CAP Security Categorization 2

Question 1

What is the security categorization format specified in FIPS 199?

Accepted Answer

SC = {(confidentiality, impact), (integrity, impact), (availability, impact)}

Answer

FIPS 199 specifies the format as SC information type = {(confidentiality, impact level), (integrity, impact level), (availability, impact level)}.

Question 2

What triggers the need to recategorize a federal information system?

Accepted Answer

Significant changes to the information processed, mission requirements, or operating environment

Answer

Recategorization is needed when the types of information processed, mission requirements, or operational context change significantly enough to alter the system's risk profile.

Question 3

Which role is primarily responsible for completing the security categorization of an information system?

Accepted Answer

System Owner, in coordination with the ISSO and data owners

Answer

The System Owner leads the categorization process in collaboration with the ISSO and information owners to ensure all data types are properly accounted for.

Question 4

What does a High categorization for Availability mean for a federal system?

Accepted Answer

Loss of availability would have a severe or catastrophic adverse effect on operations, assets, or individuals

Answer

A High Availability impact means system downtime could cause severe harm to the organization's mission, finances, or national security.

Question 5

Which mission-based information type from NIST SP 800-60 typically receives a High Confidentiality categorization?

Accepted Answer

Intelligence data and law enforcement sensitive information

Answer

Information types like intelligence and law enforcement sensitive data typically warrant High confidentiality due to the severe harm from unauthorized disclosure.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Security Categorization 2