CAP Security Control Implementation 3

Question 1

What does NIST SP 800-53A provide in direct support of the security control implementation and assessment process?

Accepted Answer

Assessment procedures for determining whether implemented controls are effective

Answer

NIST SP 800-53A provides the assessment procedures used to evaluate whether security controls have been correctly implemented and are operating effectively.

Question 2

What is the significance of documenting implementation status and evidence in the System Security Plan?

Accepted Answer

It provides evidence that assessors and the AO use to evaluate the system's security posture

Answer

Documented implementation evidence gives the security control assessor and Authorizing Official the basis they need to evaluate whether controls are effective and make sound authorization decisions.

Question 3

When a security control is determined to be 'not applicable' to an information system, what must the system owner do?

Accepted Answer

Document the rationale for non-applicability in the SSP

Answer

Non-applicability determinations must be documented with a clear rationale in the SSP so assessors and the AO can evaluate whether the decision is justified.

Question 4

What role does the Information System Security Engineer (ISSE) play in security control implementation?

Accepted Answer

Providing technical expertise to ensure controls are properly engineered into the system

Answer

The ISSE applies security engineering expertise to ensure that security controls and requirements are correctly designed and integrated into the system architecture and implementation.

Question 5

Which of the following is an example of a technical security control implementation?

Accepted Answer

Configuring automated audit log generation and retention on a server

Answer

Technical controls are implemented through hardware, software, or firmware; configuring automated audit logging is a direct technical implementation within the system itself.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Security Control Implementation 3