Free practice sample
Fifteen original CGRC practice questions, unlocked with no signup and instant scoring. The sample draws proportionally across all seven domains of the exam outline refreshed on June 15, 2024 — so the mix reflects the shape of the real exam rather than a single topic slice.
CGRC is the credential for people who get systems authorized: categorization, control selection, implementation, assessment, and the formal risk-acceptance decision, then keeping the system compliant for the rest of its life. The questions are written to that arc, and every explanation names the winning answer and the near-miss it beats — because on this exam the difference between a compensating control and a tailored one, or between residual risk and accepted risk, is usually the whole question.
Frequently asked questions about CGRC
How many questions are on the actual CGRC exam?
125 items in a three-hour window at Pearson VUE, mixing multiple choice with advanced item types. Confirm current logistics at isc2.org when you book, since ISC2 sets the format and may change it.
What score do I need to pass CGRC?
700 out of 1000 on ISC2’s scaled scoring. That is not a raw 70%, because harder items carry more scaled weight. The Certifym practice pass mark is set at 70% as an honest raw-score equivalent, and because every set is weighted to the official outline, clearing it means genuine coverage across all seven domains rather than luck in the heavy ones.
What changed in the June 2024 refresh?
ISC2 embedded AI governance throughout the outline. Alongside the classic RMF material — FIPS 199 categorization, NIST SP 800-53 baselines and tailoring, assessment methods, authorization packages, continuous monitoring — the current exam expects you to reason about the NIST AI RMF, ISO/IEC 42001, the EU AI Act, the boundary between model training and inference, and treating ML weight updates as formal system changes. Study materials that predate the refresh will not cover any of that.
Is CGRC the same as CAP?
Yes — CGRC is the renamed CAP (Certified Authorization Professional). The rename came with a broadened scope beyond U.S. federal RMF work, but the core competency is unchanged: carrying a system through to an authorization decision and keeping it compliant afterwards. Older study material sold as CAP prep predates both the rename and the 2024 AI refresh.
Do I need two years of experience to sit the exam?
No. You can sit without it and become an Associate of ISC2, then have six years to earn the two years of paid work experience in one or more domains. Many candidates take that route, particularly those moving into federal or FedRAMP work from an adjacent role.
Which domains carry the most weight?
Domain 4 (Implementation) at 17% is the heaviest, with Domains 1 and 5 close behind at 16% each. Domain 2 (Scope of the System) is the lightest at 10% — but it is disproportionately worth studying anyway, because drawing the authorization boundary wrong is the error that quietly invalidates answers in every other domain.
How is this free sample different from the full Certifym bank?
The sample is a fixed 15-question set spread across the seven domains at outline proportions. The full Certifym bank is 1,250 original CGRC questions across ten industry-vertical sets, each full-length attempt running 125 questions on a three-hour timer at official domain weights. None of the paid-bank items appear in this sample.
Is Certifym affiliated with ISC2?
No. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISC2, Inc. All questions and explanations on this site are original content produced by Certifym and are not sourced from actual ISC2 exam questions.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISC2, Inc. ISC2®, CGRC®, CISSP®, and CBK® are registered marks of ISC2, Inc., used here only to identify the certification these study materials are intended for. The CGRC exam outline and its domain structure are the property of ISC2, Inc.; download the current outline directly from isc2.org.
All practice questions, answers, and explanations on this page are original content produced by Certifym Exam Services, LLC. They are not actual ISC2 examination questions and are not represented as such. Exam format, domain weights, and eligibility criteria are set by ISC2 and may change; verify current details at isc2.org before scheduling.