Free ISC CGRC Exam Dumps Questions & Answers


Exam Code/Number:	CGRCJoin the discussion
Exam Name:	Certified in Governance Risk and Compliance
Certification:	ISC
Free Question Number:	725
Publish Date:	Aug 19, 2026
# of views:	2048
Rating 100%

Page: 1 / 145
Total 725 questions

Question 1

The risk transference is referred to the transfer of risks to a third party, usually for a fee, it creates a contractual-relationship for the third party to manage the risk on behalf of the performing organization. Which one of the following is NOT an example of the transference risk response?
Response:

A.Warranties
B.Performance bonds
C.Life cycle costing
D.Use of insurance

Question 2

Statements of security capability to: (i) build in additional, but related, functionality to a security control; and/or (ii) increase the strength of the control.
Response:

A.System-Specific Security Control
B.Tailored Security Control Baseline
C.Security Control Inheritance
D.Security Control Enhancements

Question 3

Which of the following roles is also known as the accreditor? Response:

A.Chief Information Officer
B.Data owner
C.Designated Approving Authority
D.Chief Risk Officer

Question 4

Which of the following DITSCAP phases validates that the preceding work has produced an IS that operates in a specified computing environment?
Response:

A.Phase 4
B.Phase 3
C.Phase 2
D.Phase 1

Question 5

Risk acceptance when the external subsystem owner or service provider cannot fully meet security expectations should be based on the implementation of........
Response:

A.compensating controls. Otherwise, the organization may have to accept a greater degree of risk or determine that the risk is too great to accept and decline use of the external service or subsystem.
Guidance on
B.compensating controls. Otherwise, the organization may have to reject a greater degree of risk or determine that the risk is too great to accept and decline use of the external service or subsystem.
Guidance on
C.compensating controls. Otherwise, the unorganization may have to accept a greater degree of risk or determine that the risk is too great to accept and decline use of the external service or subsystem.
Guidance on
D.compensating controls. Otherwise, the organization may have to accept a greater degree of risk or determine that the risk is too great to reject and decline, use of the external service or system.
Guidance on