CAP Security Control Implementation

Question 1

What document serves as the primary guide for implementing security controls in an information system?

Accepted Answer

System Security Plan (SSP)

Answer

Privacy Impact Assessment (PIA)

Answer

Security Assessment Report (SAR)

Answer

Plan of Action and Milestones (POA&M)

Question 2

Which NIST publication provides the comprehensive catalog of security and privacy controls for federal information systems?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

NIST SP 800-60

Answer

FIPS 199

Question 3

What type of security control is implemented centrally by an organization and inherited by multiple information systems?

Accepted Answer

Common control

Answer

System-specific control

Answer

Hybrid control

Answer

Compensating control

Question 4

When a required security control cannot be implemented as specified in the baseline, what alternative mechanism may be used with appropriate documentation?

Accepted Answer

Compensating control

Answer

Residual risk acceptance

Answer

Control inheritance

Answer

Security overlay

Question 5

In the NIST Risk Management Framework, which step directly follows the selection of security controls?

Accepted Answer

Implement security controls

Answer

Assess security controls

Answer

Authorize the information system

Answer

Monitor security controls

Question 6

What term describes a security control where implementation is split between the information system owner and a common control provider?

Accepted Answer

Hybrid control

Answer

Residual control

Answer

Shared control

Answer

Overlay control

Question 7

Which process ensures that security controls remain correctly configured as a system evolves and changes are introduced?

Accepted Answer

Configuration management

Answer

Risk assessment

Answer

Incident response

Answer

Business impact analysis