CAP Risk Management Framework 2

Question 1

Which FIPS standard defines the three security objectives: confidentiality, integrity, and availability?

Accepted Answer

FIPS 199

Answer

FIPS 200

Answer

FIPS 140-2

Answer

FIPS 201

Question 2

What is the purpose of the 'Prepare' step added to RMF in NIST SP 800-37 Revision 2?

Accepted Answer

To establish organizational risk management roles and strategy before system-level activities

Answer

To select baseline security controls

Answer

To implement controls across the enterprise

Answer

To authorize the information system

Question 3

Who is responsible for accepting residual risk and granting an Authorization to Operate (ATO)?

Accepted Answer

Authorizing Official (AO)

Answer

System Owner

Answer

ISSO

Answer

Security Control Assessor

Question 4

Which RMF step ensures that security controls are correctly installed and operating as intended?

Accepted Answer

Implement

Answer

Select

Answer

Authorize

Answer

Monitor

Question 5

What is a 'common control' in the context of the RMF?

Accepted Answer

A security control inherited by multiple systems from a shared provider

Answer

A control applied only to classified systems

Answer

A baseline control mandatory for all systems

Answer

A control assessed by an external auditor

Question 6

Which document within the RMF authorization package identifies weaknesses and plans to remediate them?

Accepted Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Answer

Authorization Decision Document