Absolute Free CGRC Exam Practice for Comprehensive Preparation 

Which of the following factors should be considered when determining residual risk?

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

Security controls are assessed for a number of reasons. Which of the following are reasons for assessing security controls? Select all that apply.

An organization has implemented network segmentation as a security control to prevent unauthorized access to sensitive data. However, the organization has recently experienced a data breach in which an attacker was able to move laterally between different segments of the network. Which of the following is the most likely reason for the failure of this control?

Which of the following statements about OMB Circular A-130 is true?