CAP Risk Management Framework (RMF)

Question 1

What NIST publication provides the primary guidance for the Risk Management Framework (RMF)?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37 provides the guide for applying the Risk Management Framework to federal information systems.

Question 2

Which step of the RMF involves selecting the appropriate security controls for an information system?

Accepted Answer

Select

Answer

The Select step of the RMF involves choosing baseline security controls tailored to the system's categorization.

Question 3

In the RMF, which step involves determining the security category of the information system?

Accepted Answer

Categorize

Answer

The Categorize step assigns a security impact level to the system using FIPS 199 and NIST SP 800-60.

Question 4

What is the primary output of the RMF Assess step?

Accepted Answer

Security Assessment Report

Answer

The Security Assessment Report (SAR) documents the findings from evaluating the effectiveness of implemented security controls.

Question 5

Which federal law mandates the use of the RMF for federal information systems?

Accepted Answer

FISMA

Answer

The Federal Information Security Modernization Act (FISMA) requires federal agencies to implement risk management frameworks.

CAP - Certified Accreditation Professional Practice Test