ISC2 CGRC Full-Length Practice Test
125 questions in 180 minutes. Ten separate sets aligned to the current ISC2 CGRC exam outline effective 15 June 2024, with all seven domains held to the published 16 / 10 / 14 / 17 / 16 / 14 / 13 weighting.
- 125 questions
- 180 minutes
- 700 / 1000 pass standard
- 7 official domains
- 13 Select TWO per test
Choose how many full-length tests you want
Every option uses the same 125-question, 180-minute format. The 10-test pack gives you 1,250 questions across ten separate sets, with the same blueprint and difficulty mix held across the series.
One test
125 questions · 180 minutes
One complete CGRC practice test
- 125 questions mapped to the seven-domain outline
- 112 single-answer and 13 Select TWO questions
- 25 easy, 55 medium and 45 hard items
- A written explanation is stored with every question
All 10 tests
1,250 questions
Works out at $1.40₹49.90£1.10€1.25 per test
- Ten complete 125-question practice tests
- The same blueprint allocation in every set
- 1,120 single-answer and 130 Select TWO questions across the pack
- Ten separate sets for repeated full-length practice
Five tests
625 questions
Five complete CGRC practice tests
- 625 questions across five separate sets
- Seven domains at the current published weights
- Mixed difficulty from easy through hard
- Use the remaining tests later if you want more full-length attempts
Current ISC2 CGRC exam format
ISC2's current CGRC outline took effect on 15 June 2024. It fixes the exam at 125 items over three hours and keeps the seven-domain structure used throughout these practice tests.
| Current outline | Effective 15 June 2024 |
| Items | 125 |
| Time limit | 3 hours |
| Passing grade | 700 out of 1000 |
| Item format | Multiple choice and advanced item types |
| Language | English |
| Testing | Pearson Testing Center |
| Experience | 2 years in one or more CGRC domains |
| Standard exam fee | $599 USD in the Americas and Asia Pacific |
Written to the current seven-domain outline
The practice bank is mapped to the ISC2 CGRC outline effective 15 June 2024. Domain 4, Implementation of Security and Privacy Controls, is the largest slice at 17%. Domain 2, Scope of the System, is the smallest at 10%. The other five sit between 13% and 16%.
The live CGRC exam can include advanced item types. These practice tests stay question-based: 112 single-answer items and 13 Select TWO items in each 125-question set. That keeps the focus on the judgement CGRC questions demand, from scoping and control selection through assessment, system compliance and ongoing maintenance.
ISC2 requires two years of cumulative work experience in one or more CGRC domains for the certification. Passing the exam without that experience can still qualify you for Associate of ISC2 status while you build the required experience.
Three hours changes how a question bank feels
A short set can tell you whether you remember a framework. A 125-question run also exposes pacing, concentration and the temptation to overthink a governance scenario after two hours at the screen.
How it's built
- 125 questions in every test
- 180-minute practice-test limit
- 112 single-answer plus 13 Select TWO questions
- 25 easy, 55 medium and 45 hard items
- All 23 mapped topics represented
Under the clock
- Three hours for 125 questions
- About 86 seconds per item if you split the time evenly
- Twenty Domain 1 questions in each set
- Twenty-one Domain 4 questions, the largest allocation
- Sixteen Domain 7 questions to finish the blueprint
What comes back
- Every bank item carries a written explanation
- Questions are mapped by domain and topic
- Scenarios cover decisions, not just vocabulary recall
- Select TWO items force you to evaluate more than one defensible control
- Separate full-length sets give you more than one 125-question run
A CGRC question turns on the decision you make
The hard part is recognising what the system owner, assessor or compliance team should do next when several options sound administratively convenient.
A security control reduces data-exfiltration risk but would require decrypting traffic that contains information subject to strict internal privacy restrictions. Which action should occur BEFORE the control is selected?
- AAbandon all exfiltration controls when encrypted traffic can never be inspected.
- BPermission for the inspection design should be assessed, and the control architecture should satisfy both exfiltration and privacy objectives.
- CSelect the control as preventing exfiltration automatically overrides privacy restrictions.
- DPrivacy restriction should be ignored until implementation when selection concerns only security.
Why B
Control selection has to account for conflicts created by the safeguard itself. The team needs a permitted design that addresses the exfiltration objective without violating the privacy requirement.
Why C can look reasonable
The control has a clear security benefit, so overriding the privacy restriction can sound decisive. CGRC questions test the opposite instinct: the safeguard must fit the full set of applicable requirements. One objective does not erase another.
Seven domains, fixed across every set
The practice-test allocation converts ISC2's published percentages into 125 questions without changing the total. That gives every set the same 20 / 13 / 18 / 21 / 20 / 17 / 16 domain pattern.
| Domain | ISC2 weight | Questions per test |
|---|---|---|
| 1. Security and Privacy Governance, Risk Management, and Compliance Program | 16% | 20 |
| 2. Scope of the System | 10% | 13 |
| 3. Selection and Approval of Framework, Security, and Privacy Controls | 14% | 18 |
| 4. Implementation of Security and Privacy Controls | 17% | 21 |
| 5. Assessment/Audit of Security and Privacy Controls | 16% | 20 |
| 6. System Compliance | 14% | 17 |
| 7. Compliance Maintenance | 13% | 16 |
All 10 ISC2 CGRC full-length practice tests
Each test is a separate 125-question set with the same three-hour format and the same seven-domain allocation.
About the CGRC exam and these practice tests
The ISC2 CGRC exam
How many questions are on the ISC2 CGRC exam?
The current CGRC exam has 125 items and a three-hour time limit. ISC2 lists the item format as multiple choice and advanced item types.
What score do you need to pass CGRC?
The passing grade is 700 out of 1000 points.
What are the seven CGRC domains?
The current outline covers Security and Privacy Governance, Risk Management, and Compliance Program; Scope of the System; Selection and Approval of Framework, Security, and Privacy Controls; Implementation of Security and Privacy Controls; Assessment/Audit of Security and Privacy Controls; System Compliance; and Compliance Maintenance.
How much does the CGRC exam cost?
ISC2 lists standard CGRC registration at $599 USD for the Americas and Asia Pacific. Regional pricing differs in the UK and EMEA.
How much experience do you need for CGRC?
ISC2 requires two years of cumulative work experience in one or more domains of the current CGRC outline. Candidates who pass without the required experience can become an Associate of ISC2 and have three years to earn the two years of relevant experience.
What is the ISC2 retake policy?
After the first attempt, you wait 30 test-free days before retesting. After the second attempt, the wait is 60 days. After the third and later attempts, it is 90 days. ISC2 allows up to four attempts for the same certification program within a 12-month period.
These practice tests
How long is each CGRC practice test?
Each test contains 125 questions and runs on a 180-minute format, matching the current exam's question count and time limit.
How closely do the tests follow the CGRC domain weights?
Every set uses the same 20 / 13 / 18 / 21 / 20 / 17 / 16 question allocation across Domains 1 through 7. That converts the official 16 / 10 / 14 / 17 / 16 / 14 / 13 percentages into exactly 125 questions.
Do the practice tests include multiple-answer questions?
Yes. Each set contains 112 single-answer questions and 13 Select TWO questions.
Do the questions include explanations?
Yes. Every item in the question bank includes a written explanation tied to the keyed answer.
Are all ten tests the same difficulty?
Each set uses the same difficulty blueprint: 25 easy, 55 medium and 45 hard questions. The questions themselves are different across the ten sets.
Which pack is the best value?
The 10-test pack is the best value pack. It contains 1,250 questions across ten separate full-length tests for $13.99₹499£10.99€12.49.
Ten CGRC practice tests. 1,250 questions.
$13.99₹499£10.99€12.49
Start with one test if you want a baseline. Use the 10-test pack when you need enough fresh papers to track whether the weak domain is actually moving.
