Control Selection 2 Flashcards

A security engineer is evaluating whether to implement a network intrusion detection system (NIDS) as a security control. The NIDS monitors traffic but does not actively block threats. Which control type best describes this implementation?

Answer: Detective control

A network intrusion detection system that monitors and alerts but does not block traffic is a detective control. Detective controls identify and record security events after or as they occur, but do not prevent them. Preventive controls stop threats before they happen, corrective controls restore systems after an incident, and compensating controls substitute for primary controls when they cannot be implemented.

During control selection for a federal information system, a security team identifies a required control from NIST SP 800-53 that is technically unfeasible due to legacy hardware constraints. What is the MOST appropriate next step according to the RMF?

Answer: Document a control tailoring decision and identify a compensating control

When a required control cannot be implemented due to technical or operational constraints, the RMF process allows for tailoring decisions, which must be documented in the System Security Plan (SSP). A compensating control should be identified to provide equivalent or comparable protection. Removing the control without documentation or justification violates RMF requirements, and deferring without documentation leaves an undocumented gap.

An organization is selecting controls for a system that processes Controlled Unclassified Information (CUI) and has been assigned a MODERATE impact level. Which baseline from NIST SP 800-53 should serve as the starting point for control selection?

Answer: Moderate baseline

NIST SP 800-53 provides three control baselines — Low, Moderate, and High — corresponding to the system's impact level as determined through FIPS 199 categorization. A system categorized as MODERATE should begin with the Moderate baseline. Organizations then tailor this baseline by adding, removing, or modifying controls based on their specific environment, threat landscape, and operational requirements.

A CGRC practitioner is reviewing a control that requires multi-factor authentication (MFA) for all privileged accounts. The organization currently uses a single-factor hardware token that generates a time-based one-time password (TOTP). How should this control be characterized?

Answer: Partially satisfied — a Plan of Action and Milestones (POA&M) should document the gap

A username combined with a TOTP token represents something you know (username/password) plus something you have (the token), which typically constitutes two factors. However, if the organization is only using the token without a separate password, it remains single-factor. In the common implementation where a password plus TOTP is used, MFA is satisfied. If the control is not fully met — for example, if some privileged accounts are excluded — a POA&M should document the gap and remediation timeline. Given the ambiguity in the scenario about the full implementation, partial satisfaction with a POA&M is the most prudent answer.

When applying control tailoring during the RMF Select step, which of the following actions is NOT a recognized tailoring activity per NIST SP 800-53B?

Answer: Replacing all baseline controls with custom controls developed in-house

Recognized tailoring activities in NIST SP 800-53B include applying scoping considerations, specifying parameter values for organization-defined parameters, and supplementing the baseline with additional controls when risk warrants it. Wholesale replacement of all baseline controls with custom in-house controls is not a recognized tailoring activity — the established baseline exists to ensure a minimum protection standard, and replacing it entirely would undermine the RMF's risk management framework.

An organization operating a cloud-based system leverages its Cloud Service Provider's (CSP) FedRAMP-authorized environment. Some security controls are managed entirely by the CSP. How should these controls be reflected in the organization's System Security Plan (SSP)?

Answer: Listed as inherited controls with a reference to the CSP's authorization package

When a customer organization leverages a FedRAMP-authorized CSP, controls that are fully managed by the CSP are documented as inherited controls in the organization's SSP. The SSP references the CSP's authorization package (e.g., their FedRAMP package) as evidence of control implementation. This inheritance model is a core concept in cloud security under the RMF — it reduces duplication of effort while maintaining accountability and traceability across organizational boundaries.