100% Free ISC2 CGRC Practice Test Questions

Question 1

Which of the following is a key factor in the success of a security awareness and training program?

A : Use of technical jargon and complex language

B : Delivery of training in a one-time, stand-alone format

C : Alignment with organizational goals and culture

D : Restriction of training to high-risk employees only

Answer: C

Question 2

ABC Corporation is considering implementing a new information system that will be critical to its business operations. The system is expected to cost $1 million to implement, and will be used to process sensitive customer information. The chief information officer (CIO) is concerned about the risks associated with the new system, and wants to ensure that the organization's risk appetite is taken into account. Which of the following factors should be considered when determining the risk appetite for the new system?

A : The cost of implementing additional security controls

B : The impact on the organization's reputation if the system is compromised

C : The risk management knowledge of the system owners

D : The level of risk tolerance among the organization's employees

Answer: B

Question 3

A large organization has recently implemented a new system to manage its financial transactions. The system includes several components, such as a database server, web server, and application server, which are all connected to a local network. The organization's IT team has configured the system according to best practices and security policies and has performed several security assessments to ensure its compliance. However, the organization's security team wants to implement continuous monitoring of the system configurations to enhance its security posture. What is the main benefit of implementing continuous monitoring of the system configurations in the scenario described above?

A : To identify any vulnerabilities or misconfigurations in the system that could lead to security breaches

B : To ensure that the system is operating at optimal performance and efficiency

C : To provide a comprehensive view of the organization's security posture

D : To eliminate the need for periodic security assessments and audits

Answer: A

Question 4

True or False: Risk response is the final step in the NIST Risk Management Framework and involves implementing security controls to address identified risks.

A : TRUE

B : FALSE

Answer: B

Question 5

A large organization has recently implemented a new system to manage its financial transactions. The system includes several components, such as a database server, web server, and application server, which are all connected to a local network. The organization's IT team has configured the system according to best practices and security policies and has performed several security assessments to ensure its compliance. However, the organization's security team wants to implement continuous monitoring of the system configurations to enhance its security posture. What is the main benefit of implementing continuous monitoring of the system configurations in the scenario described above?

A : To identify any vulnerabilities or misconfigurations in the system that could lead to security breaches

B : To ensure that the system is operating at optimal performance and efficiency

C : To provide a comprehensive view of the organization's security posture

D : To eliminate the need for periodic security assessments and audits

Answer: A

Free Practice ISC2 CGRC Exam Questions 2025