Security Assessment Flashcards

A SP 800-53A assessor first examines only a sample of three firewall rule sets for an access control. The AO then asks for higher assurance, so the assessor expands the review to every boundary device in all three data centers and adds the DMZ jump hosts. Which assessment method attribute was increased?

Answer: Coverage, because the number and types of assessment objects grew

SP 800-53A gives assessment methods two attributes. Depth is how rigorous and detailed the review of each object is. Coverage is how broad the assessment is: how many objects and what types are included. Going from a three-device sample to every boundary device plus a new object type (jump hosts) raises coverage. Each device is not being looked at more closely, so depth does not change. 'Rigor' and 'scope' are not the formal attribute names, and adding devices that were already inside the boundary does not redefine it.

A system inherits a hybrid incident-response control from an enterprise Security Operations Center (SOC). The SOC, acting as the common control provider, finished its own assessment four months ago and issued a SAR. What is the most appropriate approach for the system-level assessor?

Answer: Use the SOC's assessment results for the common portion and assess only the system-specific portion of the hybrid control

In RMF, common control providers assess their controls and make the SAR and POA&M available to the systems that inherit them. A system assessor can use those results for the inherited portion as long as they are current and relevant. A hybrid control has a system-specific portion too, and the system team is responsible for it, so the system assessor must assess that part. Reassessing the whole control duplicates effort. Calling it 'not applicable' misstates who is responsible. Deferring it leaves the system portion unassessed.

To evaluate a contingency planning control, an assessor watches a backup operator carry out the documented weekly tape rotation and offsite transfer, without stepping in. Under SP 800-53A, which method and object type best describe this activity?

Answer: Examine: activities

SP 800-53A defines 'examine' as checking, inspecting, reviewing, observing, studying, or analyzing assessment objects, and 'activities' is one of its object types. Watching an operator follow a procedure is observation, so it is examine: activities. 'Test' means exercising objects under specified conditions to compare actual behavior with expected behavior, which the assessor did not do here. 'Interview' would mean asking the operator questions. 'Specifications' are documents such as plans and procedures, not the work being performed.

An assessment objective for an audit-review control has four determination statements. The assessor finds three of them 'satisfied.' The fourth, which covers whether findings are reported to defined personnel, is 'other than satisfied' because reports go to an unlisted mailbox. How should this be reflected in the assessment results?

Answer: The control item is 'other than satisfied,' and the SAR documents the specific determination statement that was not met

SP 800-53A allows only two results for each determination statement: satisfied (S) or other than satisfied (O). There is no 'partially satisfied' category and no percentage score. If any determination statement is O, the related assessment objective is not fully met, so the result is 'other than satisfied.' The SAR should name which part failed and why, so the system owner can fix it precisely and the AO can judge the risk. Calling it satisfied because 'most' statements passed misrepresents the result.

After the SAR is delivered, the system owner fixes two 'other than satisfied' findings within the assessment window (RMF Assess step, task A-5). The assessor reassesses both and confirms they are now satisfied. What should happen to the assessment documentation?

Answer: The original findings stay in the SAR, and the reassessment results are added (for example, as an addendum or updated findings) so the AO can see both the deficiency and how it was fixed

SP 800-37 Rev. 2 task A-5 covers initial remediation actions and reassessment of the remediated controls. The SAR is updated with the new assessment information, usually as an addendum or revised findings, and the original findings are kept. That way the AO has a full, traceable record: what was wrong, what was done, and the current result. Deleting findings destroys the audit trail. Items already fixed and verified during the assessment don't need to be opened as POA&M items, and leaving the SAR unchanged would give the AO stale information at the authorization decision.

An organization is setting control assessment frequencies in its ISCM strategy. Which control would generally justify the MOST frequent ongoing assessment?

Answer: A configuration management baseline control on a cloud platform where infrastructure-as-code pipelines push changes several times a day

SP 800-137 and SP 800-53A say ongoing assessment frequency should depend on factors such as how volatile the control is, how critical it is, the threat environment, and the system's risk tolerance. Volatility means how often the control's implementation is likely to change. Controls that change often need more frequent assessment because their effectiveness can drift quickly. A configuration baseline changed by automated pipelines many times a day is very volatile, and it is also a good candidate for automated, near-real-time monitoring. The other options describe stable controls that rarely change.