CAP Information Systems & Data Protection 4

Question 1

A federal system processes both FOUO (For Official Use Only) and publicly releasable information. What is the most appropriate data handling control?

Accepted Answer

Separate the data with access controls and label all FOUO information appropriately

Answer

Mixed-sensitivity systems must segregate data, apply appropriate labels, and enforce access controls so that FOUO data is only accessible to authorized users.

Question 2

What does the concept of 'least functionality' require for federal information systems?

Accepted Answer

Configuring systems to provide only essential capabilities and disabling unused services, ports, and functions

Answer

Least functionality (NIST SP 800-53 CM-7) requires disabling all unused services, ports, protocols, and functions to reduce the attack surface.

Question 3

Which RMF step involves selecting security controls based on system categorization?

Accepted Answer

Step 2: Select

Answer

RMF Step 2 (Select) involves choosing the appropriate security controls from NIST SP 800-53 based on the system's FIPS 199 categorization.

Question 4

An assessor discovers a control is 'not applicable' for a cloud-hosted system. What is the appropriate next step?

Accepted Answer

Document the rationale for non-applicability and obtain approval through the tailoring process

Answer

Tailoring allows removal of controls that are not applicable, but the rationale must be documented in the SSP and approved by the AO.

Question 5

Which data protection control prevents a malicious insider from exfiltrating sensitive data via email or removable media?

Accepted Answer

Data Loss Prevention (DLP) tools and media access controls

Answer

DLP tools inspect content leaving the organization via email, web, or removable media, and media access controls restrict USB and other removable storage usage.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Information Systems & Data Protection 4