CAP System Categorization & Impact Level Determination

Question 1

According to FIPS 199, which of the following correctly defines the 'HIGH' impact level for a security objective?

Accepted Answer

The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, assets, or individuals.

Answer

FIPS 199 defines HIGH impact as an expected severe or catastrophic effect, including loss of life, major financial loss, or inability to perform primary missions. LOW = limited effect; MODERATE = serious but not catastrophic.

Question 2

An information system processes both MODERATE-confidentiality data and HIGH-integrity data. According to the 'high-water mark' principle in FIPS 199, what is the overall system categorization?

Accepted Answer

HIGH, because the highest individual impact level determines the overall categorization.

Answer

FIPS 199 requires using the 'high-water mark' — the overall system categorization equals the highest impact rating across all security objectives (confidentiality, integrity, availability). One HIGH rating makes the whole system HIGH.

Question 3

Which NIST publication provides guidance for mapping information types to security impact levels during the categorization step of the RMF?

Accepted Answer

NIST SP 800-60

Answer

NIST SP 800-60 ('Guide for Mapping Types of Information and Information Systems to Security Categories') is the companion to FIPS 199 and provides the taxonomy of information types with recommended impact levels for each.

Question 4

During system categorization, a hospital's patient-monitoring system that, if unavailable, could result in patient death would most likely have which availability impact rating?

Accepted Answer

HIGH

Answer

A system whose unavailability could directly cause loss of human life meets the FIPS 199 definition of HIGH impact (severe or catastrophic adverse effect on individuals). There is no fourth 'CRITICAL' tier in FIPS 199.

Question 5

Who is ultimately responsible for signing the system categorization decision in a federal agency's RMF process?

Accepted Answer

The System Owner

Answer

NIST SP 800-37 assigns the System Owner the responsibility for categorizing the information system and documenting the result in the Security Plan. The AO reviews and approves authorization decisions, but categorization is the System Owner's formal responsibility.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP System Categorization & Impact Level Determination