CGRC Practice Test
Prepare for the Certified in Governance, Risk and Compliance exam with free practice tests modeled after the real CGRC format. Each test has 20 questions with a proportional timer matching the actual exam pace of approximately 1.4 minutes per question.
Mixed Set — CGRC Practice Tests
Questions distributed across all 7 domains according to the official ISC2 exam blueprint effective June 2024. Higher-weighted domains like Implementation of Security and Privacy Controls appear more frequently — just like the real exam.
Domain Wise — CGRC Mock Tests
Target individual CGRC domains with focused practice. Each mock test covers 20 questions from a single domain to help you master the Risk Management Framework lifecycle and governance principles tested across all seven areas of the CBK.
About the CGRC Certification Exam
Everything you need to know about the CGRC exam format, eligibility requirements, and what makes this credential the leading choice for governance, risk, and compliance professionals worldwide.
What Is the CGRC?
The Certified in Governance, Risk and Compliance (CGRC) is an advanced cybersecurity certification offered by ISC2. Formerly known as the Certified Authorization Professional (CAP), it was rebranded in February 2023 to reflect its expanded global scope beyond U.S. federal RMF-focused roles. The CGRC validates a professional's ability to integrate governance, risk management, and regulatory compliance within an organization — aligning IT security objectives with broader business goals and enabling stakeholders to make informed decisions about data security and privacy risks.
The CGRC is recognized under U.S. DoDM 8140.03, making it a sought-after credential for federal government and Department of Defense professionals. It is also valued across commercial sectors, regulated industries, and international organizations. CGRC-certified professionals typically hold roles such as Information System Security Officer (ISSO), Information System Security Manager (ISSM), Authorizing Official Designated Representative (AODR), Compliance Manager, Risk Analyst, and GRC Analyst, with salaries commonly ranging from $95,000 to $150,000+ in the United States.
Exam Format (2026)
Testing method: Computer-based testing at authorized Pearson VUE testing centers worldwide or via remote proctoring.
Questions: 125 multiple-choice questions.
Duration: 3 hours (approximately 1.4 minutes per question).
Question types: Scenario-based multiple-choice; select the single best answer from four options.
Passing score: 700 on a scaled score of 1,000 points.
Exam fee: $599 USD via Pearson VUE (ISC2 member discounts may apply).
Eligibility Requirements
Experience: Minimum of 2 years of cumulative paid work experience in one or more of the seven CGRC CBK domains.
Associate path: Candidates without the required experience may pass the exam first and earn the Associate of ISC2 designation, then accumulate the 2 years of experience within 3 years.
Endorsement: A current ISC2-certified professional must endorse your application within 9 months of passing the exam.
Ethics: All candidates must subscribe to the ISC2 Code of Professional Ethics.
Renewal: Earn 60 CPE credits every 3 years (minimum 20 per year) plus annual maintenance fees.
CGRC Domain Weights — June 2024 Exam Outline
The CGRC exam is built around seven domains aligned to the Risk Management Framework lifecycle. Domain weights below reflect the updated ISC2 exam outline effective June 15, 2024.
| Domain | Topic | Weight |
|---|---|---|
| Domain 1 | Security and Privacy Governance, Risk Management, and Compliance Program | 16% |
| Domain 2 | Scope of the System | 10% |
| Domain 3 | Selection and Approval of Framework, Security, and Privacy Controls | 14% |
| Domain 4 | Implementation of Security and Privacy Controls | 17% |
| Domain 5 | Assessment/Audit of Security and Privacy Controls | 16% |
| Domain 6 | System Compliance | 14% |
| Domain 7 | Compliance Maintenance | 13% |
How Our Practice Tests Are Designed
RMF-aligned question style — Every question is written to reflect the scenario-based format ISC2 uses on the real CGRC exam. You encounter situations drawn from the full Risk Management Framework lifecycle — from initial program setup through system categorization, control selection, implementation, assessment, authorization, and ongoing compliance maintenance.
Blueprint-aligned mixed sets — Mixed practice tests distribute questions proportionally across all 7 domains per the official ISC2 exam outline effective June 2024. Domain 4 (Implementation) at 17% and Domains 1 and 5 at 16% each appear most frequently, reflecting their higher weight on the real exam.
Proportional timer — The real CGRC exam allows 3 hours for 125 questions, approximately 1.4 minutes per question. Each 20-question practice test is timed at about 29 minutes to match this pace and build the time discipline you need before exam day.
Domain-specific deep dives — Use domain-wise tests to concentrate on areas where your preparation needs the most work. This is especially effective for mastering the high-weight domains — Implementation (17%), Governance/Risk/Compliance Program (16%), and Assessment/Audit (16%) — that together account for nearly half the exam.
CGRC Exam Preparation Tips
Study Strategy
Master the RMF lifecycle end-to-end: The CGRC is fundamentally a test of the NIST Risk Management Framework. Study each RMF step in sequence — Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor — and understand the key NIST publications (SP 800-37, SP 800-53, SP 800-53A, SP 800-115) associated with each step.
Prioritize Domains 1, 4, and 5: These three domains collectively represent 49% of the exam. Allocate significant study time to understanding GRC program principles, control implementation evidence, and assessment methodologies before moving into the lower-weight domains.
Learn the roles and artifacts: CGRC questions frequently test your knowledge of who does what and which documents are produced at each RMF step — SSPs, SARs, POA&Ms, and ATOs. Knowing these artifacts and the roles responsible for them (ISSO, ISSM, AO, AODR) is critical.
Test-Taking Strategy
Flag and revisit: The CGRC exam format allows you to flag uncertain questions and return to them before submitting. Commit to your best answer, flag items where you are unsure, and revisit them after completing the remaining questions with fresh perspective.
Pace yourself to 1.4 minutes per question: With 125 questions over 3 hours, you have roughly 84 seconds per item on average. Use our 29-minute timed practice sessions to internalize this rhythm so you are not caught off guard by the clock on exam day.
Think in terms of "best practice," not just "correct": CGRC scenarios often present multiple plausible answers. Choose the response that best aligns with RMF step sequence, proper roles and responsibilities, and documented NIST guidance — not simply the technically accurate one.
Frequently Asked Questions
Ready to Test Your CGRC Knowledge?
Start with a mixed set to assess your readiness across all seven domains, then use domain-wise tests to sharpen the specific areas where you need the most practice.
Start CGRC Practice Test 1 →
