CAP Information Systems & Data Protection 2

Question 1

Which NIST publication provides guidelines for categorizing federal information and information systems based on potential impact?

Accepted Answer

FIPS 199

Answer

FIPS 199 establishes security categories for federal information and information systems using potential impact levels of low, moderate, and high.

Question 2

A database containing Social Security Numbers, medical records, and financial data is being categorized. Which security objective drives the overall system categorization to HIGH?

Accepted Answer

The highest impact level across all security objectives

Answer

Per FIPS 199, the overall information system security category is determined by the high-water mark — the highest impact level across all security objectives (confidentiality, integrity, availability).

Question 3

Under FISMA, which role is responsible for ensuring that information systems under their authority are covered by an approved authorization?

Accepted Answer

Authorizing Official (AO)

Answer

The Authorizing Official is the senior federal official who bears ultimate accountability for accepting risk and ensuring systems have an approved ATO.

Question 4

What is the primary purpose of a System Security Plan (SSP) in the RMF process?

Accepted Answer

To document the system boundary, environment, and implemented security controls

Answer

The SSP describes the system boundary, operating environment, security requirements, and the controls implemented to meet those requirements.

Question 5

Which type of data handling practice violates the principle of data minimization?

Accepted Answer

Collecting more PII than is strictly necessary for the stated purpose

Answer

Data minimization requires collecting only the minimum amount of personal information necessary to fulfill a specific, legitimate purpose.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Information Systems & Data Protection 2