Practice governance, risk and compliance decisions with 120 original questions from Cloudpuz Academy. This written course contains two different 60-question tests organized around the seven CGRC domains in the official outline effective June 15, 2024, reviewed in November 2026. Scenarios emphasize responsibilities, evidence, risk context and the difference between a documented intention and an operating control.

Each test contains ten Governance questions, six Scope questions, eight Framework and Control Selection questions, ten Implementation questions, ten Assessment questions, eight System Compliance questions and eight Compliance Maintenance questions. These integer counts approximate the published domain weights. They are focused study sets, not replicas of the official 125-item exam.

Governance practice connects security and privacy work to business objectives, decision authority, risk tolerance, supplier responsibilities and the information lifecycle. Evaluate uncertainty, correlated risks, meaningful metrics and the limits of compliance claims. Distinguish authorized risk decisions from informal approval or unsupported assumptions.

Scoping scenarios explore system purpose, boundaries, information types, data flows and external dependencies. Identify incomplete inventories, hidden exports and changes that affect the risk context. Where a question uses a specific framework such as FIPS 199, the scenario states that context so the expected decision follows the identified method.

Control-selection questions cover baselines, tailoring, inherited and hybrid controls, organization-defined parameters, overlays, compensating controls and traceability. Implementation scenarios examine ownership, resources, configuration records, evidence retention, training and shared responsibilities. Understand why planned, partly deployed and effectively operating controls are different states.

Assessment practice focuses on planning, independence, examination, interviews, testing, sampling and the relevance of evidence to a requirement. Review findings, validate corrective actions and recognize assessment limitations. Avoid confusing a vulnerability scan, a supplier report or a policy statement with proof that every control objective has been achieved.

System Compliance questions address decision packages, residual risk, authorization conditions, accurate status and communication. Maintenance scenarios cover change impact, monitoring strategy, stale evidence, shared-control failures, incident lessons and overdue remediation. The central question is what evidence and authority are needed for the decision described.

Every item has four options, one best answer, explanations for every option and a reference for further reading. Allow 90 minutes per test. The 70 percent practice threshold is a course learning target; it is not a conversion of the official scaled passing grade. Review the reasoning behind uncertain answers before attempting the second set.

This course contains written practice tests without video lessons or a hosted lab. Familiarity with information security, organizational risk and control terminology is recommended. References emphasize public NIST guidance and the official CGRC outline. The course is supplementary practice and does not claim exhaustive coverage of every framework, law or jurisdiction-specific obligation.

Cloudpuz Academy is independent and is not affiliated with or endorsed by ISC2. These are original study scenarios, not real examination questions or exam dumps. Completion does not guarantee certification or professional compliance. Consult current official examination requirements and authoritative guidance for the context in which you work.