CGRC CGRC Information Security Controls 2

Question 1

What is the purpose of a System Security Plan (SSP) in the RMF process?

Accepted Answer

To describe the security requirements and controls implemented for a system

Answer

An SSP formally documents a system's security requirements, the controls selected to meet those requirements, and the roles responsible for implementation.

Question 2

Which concept refers to a system's ability to inherit security controls implemented by a common control provider?

Accepted Answer

Control inheritance

Answer

Control inheritance allows a system to leverage and rely on controls already implemented by a shared infrastructure or service provider without re-implementing them.

Question 3

What is a compensating control?

Accepted Answer

An alternative control used when the required control cannot be implemented

Answer

A compensating control provides equivalent protection when the primary required control cannot be implemented due to technical or operational constraints.

Question 4

Which FIPS standard is used to categorize federal information and information systems based on potential impact?

Accepted Answer

FIPS 199

Answer

FIPS 199 defines the standards for categorizing information and information systems as Low, Moderate, or High based on confidentiality, integrity, and availability impacts.

Question 5

In NIST SP 800-53, what does the CM control family address?

Accepted Answer

Configuration Management

Answer

The CM (Configuration Management) family includes controls for establishing and maintaining baseline configurations and tracking changes to systems.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC CGRC Information Security Controls 2