ISC2 CGRC PRACTICE TEST
QUESTIONS: 101 – 150 AND ANSWERS
WITH SOLUTIONS 2024
101.QWhoQprocures,Qdevelops,Qintegrates,QorQmodifiesQanQinformationQsystem?
a.QProgramQManager
b.QChiefQInformationQOfficer
c.QCertificationQProgramQManager
d.QInformationQSystemQOwnerQ-QANSWERQInformationQSystemQOwner
102.QWhoQhasQtheQresponsibilityQtoQprepareQtheQplanQofQactionQandQmilestonesQbasedQonQtheQfindingsQa
ndQrecommendationsQofQtheQsecurityQassessmentQreport?
a.QSecurityQControlQAssessor
b.QInformationQSystemQOwner
c.QAuthorizingQOfficial
d.QInformationQOwner/StewardQ-QANSWERQInformationQSystemQOwner
103.QYouQhaveQjustQcompletedQtheQControlQAnalysisQstepQinQtheQNISTQSPQ800-
30Qprocess.QWhatQreferenceQwouldQmostQlikelyQbeQusedQtoQidentifyQcontrolsQthatQareQnotQdocumentedQin
QtheQSSP?
a.QNISTQSPQ800-47QRevQ1
b.QNISTQSPQ800-39
c.QNISTQSPQ800-53
d.QNISTQSPQ800-30Q-QANSWERQNISTQSPQ800-53
104.QInQwhichQphaseQofQtheQNISTQSPQ800-
30QprocessQdoesQoneQproduceQtheQRiskQAssessmentQReportQ(RAR)?
a.QFutureQControlQRecommendations
b.QControlQAnalysis
c.QImpactQAnalysis
, d.QResultsQDocumentationQ-QANSWERQResultsQDocumentation
105.QWhichQphaseQofQtheQNISTQSPQ800-30QprocessQwouldQmostQlikelyQuseQtheQCVEQdatabase?
a.QVulnerabilityQIdentification
b.QFutureQControlQRecommendations
c.QImpactQAnalysis
d.QControlQAnalysisQ-QANSWERQVulnerabilityQIdentification
106.QUltimately,QorganizationsQshouldQviewQassessmentQasQanQinformationQgatheringQactivity,QnotQasQaQse
curityQproducingQactivity.QInQaccordanceQwithQNISTQSPQ800-
53A,QwhichQofQtheQfollowingQisQnotQproducedQduringQsecurityQcontrolQassessments?
a.QIdentifyQpotentialQproblemsQorQshortfallsQinQtheQorganization'sQimplementationQofQtheQNISTQRiskQMana
gementQFramework
b.QSupportQbudgetaryQdecisionsQandQtheQcapitalQinvestmentQprocess
c.QCorrectQidentifiedQweaknessesQandQdeficiencies
d.QSupportQinformationQsystemQauthorizationQdecisionsQ-
QANSWERQSupportQbudgetaryQdecisionsQandQtheQcapitalQinvestmentQprocess
107.QWhichQofQtheQfollowingQisQanQobjectiveQofQtheQSystemQCharacterizationQstepQunderQSPQ800-30?
a.QEstablishQDataQandQInformationQSensitivityQLevel
b.QEstablishQThreatQandQVulnerabilityQMatrix
c.QEstablishQSystemQControlQFramework
d.QEstablishQSystemQTestingQProceduresQ-QANSWERQEstablishQDataQandQInformationQSensitivityQLevel
108.QInQaccordanceQwithQNISTQSPQ800-53A,QduringQwhichQphaseQofQtheQNISTQSPQ800-
64QSystemQDevelopmentQLifecycleQareQsecurityQassessmentsQusedQtoQincreaseQconfidenceQorQassuranceQt
hatQtheQsecurityQcontrolsQareQworkingQcorrectlyQforQaQsystem?
a.QOperation/Maintenance
b.QValidation/Assessment
c.QImplementation/Assessment
d.QDevelopment/AcquisitionQ-QANSWERQDevelopment/Acquisition
QUESTIONS: 101 – 150 AND ANSWERS
WITH SOLUTIONS 2024
101.QWhoQprocures,Qdevelops,Qintegrates,QorQmodifiesQanQinformationQsystem?
a.QProgramQManager
b.QChiefQInformationQOfficer
c.QCertificationQProgramQManager
d.QInformationQSystemQOwnerQ-QANSWERQInformationQSystemQOwner
102.QWhoQhasQtheQresponsibilityQtoQprepareQtheQplanQofQactionQandQmilestonesQbasedQonQtheQfindingsQa
ndQrecommendationsQofQtheQsecurityQassessmentQreport?
a.QSecurityQControlQAssessor
b.QInformationQSystemQOwner
c.QAuthorizingQOfficial
d.QInformationQOwner/StewardQ-QANSWERQInformationQSystemQOwner
103.QYouQhaveQjustQcompletedQtheQControlQAnalysisQstepQinQtheQNISTQSPQ800-
30Qprocess.QWhatQreferenceQwouldQmostQlikelyQbeQusedQtoQidentifyQcontrolsQthatQareQnotQdocumentedQin
QtheQSSP?
a.QNISTQSPQ800-47QRevQ1
b.QNISTQSPQ800-39
c.QNISTQSPQ800-53
d.QNISTQSPQ800-30Q-QANSWERQNISTQSPQ800-53
104.QInQwhichQphaseQofQtheQNISTQSPQ800-
30QprocessQdoesQoneQproduceQtheQRiskQAssessmentQReportQ(RAR)?
a.QFutureQControlQRecommendations
b.QControlQAnalysis
c.QImpactQAnalysis
, d.QResultsQDocumentationQ-QANSWERQResultsQDocumentation
105.QWhichQphaseQofQtheQNISTQSPQ800-30QprocessQwouldQmostQlikelyQuseQtheQCVEQdatabase?
a.QVulnerabilityQIdentification
b.QFutureQControlQRecommendations
c.QImpactQAnalysis
d.QControlQAnalysisQ-QANSWERQVulnerabilityQIdentification
106.QUltimately,QorganizationsQshouldQviewQassessmentQasQanQinformationQgatheringQactivity,QnotQasQaQse
curityQproducingQactivity.QInQaccordanceQwithQNISTQSPQ800-
53A,QwhichQofQtheQfollowingQisQnotQproducedQduringQsecurityQcontrolQassessments?
a.QIdentifyQpotentialQproblemsQorQshortfallsQinQtheQorganization'sQimplementationQofQtheQNISTQRiskQMana
gementQFramework
b.QSupportQbudgetaryQdecisionsQandQtheQcapitalQinvestmentQprocess
c.QCorrectQidentifiedQweaknessesQandQdeficiencies
d.QSupportQinformationQsystemQauthorizationQdecisionsQ-
QANSWERQSupportQbudgetaryQdecisionsQandQtheQcapitalQinvestmentQprocess
107.QWhichQofQtheQfollowingQisQanQobjectiveQofQtheQSystemQCharacterizationQstepQunderQSPQ800-30?
a.QEstablishQDataQandQInformationQSensitivityQLevel
b.QEstablishQThreatQandQVulnerabilityQMatrix
c.QEstablishQSystemQControlQFramework
d.QEstablishQSystemQTestingQProceduresQ-QANSWERQEstablishQDataQandQInformationQSensitivityQLevel
108.QInQaccordanceQwithQNISTQSPQ800-53A,QduringQwhichQphaseQofQtheQNISTQSPQ800-
64QSystemQDevelopmentQLifecycleQareQsecurityQassessmentsQusedQtoQincreaseQconfidenceQorQassuranceQt
hatQtheQsecurityQcontrolsQareQworkingQcorrectlyQforQaQsystem?
a.QOperation/Maintenance
b.QValidation/Assessment
c.QImplementation/Assessment
d.QDevelopment/AcquisitionQ-QANSWERQDevelopment/Acquisition
