CAP Security Categorization 2

Question 1

What is the security categorization format specified in FIPS 199?

Accepted Answer

SC = {(confidentiality, impact), (integrity, impact), (availability, impact)}

Answer

Risk = Threat × Vulnerability × Impact

Answer

Category = (High/Moderate/Low)

Answer

SC = [C+I+A] / 3

Question 2

What triggers the need to recategorize a federal information system?

Accepted Answer

Significant changes to the information processed, mission requirements, or operating environment

Answer

Annual FISMA reporting deadlines only

Answer

A change in the system administrator

Answer

The expiration of the ATO

Question 3

Which role is primarily responsible for completing the security categorization of an information system?

Accepted Answer

System Owner, in coordination with the ISSO and data owners

Answer

Authorizing Official alone

Answer

Security Control Assessor independently

Answer

Chief Information Officer without input from owners

Question 4

What does a High categorization for Availability mean for a federal system?

Accepted Answer

Loss of availability would have a severe or catastrophic adverse effect on operations, assets, or individuals

Answer

The system is classified at the Top Secret level

Answer

The system requires 99.999% uptime by law

Answer

The system is accessible to all federal employees

Question 5

Which mission-based information type from NIST SP 800-60 typically receives a High Confidentiality categorization?

Accepted Answer

Intelligence data and law enforcement sensitive information

Answer

Public outreach and communications data

Answer

Facilities management information

Answer

Training and education records for public programs

Question 6

What FIPS standard defines the minimum security requirements based on the impact level determined by FIPS 199?

Accepted Answer

FIPS 200

Answer

FIPS 199

Answer

FIPS 140-2

Answer

FIPS 201