CAP Security Controls and Authorization 2 — Questions and Answers
Question 1: Which NIST SP 800-53 control family covers configuration management?
- CM (Correct answer)
- CA
- CP
- AC
Correct answer: CM
The CM (Configuration Management) family includes controls for baseline configurations, change control, and software usage restrictions.
Question 2: What is the purpose of an Interconnection Security Agreement (ISA)?
- To grant an ATO to a new system
- To document the security requirements for a connection between two systems (Correct answer)
- To authorize user access to classified data
- To define incident response procedures
Correct answer: To document the security requirements for a connection between two systems
An ISA establishes the security interface requirements and responsibilities when two systems are interconnected.
Question 3: Which document formally describes the security controls applied to a system and how they are implemented?
- Plan of Action and Milestones
- Security Assessment Report
- System Security Plan (Correct answer)
- Memorandum of Understanding
Correct answer: System Security Plan
The System Security Plan (SSP) comprehensively describes all security controls and their implementation details for the information system.
Question 4: Which control overlay in NIST SP 800-53 provides additional guidance for classified national security systems?
- Privacy overlay
- Intelligence overlay
- CNSS Instruction 1253 overlay (Correct answer)
- FedRAMP overlay
Correct answer: CNSS Instruction 1253 overlay
CNSSI 1253 provides the security categorization and control selection guidance for national security systems.
Question 5: What distinguishes a system-specific control from a hybrid control in NIST SP 800-53?
- System-specific controls are implemented only for the local system; hybrid controls are shared and locally customized (Correct answer)
- System-specific controls are mandatory; hybrid controls are optional
- Hybrid controls require AO approval; system-specific controls do not
- System-specific controls apply only to cloud systems
Correct answer: System-specific controls are implemented only for the local system; hybrid controls are shared and locally customized
Hybrid controls have portions implemented by a common control provider and portions implemented locally by the system owner.
Question 6: Under FedRAMP, what authorization path allows agencies to reuse an existing cloud ATO?
- Agency ATO
- Joint Authorization Board (JAB) Provisional ATO (Correct answer)
- Reciprocity Agreement
- Security Impact Analysis
Correct answer: Joint Authorization Board (JAB) Provisional ATO
A JAB Provisional ATO (P-ATO) issued by FedRAMP's Joint Authorization Board can be leveraged by multiple agencies through reciprocity.
CAP Security Controls and Authorization 2
Which NIST SP 800-53 control family covers configuration management?