and the NHH Project team creating in this scenario? Response:

Project management plan

Resource management plan

Risk management plan

Project plan

NEW QUESTION 71
What publication provides a wide range of security controls as a basis for mitigation measures?
Response:

NIST SP 800-53

NIST SP 800-60

NIST SP 800-39

NIST SP 800-37

NEW QUESTION 72
The tiers of the NIST RMF are
Response:

Operational, management, system.

Confidentiality, integrity, availability.

Organization, mission/business process, information system.

Prevention, detection, recovery.

NEW QUESTION 73
A citizen of the United States or an alien lawfully admitted for permanent residence. Agencies may, consistent with individual practice, choose to extend the protections of the Privacy Act and E
– Government Act to businesses, sole proprietors, aliens, etc.
Response:

Individual

Combined

Private

Mixed

NEW QUESTION 74
An instance of an information type.
Response:

Information

Operation

Destruction

Organization

NEW QUESTION 75
Which of the following RMF phases is known as risk analysis? Response:

Phase 2

Phase 1

Phase 0

Phase 3

NEW QUESTION 76
Which of the following governance bodies directs and coordinates implementations of the information security program?
Response:

Information Security Steering Committee

Senior Management

Business Unit Manager

Chief Information Security Officer

NEW QUESTION 77
Functional description of security control implementation must include which of the following, primarily as related to technical controls employed in the system? Response:

Planned inputs, expected behavior, and expected outputs.

Implementation statement and remediation plan.

Remediation plan and expected outputs

Planned inputs implementation statement and expected behavior