Crucial Exams

ISC2 Governance, Risk and Compliance (CGRC) Practice Question

While drafting the System Security Plan (SSP) for a newly categorized moderate-impact web application, you discover that the organization's enterprise boundary protection service already satisfies control SC-7 for every system in the enclave. According to RMF guidance, what is the MOST appropriate way to reflect this control in the application's SSP?

  • Mark SC-7 as Not Applicable because boundary protection is provided outside the system boundary.

  • Redefine SC-7 as a hybrid control and restate all implementation details in both the SSP and the common control documentation.

  • Indicate SC-7 as inherited, reference the common control provider's authorization package, and document any remaining monitoring responsibilities.

  • Copy the full enterprise firewall configuration into the SSP so assessors can evaluate it directly.

ISC2 Governance, Risk and Compliance (CGRC)
Selection and Approval of Framework, Security, and Privacy Controls
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot