Selection and Approval of Framework, Security, and Privacy Controls

Identifying baseline and inherited controls, selecting and tailoring controls, and documenting control decisions for organizational compliance.

5 minutes 5 Questions

Selection and Approval of Framework, Security, and Privacy Controls is a critical process within Governance, Risk, and Compliance (GRC) that involves identifying, evaluating, and formally authorizing the appropriate set of controls to protect an organization's information assets and ensure regulato…

Concepts covered
Baseline Controls Identification and DocumentationInherited ControlsControl Allocation and Stakeholder AgreementContinuous Monitoring StrategyVulnerability Management StrategyControl Selection DocumentationData Handling and Marking RequirementsControl Enhancements and OverlaysMitigating ControlsControl Tailoring
Test mode:
Start practice test

CGRC - Selection and Approval of Framework, Security, and Privacy Controls Example Questions

Test your knowledge of Selection and Approval of Framework, Security, and Privacy Controls

Question 1

A company is establishing its first vulnerability management strategy. The security team lead asks a new analyst: 'What is the primary purpose of a vulnerability management strategy?' Which answer best describes this purpose?

Correct Answer: To identify, assess, and remediate security weaknesses in a systematic and ongoing manner

The primary purpose of a vulnerability management strategy is to systematically and continuously identify, assess, and remediate security weaknesses across an organization's environment, reducing the overall attack surface.

The incident response option describes incident management, not vulnerability management, as it focuses on responding to security events rather than proactively addressing weaknesses. The configuration baseline option narrowly focuses on configuration management, which is only one subset of vulnerability management. The risk acceptance option describes a governance process for risk decisions, which may be a component but is not the primary purpose of vulnerability management.

The key concept tested is understanding the core objective and lifecycle of vulnerability management as a proactive, ongoing security practice.

Question 2

An organization is deploying a specialized data analytics platform that leverages an enterprise-wide identity management system. The platform relies heavily on the enterprise system for authentication, but the analytics team must define specific session timeout parameters and access roles locally. During the control selection phase, how should the analytics platform's system owner document the Account Management control to reflect this relationship accurately?

Correct Answer: Record the control as a shared implementation, clearly specifying the enterprise-provided functions alongside the distinct local configuration parameters the platform manages.

The control must be documented as a shared implementation because responsibility is split between the enterprise identity system providing authentication and the local platform managing specific roles and timeouts.

A fully inherited implementation ignores the local configuration responsibilities. A system-specific implementation dismisses the enterprise system's foundational role. A compensating implementation is improperly applied here, as those are used when baseline controls cannot be met rather than for standard division of administrative duties.

Key concept: Shared control implementations and inheritance documentation.

Question 3

A healthcare organization identifies that its patient portal has an authentication bypass vulnerability. The vendor confirms a patch will be available in 30 days. The security team implements network segmentation, enhanced logging, and rate limiting on the portal. During the next risk review meeting, the CISO asks the team to justify how these measures collectively affect the organization's risk posture. Which statement best represents the combined effect of these mitigating controls?

Correct Answer: They reduce the likelihood and potential impact of exploitation while the vulnerability remains unpatched, lowering residual risk to an acceptable threshold

The correct answer accurately describes how compensating controls work together to reduce both the likelihood of exploitation (through rate limiting and network segmentation) and the potential impact (through segmentation limiting lateral movement and enhanced logging enabling faster detection and response), thereby lowering residual risk to an acceptable level while awaiting the permanent fix.

Claiming the controls eliminate the authentication bypass and bring residual risk down to zero is wrong because compensating controls cannot eliminate a vulnerability or reduce residual risk to zero. One option incorrectly characterizes these controls as risk transfer when they are risk mitigation measures. Treating the controls as permanent replacements that make the vendor patch unnecessary is wrong because compensating controls are temporary by nature and do not replace the need for a vendor patch.

Key concept tested: compensating controls as temporary risk mitigation measures that reduce residual risk without eliminating the underlying vulnerability.

More Selection and Approval of Framework, Security, and Privacy Controls questions
267 questions (total)
Practice 100 questions
One session at a time, always new questions