CAP Security Authorization Documentation 3

Question 1

What is a 'significant change' that would require reauthorization of a federal information system?

Accepted Answer

A major upgrade to system architecture, operating environment, or security posture that increases risk

Answer

Routine software patching and updates

Answer

Adding a new user account

Answer

Changing the system administrator's name

Question 2

What is the role of the Information System Security Officer (ISSO) in documentation management?

Accepted Answer

To develop, maintain, and update security documentation including the SSP and POA&M

Answer

To approve the final ATO decision

Answer

To conduct the independent security assessment

Answer

To define the organizational risk appetite

Question 3

Which artifact documents interconnections between an information system and external systems?

Accepted Answer

Interconnection Security Agreement (ISA) / Memorandum of Understanding (MOU)

Answer

System Security Plan body only

Answer

Authorization Decision Document

Answer

POA&M

Question 4

What is the maximum ATO period allowed for most federal information systems under NIST guidance?

Accepted Answer

Three years

Answer

One year

Answer

Five years

Answer

Indefinite with continuous monitoring

Question 5

What must the POA&M include for each identified security weakness?

Accepted Answer

Description of the weakness, responsible party, scheduled completion date, and resources needed

Answer

Only the vulnerability CVE number

Answer

The name of the penetration tester who found it

Answer

A sign-off from the system owner

Question 6

What is the purpose of a System of Records Notice (SORN) in the federal authorization context?

Accepted Answer

To notify the public about a federal system that collects and maintains PII under the Privacy Act

Answer

To announce a new information system deployment to agency staff

Answer

To document the system's network topology for the ATO package

Answer

To list authorized users of a classified system