CAP CAP Security Documentation & Authorization Artifacts 4

Question 1

Which document in the RMF authorization package formally describes the boundary of the information system being assessed?

Accepted Answer

System Security Plan (SSP)

Answer

The SSP defines the authorization boundary, system description, and security controls implemented for the information system.

Question 2

When an inherited control does not fully satisfy a system's security requirements, what artifact documents the system-specific additions needed?

Accepted Answer

Control implementation statement supplement

Answer

A control implementation statement supplement documents how the inheriting system fills gaps left by a partially inherited common control.

Question 3

Which NIST document provides the standardized format and content requirements for Security Assessment Reports?

Accepted Answer

NIST SP 800-53A

Answer

NIST SP 800-53A provides assessment procedures and guidance on documenting findings in the Security Assessment Report.

Question 4

An organization discovers a critical vulnerability after the ATO is issued. Which authorization artifact must be IMMEDIATELY updated?

Accepted Answer

Plan of Action and Milestones (POA&M)

Answer

The POA&M must be updated immediately to document the newly discovered vulnerability, its risk level, and planned remediation timeline.

Question 5

What is the primary purpose of the Authorization Decision Document signed by the Authorizing Official?

Accepted Answer

Formally accept residual risk and grant or deny system operation

Answer

The Authorization Decision Document (ADD) is the AO's formal statement accepting residual risk and granting, denying, or conditionally granting ATO.

(CAP) Certified Authorization Professional Practice Test