CAP Risk Management Framework (RMF) 3

Question 1

Which RMF step was added in NIST SP 800-37 Revision 2 to emphasize security early in the system lifecycle?

Accepted Answer

Prepare

Answer

Monitor

Answer

Assess

Answer

Select

Question 2

What is the meaning of 'residual risk' in the context of the RMF Authorize step?

Accepted Answer

Risk remaining after controls are applied

Answer

Risk eliminated by controls

Answer

Risk transferred to third parties

Answer

Risk identified during initial categorization

Question 3

Under RMF, who has final authority to accept the risk associated with operating an information system?

Accepted Answer

Authorizing Official

Answer

System Owner

Answer

Information System Security Officer

Answer

Chief Information Officer

Question 4

A Plan of Action and Milestones (POA&M) is used to track what?

Accepted Answer

Weaknesses and remediation plans for security controls

Answer

Approved system features

Answer

Employee training records

Answer

System backup schedules

Question 5

Which component of an authorization package summarizes the overall risk posture of a system?

Accepted Answer

Executive Summary / Risk Summary

Answer

System Security Plan

Answer

Security Assessment Report

Answer

Continuous Monitoring Plan

Question 6

What is the typical duration of an Authorization to Operate (ATO) before it requires renewal?

Accepted Answer

3 years

Answer

6 months

Answer

1 year

Answer

5 years