CAP Risk Management Framework 3

Question 1

What does FISMA stand for and what does it mandate?

Accepted Answer

Federal Information Security Modernization Act; mandates federal agencies implement RMF-based security programs

Answer

Federal Information Systems Management Act; mandates annual security audits

Answer

Federal Information Security Management Act; mandates encryption of all federal data

Answer

Federal IT Security Modernization Act; mandates cloud-first adoption

Question 2

What NIST publication provides guidance on organizational risk management as the overarching context for the RMF?

Accepted Answer

NIST SP 800-39

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-30

Question 3

In the RMF three-tier hierarchy, which tier addresses mission and business process risk?

Accepted Answer

Tier 2

Answer

Tier 1

Answer

Tier 3

Answer

Tier 4

Question 4

Which term describes the maximum acceptable downtime for a system as defined in a Business Impact Analysis?

Accepted Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Mean Time to Repair (MTTR)

Question 5

What is the primary goal of tailoring baseline security controls in the RMF?

Accepted Answer

To adjust controls to the specific conditions, threat environment, and risk tolerance of the system

Answer

To reduce the number of controls to the minimum possible

Answer

To replace government controls with industry standards

Answer

To align controls with vendor recommendations

Question 6

Which federal law requires Authorizing Officials to be senior agency officials with budget authority?

Accepted Answer

FISMA

Answer

HIPAA

Answer

FERPA

Answer

Privacy Act