CAP Security Categorization

Question 1

Which FIPS publication establishes the standards for categorizing federal information and information systems?

Accepted Answer

FIPS 199

Answer

FIPS 200

Answer

FIPS 140-2

Answer

FIPS 201

Question 2

What are the three potential impact levels defined by FIPS 199?

Accepted Answer

Low, Moderate, High

Answer

Level 1, Level 2, Level 3

Answer

Critical, Important, Minor

Answer

Green, Yellow, Red

Question 3

What NIST publication provides detailed guidance on mapping information types to security categories?

Accepted Answer

NIST SP 800-60

Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

NIST SP 800-39

Question 4

How is the overall security category of an information system determined when multiple information types are present?

Accepted Answer

By using the high-water mark — the highest impact value across all information types and objectives

Answer

By averaging the impact values of all information types

Answer

By using the lowest impact value to minimize security requirements

Answer

By a vote among the system owner, ISSO, and AO

Question 5

A system is categorized as SC = {Confidentiality: High, Integrity: Moderate, Availability: Low}. What is the overall system impact level?

Accepted Answer

High

Answer

Moderate

Answer

Low

Answer

Critical

Question 6

Which document should the system owner consult when determining information types for categorization?

Accepted Answer

NIST SP 800-60 Volume II

Answer

NIST SP 800-53 Appendix

Answer

FIPS 200

Answer

OMB Circular A-130