CAP Information Systems & Data Protection 3 — Questions and Answers
Question 1: In the context of federal information systems, what does 'data in use' refer to?
- Data actively being processed in memory or by an application (Correct answer)
- Data stored on backup tapes in a secure vault
- Data transmitted over encrypted network channels
- Data archived in long-term cold storage
Correct answer: Data actively being processed in memory or by an application
Data in use refers to data actively being accessed, modified, or processed by an application or user, making it vulnerable to memory-based attacks.
Question 2: Which control baseline under NIST SP 800-53 is appropriate for a system categorized as MODERATE impact?
- Moderate baseline controls with tailoring as needed (Correct answer)
- Low baseline controls only
- High baseline controls without tailoring
- No baseline — all controls are selected ad hoc
Correct answer: Moderate baseline controls with tailoring as needed
NIST SP 800-53 provides low, moderate, and high baselines; MODERATE impact systems use the moderate baseline, which can be tailored to organizational needs.
Question 3: A penetration test reveals that a web application stores session tokens in plaintext cookies. Which security principle is most directly violated?
- Confidentiality of session data and least privilege for session management (Correct answer)
- System availability and redundancy
- Integrity of audit logs
- Non-repudiation of user transactions
Correct answer: Confidentiality of session data and least privilege for session management
Plaintext session tokens expose confidential authentication data and violate least privilege by allowing any interceptor to assume a user's session privileges.
Question 4: Under the Privacy Act of 1974, what is a 'system of records'?
- A group of records under agency control from which information is retrieved by personal identifier (Correct answer)
- Any database containing classified national security information
- A backup system that stores encrypted copies of production data
- An inventory of all IT assets maintained by a federal agency
Correct answer: A group of records under agency control from which information is retrieved by personal identifier
A Privacy Act system of records is a group of records under an agency's control from which information is retrieved by name, SSN, or other personal identifier.
Question 5: What is the key distinction between a Security Assessment Report (SAR) and a Plan of Action and Milestones (POA&M)?
- The SAR documents assessment findings while the POA&M tracks remediation of weaknesses (Correct answer)
- The SAR authorizes the system while the POA&M categorizes the system
- The SAR is created by the AO while the POA&M is created by the assessor
- The SAR applies to classified systems while the POA&M applies to unclassified systems
Correct answer: The SAR documents assessment findings while the POA&M tracks remediation of weaknesses
The SAR captures what the assessor found during testing; the POA&M is the system owner's plan for correcting identified weaknesses with scheduled milestones.
Question 6: Which data protection technique renders data unusable to unauthorized parties if storage media is stolen, but retains full utility for authorized users?
- Encryption at rest with proper key management (Correct answer)
- Data masking with static substitution
- Tokenization for all stored records
- Hashing with SHA-256
Correct answer: Encryption at rest with proper key management
Encryption at rest with proper key management ensures that stolen media yields only ciphertext, while authorized users with valid keys can access plaintext data normally.
Question 7: Which federal law mandates that agencies report major information security incidents to US-CERT within one hour of discovery?
- Federal Information Security Modernization Act (FISMA) (Correct answer)
- Privacy Act of 1974
- Computer Fraud and Abuse Act (CFAA)
- E-Government Act of 2002
Correct answer: Federal Information Security Modernization Act (FISMA)
FISMA requires federal agencies to report major incidents to US-CERT within one hour and includes ongoing incident management requirements.
CAP Information Systems & Data Protection 3
In the context of federal information systems, what does 'data in use' refer to?