Certified in Governance, Risk and Compliance (CGRC) Practice Tests

Validates knowledge of authorizing and maintaining secure systems, including scoping, control selection, implementation, assessment and ongoing compliance.

CGRC is 125 items in 3 hours, multiple choice plus ISC2's advanced item types. The questions are scenario-based best-answer items built around the NIST Risk Management Framework, especially who is responsible for each task. We compared the main options on question style, domain coverage and price.

Start with ISC2's free quiz and flashcards, then use Pocket Prep to find weak domains. Few dedicated CGRC question banks exist, so the official course questions and the NIST publications carry much of the practice.

Quick readiness check

CGRC Knowledge Check

ISC2's own short quiz for a first look at the question style and your starting level. One passer who tried it scored 4 or 5 out of 10 because many questions drew on NIST references.

Great fit if you want a free official taste of the questions before paying for anything.

Poor fit if you need volume or timed practice; use Pocket Prep.

Free official flashcards

Official CGRC Flash Cards

ISC2's interactive flashcards across the seven CGRC domains, with immediate feedback. They drill terms and concepts rather than exam-style scenarios.

Great fit if you want a free official check on RMF and compliance terminology before buying questions.

Poor fit if you need scenario questions or timed practice; use Pocket Prep.

Weak-domain quizzes

ISC2 CGRC Question Bank

Domain quizzes, timed 5- and 10-minute quizzes, a weakest-subject quiz and explanations on every question, in a mobile and web app. It is built for short sessions rather than full-length mock exams.

Great fit if you want explained questions by domain to find weak spots in short sessions.

Poor fit if you want full 125-question timed runs; this app is built for short quizzes.

What to look for in a CGRC practice test

Match the June 2024 outline. The outline in effect since June 15, 2024 has seven domains weighted 16%, 10%, 14%, 17%, 16%, 14% and 13%. Older CAP-era guides and question sets follow the previous outline, and a passer who studied before the update said such material no longer lines up.
Look for RMF roles and tasks. Passers say many questions ask who is primarily responsible for an RMF task under NIST SP 800-37, and some use ISO wording such as 'interested party'. Prefer questions that explain the role and the task, not only the answer.
Expect few full-length banks. ISC2 sells no separate CGRC practice exam, and candidates describe many cheap third-party sets as amateur, with outdated NIST content. Judge any bank by whether its explanations match SP 800-37 Rev. 2.
Know the format. CGRC is 125 questions in three hours at a fixed length, not adaptive, with multiple choice and ISC2's advanced item types such as drag and drop. Passers report finishing in about 70 minutes to 2 hours 15 minutes.
Skip sites selling "real exam questions." Sites promising actual CGRC questions or a guaranteed pass are selling leaked or copied items. ISC2's exam agreement bans accessing exam content before the exam and lets ISC2 cancel your score, revoke every certification you hold and bar you from earning more. A real practice test explains why each answer is right; a dump only lists answers.

How to use CGRC practice tests

Take a diagnostic first. Try ISC2's 10-question quiz and a few Pocket Prep quizzes cold to see which domains are thin, then match the result against your own RMF and audit experience.
Learn RMF roles in both directions. Drill each task, its outcome and the role responsible, then go from each role back to its tasks. Candidates call this the most useful single drill for the exam.
Use the official course questions too. ISC2's e-textbook and sample-question book are the closest to ISC2's own wording, and their questions can cite RMF task codes such as M-2. Pair them with a question bank for volume.
Explain every option. For each question, say why the best answer fits and why the others fail, including questions you got right. Several options usually look plausible, so the reasoning matters more than the score.
Sit a full run late. In the last weeks, build a 125-question set in Pocket Prep and answer it in one three-hour sitting, then review each miss by domain. Treat the score as a guide, not a prediction.

ISC2: CGRC exam outline ↗ISC2: before your exam ↗Reddit: CGRC exam experience ↗Reddit: passed CGRC after 2nd attempt ↗Reddit: CGRC study and exam experience ↗

CGRC practice test FAQ

Are there free CGRC practice tests?

Yes. ISC2 offers a free 10-question CGRC quiz and free flashcards for all seven domains after a short sign-up form. Pocket Prep also gives 30 questions free.

Are CGRC practice questions harder than the real exam?

Candidates say the real exam is more ambiguous than study questions: some answers use the wrong terminology and several options look right. A practice score is a guide to what to review, not a prediction.

How many CGRC practice tests should I take?

ISC2 gives no number. Passers combine the official course questions with one bank and the NIST publications, and some passed after using only the questions in the official course.

Is the CGRC exam adaptive?

No. Everyone answers 125 questions in up to three hours, so a fixed 125-question practice run matches the format.