1500 Questions | CGRC Exam: From Beginner to Certified 2026

Risk (25%): Expertise in risk assessment, a practical guide to cyber risk management strategies, and implementing robust security controls.

Compliance (20%): Navigating global compliance regulations and executing effective security and compliance auditing.

Infrastructure and Data Protection (25%): Designing infrastructure security and implementing advanced data protection and encryption techniques.

B. Use AWS KMS with AWS managed keys.

C. Use AWS KMS with customer managed keys (CMKs) and enable automatic rotation.

D. Use client-side encryption with a local hard drive key.

E. Use S3 Bucket Policies to block unencrypted uploads only.

F. Disable versioning on the bucket to simplify key management.

Correct Answer: C

Explanation:

A (Incorrect): SSE-S3 uses keys managed entirely by Amazon, which does not give the customer control over rotation schedules.

B (Incorrect): AWS managed keys are rotated by AWS every three years, not annually, and cannot be manually triggered by the user.

D (Incorrect): While secure, managing keys on a local hard drive is not a scalable AWS-native solution for enterprise governance.

E (Incorrect): This enforces encryption but does not address the specific requirement for key rotation management.

F (Incorrect): Versioning is a data protection feature and has no impact on encryption key rotation requirements.

Question 2: During a security and compliance audit, a developer discovers that several IAM users have not changed their passwords in over 180 days. Which AWS service should I use to generate a list of all users and their credential status?

B. IAM Credential Report.

C. Amazon Inspector.

D. AWS Config.

E. AWS CloudTrail.

F. Amazon GuardDuty.

Correct Answer: B

Explanation:

A (Incorrect): Trusted Advisor provides high-level checks but does not provide the granular, downloadable list of all user credential ages.

C (Incorrect): Amazon Inspector is used for automated security assessments of applications, not for auditing IAM user metadata.

D (Incorrect): AWS Config tracks resource changes but the Credential Report is the specific tool designed for this auditing task.

E (Incorrect): CloudTrail logs API calls; while it shows when a password was last used, it doesn't provide a consolidated credential status report.

F (Incorrect): GuardDuty is a threat detection service, not an auditing tool for password policy compliance.

Question 3: According to the AWS Shared Responsibility Model, which of the following is the sole responsibility of the customer when managing infrastructure security and compliance?

B. Patching the underlying hypervisor.

C. Configuration of the guest operating system and firewall (Security Groups).

D. Disposal of physical storage disks.

E. Edge location maintenance.

F. Managing the hardware lifecycle of host servers.

Correct Answer: C

Explanation:

A (Incorrect): This is the responsibility of AWS (security "of" the cloud).

B (Incorrect): AWS manages the hypervisor layer in non-bare-metal instances.

D (Incorrect): AWS handles the physical destruction of storage media according to NIST standards.

E (Incorrect): AWS maintains all global infrastructure, including edge locations.

F (Incorrect): Hardware management is strictly an AWS responsibility.

This is a huge original question bank consisting of 1,500 high-quality questions.

You get support from instructors if you have questions or need clarification on complex GRC topics.

Each question has a detailed explanation to ensure you understand the core concepts.

Mobile-compatible with the Udemy app, allowing you to study on the go.

30-days money-back guarantee if you're not satisfied with the course content.