CAP Risk Management Framework 3

Question 1

What does FISMA stand for and what does it mandate?

Accepted Answer

Federal Information Security Modernization Act; mandates federal agencies implement RMF-based security programs

Answer

FISMA requires federal agencies to develop, document, and implement information security programs aligned with the RMF.

Question 2

What NIST publication provides guidance on organizational risk management as the overarching context for the RMF?

Accepted Answer

NIST SP 800-39

Answer

NIST SP 800-39 addresses managing information security risk at the organization, mission/business, and information system tiers.

Question 3

In the RMF three-tier hierarchy, which tier addresses mission and business process risk?

Accepted Answer

Tier 2

Answer

Tier 2 (Mission/Business Process) addresses risk at the mission and business process level between organizational leadership and system owners.

Question 4

Which term describes the maximum acceptable downtime for a system as defined in a Business Impact Analysis?

Accepted Answer

Maximum Tolerable Downtime (MTD)

Answer

MTD is the longest period an organization can survive without a critical system before business operations are permanently impaired.

Question 5

What is the primary goal of tailoring baseline security controls in the RMF?

Accepted Answer

To adjust controls to the specific conditions, threat environment, and risk tolerance of the system

Answer

Tailoring allows organizations to customize baseline controls to fit their specific operational environment, threat landscape, and risk posture.

CAP - Certified Accreditation Professional Practice Test