ISC2 Certified in Governance, Risk and Compliance (CGRC) Certification Exam Practice Test
Governance, risk, and compliance work connects security controls to organizational objectives, obligations, and changing business conditions. CGRC practice content focuses on decisions such as selecting controls suited to the organization, documenting risks and exceptions, evaluating control design and operation, and assessing how system changes affect security and compliance.
Exam overview
About the ISC2 Certified in Governance, Risk and Compliance (CGRC) Certification Exam
GRC professionals translate requirements into accountable decisions and evidence. That work includes maintaining risk records with clear owners and follow-up actions; reviewing policy exceptions against business needs, risk exposure, and compensating measures; and determining whether controls are appropriately designed and consistently performed. Governance decisions also require connecting system changes and service dependencies to business priorities, approval authority, and risk tolerance. Control selection should reflect the organization’s operating context rather than rely on a one-size-fits-all implementation. Related tasks include setting defensible records-retention practices, identifying continuity gaps exposed by exercises, and reassessing controls when technology or business processes change. These skills support traceable oversight: stakeholders can understand why a decision was made, what evidence supports it, and when further review is needed.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
An organization is selecting a security control implementation approach. Which consideration best supports choosing controls that are appropriate to the organization?
Show answer
Correct answer: AControls should be selected in light of relevant risks and the organization's operating context, including applicable constraints. Recency, documentation volume, or imitation alone does not establish suitability.
An organization is deciding how long to retain records that support a control’s operation. Which approach is most appropriate?
Show answer
Correct answer: BRetention should be governed by applicable requirements, business needs, and organizational records-management rules. This balances the need for accessible evidence with privacy, storage, and disposal considerations.
A business continuity exercise reveals that a recovery process depends on one employee who is unavailable during the test. What is the most useful next step?
Show answer
Correct answer: AExercises are intended to reveal gaps and improve readiness. The dependency should be documented, evaluated, and addressed through actions such as cross-training or documented procedures, with follow-up to confirm improvement.
An organization is developing a method to evaluate whether a control is suitably designed and consistently performed. Which distinction should guide the evaluation?
Show answer
Correct answer: ADesign evaluation considers whether a control, if implemented as described, is capable of meeting its objective. Operating evaluation considers whether it was actually performed consistently and as intended.
A policy exception is requested because a business process cannot currently meet a stated requirement. Which information is most important for a responsible exception review?
Show answer
Correct answer: BAn exception should be evaluated with enough information to understand its rationale and risk, determine whether compensating measures are suitable, assign approval accountability, and set a time-bound review or expiration.
A governance committee is reviewing a proposed change to a system that supports a critical business service. Which governance practice best ensures the decision reflects organizational priorities and accountability?
Show answer
Correct answer: BEstablished decision authorities, informed by business and risk perspectives, support accountable decisions aligned with organizational priorities. Cost or technical feasibility alone does not establish that a change is appropriate.
A department wants to reduce the chance that a single person's mistake causes an unauthorized financial transaction. Which control design principle is most directly relevant?
Show answer
Correct answer: ASeparation of duties divides incompatible responsibilities so that one person cannot complete or conceal a transaction without oversight. It is a common way to reduce error and misuse risk.
How to use this practice test
The free US Practice Tests bank contains 50 published CGRC practice questions. Each session presents up to 20 questions selected at random and shows results afterward. Use a session to identify whether you need more work on risk documentation, control evaluation, exception review, governance decisions, or change-impact analysis; revisit missed scenarios by naming the decision and evidence they require.
Preparation tips
- For each risk scenario, distinguish the risk statement, affected business objective, accountable owner, response, and next review action.
- Practice separating control design from operating effectiveness: identify what the control is intended to do, then what evidence shows it is performed consistently.
- When evaluating an exception, record the unmet requirement, business rationale, risk impact, compensating controls, approval authority, and review date.
- Map system or cloud changes to affected services, data, controls, obligations, and responsible decision-makers before recommending approval.
- After continuity scenarios, identify the dependency or single point of failure and specify a testable corrective action, such as cross-training or documented backup procedures.