NEWEST GOVERNANCE, RISK AND
COMPLIANCE (CGRC) EXAM | Q&A
WITH RATIONALES
1. What was the former name of the Certified in
Governance, Risk and Compliance (CGRC)
certification?
A) Certified Information Systems Security
Professional (CISSP)
B) Certified Authorization Professional (CAP)
C) Certified Cloud Security Professional (CCSP)
D) Systems Security Certified Practitioner
(SSCP)
Correct answer: B
Rationale: The CGRC certification was originally
launched in 2005 as the Certified Authorization
Professional (CAP) certification. It was updated
to its current name in 2023 to better represent
the knowledge, skills, and abilities required to
earn and maintain it.
,2. Which organization administers the CGRC
certification?
A) CompTIA
B) ISACA
C) (ISC)²
D) GIAC
Correct answer: C
Rationale: The CGRC certification is
administered by the International Information
Systems Security Certification Consortium, or
(ISC)², which manages the certification
program.
3. How many questions are on the CGRC exam
and what is the time limit?
A) 100 questions, 2 hours
B) 125 questions, 3 hours
C) 150 questions, 4 hours
D) 200 questions, 5 hours
Correct answer: B
,Rationale: The CGRC exam is comprised of 125
items and the testing time allowed is three
hours. It is a computer-based test (CBT).
4. What is the format of the CGRC exam?
A) Performance-based and drag-and-drop
questions
B) Primarily four-option multiple-choice
questions with one correct key
C) A combination of essay and multiple-choice
questions
D) An open-book format with simulation
questions
Correct answer: B
Rationale: The CGRC exam is a computer-based
test comprised primarily of four-option multiple-
choice items with one correct key.
5. What type of scoring system is used for the
CGRC exam?
A) A scaled score of 700 out of 1000 points
, B) A percentage score with 70% required to
pass
C) A pass/fail decision only
D) A logit cut score determined by an IRT Rasch
model
Correct answer: D
Rationale: ISC2 uses an IRT Rasch model to set
the cut score and equate all forms for the CGRC
exam. The minimum passing score is a logit cut
score of 0.5663. Failing candidates receive
feedback on their exam performance by
domains.
6. What is the minimum work experience
requirement for full CGRC certification?
A) 6 months
B) 1 year
C) 2 years
D) 5 years
Correct answer: C
COMPLIANCE (CGRC) EXAM | Q&A
WITH RATIONALES
1. What was the former name of the Certified in
Governance, Risk and Compliance (CGRC)
certification?
A) Certified Information Systems Security
Professional (CISSP)
B) Certified Authorization Professional (CAP)
C) Certified Cloud Security Professional (CCSP)
D) Systems Security Certified Practitioner
(SSCP)
Correct answer: B
Rationale: The CGRC certification was originally
launched in 2005 as the Certified Authorization
Professional (CAP) certification. It was updated
to its current name in 2023 to better represent
the knowledge, skills, and abilities required to
earn and maintain it.
,2. Which organization administers the CGRC
certification?
A) CompTIA
B) ISACA
C) (ISC)²
D) GIAC
Correct answer: C
Rationale: The CGRC certification is
administered by the International Information
Systems Security Certification Consortium, or
(ISC)², which manages the certification
program.
3. How many questions are on the CGRC exam
and what is the time limit?
A) 100 questions, 2 hours
B) 125 questions, 3 hours
C) 150 questions, 4 hours
D) 200 questions, 5 hours
Correct answer: B
,Rationale: The CGRC exam is comprised of 125
items and the testing time allowed is three
hours. It is a computer-based test (CBT).
4. What is the format of the CGRC exam?
A) Performance-based and drag-and-drop
questions
B) Primarily four-option multiple-choice
questions with one correct key
C) A combination of essay and multiple-choice
questions
D) An open-book format with simulation
questions
Correct answer: B
Rationale: The CGRC exam is a computer-based
test comprised primarily of four-option multiple-
choice items with one correct key.
5. What type of scoring system is used for the
CGRC exam?
A) A scaled score of 700 out of 1000 points
, B) A percentage score with 70% required to
pass
C) A pass/fail decision only
D) A logit cut score determined by an IRT Rasch
model
Correct answer: D
Rationale: ISC2 uses an IRT Rasch model to set
the cut score and equate all forms for the CGRC
exam. The minimum passing score is a logit cut
score of 0.5663. Failing candidates receive
feedback on their exam performance by
domains.
6. What is the minimum work experience
requirement for full CGRC certification?
A) 6 months
B) 1 year
C) 2 years
D) 5 years
Correct answer: C
