CAP CAP Security Documentation & Authorization Artifacts 5

Question 1

In a continuous monitoring program, how frequently must POA&M entries be reviewed at minimum according to NIST guidance?

Accepted Answer

Monthly

Answer

NIST SP 800-137 recommends monthly POA&M reviews as part of ongoing authorization and continuous monitoring activities.

Question 2

Which artifact specifically documents the agreement between a cloud service provider and a federal agency regarding shared security responsibilities?

Accepted Answer

Customer Responsibility Matrix (CRM)

Answer

The Customer Responsibility Matrix (also called Shared Responsibility Matrix) explicitly delineates which security controls are managed by the CSP versus the agency.

Question 3

A system owner wants to reuse security assessment results from a similar system assessed 14 months ago. What is the primary concern with this approach?

Accepted Answer

The previous SAR may be outside the acceptable reuse window, typically 12 months

Answer

NIST guidance generally limits reuse of assessment evidence to within 12 months, as older results may not reflect the current security posture.

Question 4

Which document would an ISSO reference to determine the specific assessment methods (examine, interview, test) required for each security control?

Accepted Answer

NIST SP 800-53A Revision 5

Answer

NIST SP 800-53A provides the assessment procedures, including whether each control requires examination of artifacts, interviews with personnel, or technical testing.

Question 5

What is the purpose of including a 'control origination' field in the SSP control implementation statements?

Accepted Answer

Indicate whether a control is system-specific, hybrid, inherited, or common

Answer

The control origination field clarifies accountability by showing whether a control is implemented locally, shared with a common control provider, or a hybrid arrangement.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP CAP Security Documentation & Authorization Artifacts 5