CAP Security Control Implementation 2

Question 1

What is the primary purpose of applying security engineering principles during security control implementation?

Accepted Answer

To integrate security into systems from the design phase

Answer

Security engineering principles ensure that security requirements and controls are built into systems from the beginning rather than retrofitted after development.

Question 2

When a system owner inherits a common control from an external provider, what responsibility does the system owner retain?

Accepted Answer

Verifying the inherited control adequately satisfies their system's security requirements

Answer

System owners must verify that inherited controls are appropriately implemented and actually satisfy the security requirements for their specific system.

Question 3

According to NIST SP 800-53, which control baseline applies to an information system with a FIPS 199 overall impact level of Moderate?

Accepted Answer

Moderate baseline

Answer

NIST SP 800-53 directly maps baseline selection to impact level, so a Moderate-impact system uses the Moderate security control baseline.

Question 4

What is the purpose of security control overlays in the implementation process?

Accepted Answer

To tailor baseline controls for specific technologies, environments, or communities of interest

Answer

Overlays provide tailoring guidance that customizes security control baselines for specific technologies, deployment environments, or sector-specific requirements.

Question 5

Which concept BEST describes implementing multiple overlapping layers of security controls to protect information system resources?

Accepted Answer

Defense in depth

Answer

Defense in depth involves layering multiple security controls so that if one control fails, additional controls remain in place to protect the system.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Security Control Implementation 2