CAP Security Categorization

Question 1

Which FIPS publication establishes the standards for categorizing federal information and information systems?

Accepted Answer

FIPS 199

Answer

FIPS 199 defines the standards for security categorization of federal information and information systems.

Question 2

What are the three potential impact levels defined by FIPS 199?

Accepted Answer

Low, Moderate, High

Answer

FIPS 199 defines Low, Moderate, and High as the three potential impact levels for each security objective.

Question 3

What NIST publication provides detailed guidance on mapping information types to security categories?

Accepted Answer

NIST SP 800-60

Answer

NIST SP 800-60 provides a guide for mapping types of information and information systems to security categories.

Question 4

How is the overall security category of an information system determined when multiple information types are present?

Accepted Answer

By using the high-water mark — the highest impact value across all information types and objectives

Answer

The high-water mark principle means the system's overall category is set to the highest impact level found among all information types for each security objective.

Question 5

A system is categorized as SC = {Confidentiality: High, Integrity: Moderate, Availability: Low}. What is the overall system impact level?

Accepted Answer

High

Answer

The overall system impact level is determined by the highest value across all three security objectives, which is High in this case.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Security Categorization