CAP Security Control Implementation 2

Question 1

What is the primary purpose of applying security engineering principles during security control implementation?

Accepted Answer

To integrate security into systems from the design phase

Answer

To reduce the total number of controls required

Answer

To eliminate the need for post-implementation assessments

Answer

To replace the System Security Plan with engineering diagrams

Question 2

When a system owner inherits a common control from an external provider, what responsibility does the system owner retain?

Accepted Answer

Verifying the inherited control adequately satisfies their system's security requirements

Answer

Reimplementing the control independently within their system

Answer

Conducting a separate formal assessment of the inherited control

Answer

Accepting all residual risk generated by the common control provider

Question 3

According to NIST SP 800-53, which control baseline applies to an information system with a FIPS 199 overall impact level of Moderate?

Accepted Answer

Moderate baseline

Answer

Low baseline

Answer

High baseline

Answer

Minimum security baseline

Question 4

What is the purpose of security control overlays in the implementation process?

Accepted Answer

To tailor baseline controls for specific technologies, environments, or communities of interest

Answer

To reduce the number of required security assessors

Answer

To replace the need for security categorization

Answer

To eliminate inherited controls from the SSP

Question 5

Which concept BEST describes implementing multiple overlapping layers of security controls to protect information system resources?

Accepted Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties

Answer

Need to know

Question 6

During implementation, who is primarily responsible for ensuring that security controls are correctly configured and operational in the information system?

Accepted Answer

The System Owner

Answer

The Authorizing Official (AO)

Answer

The Information System Security Officer (ISSO)

Answer

The Security Control Assessor (SCA)

Question 7

What is a 'security control baseline' as defined in NIST SP 800-53?

Accepted Answer

The initial set of controls corresponding to a system's impact level before tailoring

Answer

The final set of controls remaining after a security assessment

Answer

A list of controls verified as effective during continuous monitoring

Answer

Controls that apply universally to all federal systems regardless of impact level