CGRC試験無料問題集（725題）「ISC Certified in Governance Risk and Compliance 認定」

出題：1

What is the system development life cycle phase for step six of the RMF for an existing system?
Response:

A. Development and Acquisition

B. Maintenance

C. Implementation/Assessment

D. Operations/Maintenance

正解：D 解答を投票する

出題：2

Disclosure of information to unauthorized persons, or a violation of the security policy of a system in which an unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred.
Response:

A. Configuration

B. Contingency

C. Continuity

D. Compromise

正解：D 解答を投票する

出題：3

What role is an agency official responsible for providing advice & other assistance to the head of the executive agency and other senior management personnel of the agency to ensure that IT is acquired and information resources are managed in a manner that is consistent with laws, Executive Orders, directives, policies, regulations, and priorities established by the head of the agency? Response:

A. Information Security Architect (ISA)

B. Information System Owner (ISO)

C. Authorizing Official (AO)

D. Chief Information Officer (CIO)

正解：D 解答を投票する

出題：4

What are information system?
Response:

A. a discrete set of information resources organized for the collection, processing, maintenance, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.

B. a attached set of information resources organized for the collection, processing, maintenance, transmission, and emination of information, in accordance with defined procedures, whether automated or manual.

C. a discrete set of information resources organized for the collection, processing, dereliction, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.

D. a discrete set of information resources organized for the collection, processing, maintenance, transmission, and dissemination of information, in accordance with defined procedures, whether automated or manual.

正解：D 解答を投票する

出題：5

Which of the following is principally used to verify that Information Systems (IS) are meeting their stated security goals and objectives?
Response:

A. Security Control Assessor

B. System Plan (SP)

C. Risk Assessment (RA)

D. Requirements Traceability Matrix (RTM)

正解：B 解答を投票する

出題：6

Which of the following is not a risk factor as stated in NIST SP 800-37? Response:

A. Vulnerability

B. Threat actor

C. Likelihood

D. Threat

正解：B 解答を投票する

出題：7

What does avoidance mean with respect to risk response?
Response:

A. It means implementing security controls

B. It can mean bying an insurance

C. It means not venturing in a project due to high risk

D. It means simply ignoring risk

正解：C 解答を投票する

出題：8

This is a standard that sets essential requirements for assessing the effectiveness of computer security controls built into a computer system?
Response:

A. FITSAF

B. SSAA

C. TCSEC

D. FIPS

正解：C 解答を投票する

出題：9

Which organization is responsible for procurement, development, integration, modification, operation, maintenance, and disposal of an Information System?
Response:

A. Information security architect

B. Information System Owner

C. Chief Information Officer (CIO)

D. Information system security engineer (ISSE)

正解：B 解答を投票する

出題：10

Which of the following individuals is responsible for preparing and submitting security status reports to the organizations?
Response:

A. Senior Agency Information Security Officer

B. Common Control Provider

C. Chief Information Officer

D. Authorizing Official

正解：B 解答を投票する

出題：11

The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes:
(i) the conduct of a risk assessment;
(ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system.
Response:

A. Risk Management

B. Configuration management

C. Procurement management

D. Change management

正解：A 解答を投票する

出題：12

In what step of the RMF process would you create the SSP? Response:

A. Step 4 (Determination)

B. Step 1 (Categorization)

C. Step 3 (Mitigation)

D. Step 2 (Recommendations)

正解：B 解答を投票する

CGRC試験無料問題集「ISC Certified in Governance Risk and Compliance 認定」