CAP Risk Management Framework 2

Question 1

Which FIPS standard defines the three security objectives: confidentiality, integrity, and availability?

Accepted Answer

FIPS 199

Answer

FIPS 199 establishes the standards for categorizing federal information and information systems using C, I, and A.

Question 2

What is the purpose of the 'Prepare' step added to RMF in NIST SP 800-37 Revision 2?

Accepted Answer

To establish organizational risk management roles and strategy before system-level activities

Answer

The Prepare step establishes the organizational context and risk management strategy prior to executing system-level RMF tasks.

Question 3

Who is responsible for accepting residual risk and granting an Authorization to Operate (ATO)?

Accepted Answer

Authorizing Official (AO)

Answer

The Authorizing Official is the senior executive who formally accepts residual risk and grants the ATO.

Question 4

Which RMF step ensures that security controls are correctly installed and operating as intended?

Accepted Answer

Implement

Answer

The Implement step involves deploying security controls and documenting how they are configured and functioning.

Question 5

What is a 'common control' in the context of the RMF?

Accepted Answer

A security control inherited by multiple systems from a shared provider

Answer

Common controls are security controls whose implementation is managed at the organizational level and inherited by multiple information systems.

CAP - Certified Accreditation Professional Practice Test