ISC CGRC Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Assessment/Audit of Security and Privacy Controls | 16% | - Assessment and auditing
|
| Topic 2: Selection and Approval of Framework, Security, and Privacy Controls | 14% | - Control selection process
|
| Topic 3: Security and Privacy Governance, Risk Management, and Compliance Program | 16% | - Governance and risk management
|
| Topic 4: Compliance Maintenance | 13% | - Continuous monitoring and maintenance
|
| Topic 5: System Compliance | 14% | - Authorization and compliance activities
|
| Topic 6: Implementation of Security and Privacy Controls | 17% | - Control deployment
|
| Topic 7: Scope of the System | 10% | - System scoping activities
|
ISC Certified in Governance Risk and Compliance Sample Questions:
Question #1
Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Which of the following areas can be exploited in a penetration test?
Each correct answer represents a complete solution. Choose all that apply.
Response:
A. Kernel flaws
B. Social engineering
C. Race conditions
D. Trojan horses
E. File and directory permissions
F. Buffer overflows
G. Information system architectures
Question #2
One of the following is a formal document that provides an overview of the security requirements for the information system, describes the system and the security controls in place or planned for meeting those requirements.
Response:
A. Initial Risk Assessment
B. Plan of Action and Milestones (POA&M)
C. Security and Privacy assessment reports
D. Security Plan (SP)
Question #3
A security assessment plan comprises of all of the following except one Response:
A. Rules of engagement
B. Scope
C. Methodology
D. Recommendations for remediation
Question #4
Which NIST publication is the Guide to applying RMF in Federal Info Systems a Security Life cycle approach & moved process from four phase certification & accreditation approach to emphasis risk management in a 6 step authorization process.
Response:
A. NIST SP 800-40
B. NIST SP 800-53
C. NIST SP 800-37
D. NIST SP 800-39
Question #5
Which of the following publications serves as a guide for the selection of security controls?
Response:
A. FIPS 199 and NIST SP 800-60
B. Organizational policy and procedures
C. System security plan and security assessment report
D. NIST SP 800-53 and FIPS 200
Solutions:
| Question #1 Correct Answer: A,B,C,D,E,F | Question #2 Correct Answer: D | Question #3 Correct Answer: D | Question #4 Correct Answer: C | Question #5 Correct Answer: D |
793 Customer Reviews
Quality and ValueITCertKing Practice Exams are written to the highest standards of technical accuracy, using only certified subject matter experts and published authors for development - no all study materials.
Tested and ApprovedWe are committed to the process of vendor and third party approvals. We believe professionals and executives alike deserve the confidence of quality coverage these authorizations provide.
Easy to PassIf you prepare for the exams using our ITCertKing testing engine, It is easy to succeed for all certifications in the first attempt. You don't have to deal with all dumps or any free torrent / rapidshare all stuff.
Try Before BuyITCertKing offers free demo of each product. You can check out the interface, question quality and usability of our practice exams before you decide to buy.
