Based on Official Syllabus Topics of Actual ISC CGRC Exam [Q306-Q326]

QUESTION 306
The security control type for an information system that primarily are implemented and executed by people (as opposed to systems).
Response:

QUESTION 307
Which of the following DITSCAP phases validates that the preceding work has produced an IS that operates in a specified computing environment?
Response:

QUESTION 308
What is NIST SP 800-37 R1?
Response:

QUESTION 309
Functional description of security control implementation must include which of the following, primarily as related to technical controls employed in the system? Response:

QUESTION 310
Which of the following describes residual risk as the risk remaining after risk mitigation has occurred? Response:

QUESTION 311
The scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation and maintenance, and ultimately its disposal that instigates another system initiation best describes Response:

QUESTION 312
What RMF role is responsible for assessing impact of changes on systems, process it supports, & data it processes (ISO, AO, ISSO)?
Response:

QUESTION 313
When an authorizing official (AO) submits the security authorization decision, what responses should the information system owner (ISO) expect to receive?
Response:

QUESTION 314
Which of the following is the acronym of RTM?
Response:

QUESTION 315
You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed.
How often should you and the project team do risk identification? Response:

QUESTION 316
Failure to authorize an operational system to process demonstrates that management has not exercised due care in protecting the system in the event of a security incident. Which of the following Acts has been violated?
Response:

QUESTION 317
Which of the following control families belongs to the management class of security controls?
Response:

QUESTION 318
When was Title III of E-Government Act 44 USC sec.351 (Public Law 107-347) passed and signed into law?
Response:

QUESTION 319
Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three.
Response:

QUESTION 320
You are responsible for network and information security at a metropolitan police station. The most important concern is that unauthorized parties are not able to access dat

QUESTION 321
According to NIST SP 800-64 Rev 2 (withdrawn) the system development life cycle is broken down into five phases. Which of the following is not one of the five phases? Response:

QUESTION 322
According to NIST SP 800-53 Rev 5, security controls are broken down into how many control families Response:

QUESTION 323
Which of the following processes is a structured approach to transitioning individuals, teams, and organizations from a current state to a desired future state? Response:

QUESTION 324
An organization’s information systems are a mix of Windows and UNIX systems located in a single computer room. Access to the computer room is restricted by the use of door locks that require proximity cards and personal identification numbers (PINs). Only a small percentage of the organizations employees have access to the computer room. The computer room access restriction is an example of what type of security control relative to the hardware in the computer room?
Response:

QUESTION 325
Any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency.
Response:

QUESTION 326
True or False. Impacts of changes should be known in advance so that appropriate actions can be taken before vulnerabilities are experienced.
Response: