ISC2 Governance, Risk and Compliance (CGRC) Practice Question

An assessment found missing multi-factor authentication on a critical system. Two weeks later the system owner deploys MFA and reports the issue closed. As lead assessor, what is the most appropriate next step to validate the corrective action?

Perform a focused follow-up assessment to test the new MFA control on the system.
Wait for the next scheduled annual audit to review MFA implementation in the normal cycle.
Document the owner's statement and mark the finding as resolved without additional testing.
Recalculate the residual risk using assumed control effectiveness and update the POA&M.

Report Issue

Answer Description

When stakeholders report that a deficiency has been corrected, the assessor must determine whether the new or revised control is operating as intended before closing the finding. A focused follow-up or supplemental assessment-using examination, interview, and/or testing techniques directed at the specific control-provides objective evidence of effectiveness. Simply accepting the owner's statement, deferring review until the next full audit, or adjusting risk values without verification would leave the organization exposed if the control is misconfigured or ineffective. Therefore, conducting and documenting a targeted reassessment of the implemented MFA control is the correct response.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.

Why is multi-factor authentication (MFA) critical for system security?

Open an interactive chat with Bash

What does a focused follow-up assessment involve in validating system controls?

Open an interactive chat with Bash

What is the POA&M and why is it updated only after verification?

Open an interactive chat with Bash

Why is multi-factor authentication (MFA) considered critical for system security?

Open an interactive chat with Bash

What tools or methods are commonly used during focused follow-up assessments for control validation?

Open an interactive chat with Bash

What is a POA&M and why wouldn't updating it without validation be appropriate in this scenario?

Open an interactive chat with Bash

Why is a focused follow-up assessment necessary after deploying MFA?

Open an interactive chat with Bash

What techniques are used in a focused follow-up assessment?

Open an interactive chat with Bash

What is residual risk and how does it relate to control effectiveness?

Open an interactive chat with Bash

ISC2 Governance, Risk and Compliance (CGRC)

Assessment/Audit of Security and Privacy Controls

Your Score:

Settings & Objectives

Security and Privacy Governance, Risk Management, and Compliance Program

Scope of the System

Selection and Approval of Framework, Security, and Privacy Controls

Implementation of Security and Privacy Controls

Assessment/Audit of Security and Privacy Controls

System Compliance

Compliance Maintenance

Random Mixed

Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.

Rotate by Objective

Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Hide Score

Check or uncheck an objective to set which questions you will receive.

Bash, the Crucial Exams Chat Bot

AI Bot