Crucial Exams

ISC2 Governance, Risk and Compliance (CGRC) Practice Question

During quarterly continuous monitoring, a control assessor notes that a critical patch cannot be applied for 90 days because the vendor has not yet released a compatible version. The system owner formally accepts the residual risk. According to RMF best practice for ongoing compliance, what should the security team do next to keep this risk visible and managed?

  • Document the risk and its 90-day mitigation timeline in the POA&M and update the risk register with scheduled review dates.

  • Escalate the matter to the Change Control Board to overturn the acceptance decision.

  • Add an entry in the incident response log and wait for an event that triggers a future investigation.

  • Close the vulnerability ticket because the risk has been formally accepted.

ISC2 Governance, Risk and Compliance (CGRC)
Compliance Maintenance
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot