CGRC CGRC Information Security Controls

Question 1

Which NIST publication provides a catalog of security and privacy controls for federal information systems?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

NIST SP 800-30

Answer

NIST SP 800-60

Question 2

In the context of CGRC, what is the primary purpose of a security control baseline?

Accepted Answer

To provide a starting set of controls for a given impact level

Answer

To document all known vulnerabilities

Answer

To record audit findings

Answer

To define network perimeter boundaries

Question 3

Which control family in NIST SP 800-53 addresses identification and authentication requirements?

Accepted Answer

IA – Identification and Authentication

Answer

AC – Access Control

Answer

SI – System and Information Integrity

Answer

AU – Audit and Accountability

Question 4

What term describes the process of selecting and adjusting security controls to meet the specific needs of an organization or system?

Accepted Answer

Control tailoring

Answer

Control inheritance

Answer

Control authorization

Answer

Control scoping

Question 5

Which type of control is implemented through hardware, software, or firmware to protect information systems?

Accepted Answer

Technical control

Answer

Administrative control

Answer

Physical control

Answer

Operational control

Question 6

Under NIST SP 800-53, which control family specifically addresses planning for security activities within a system?

Accepted Answer

PL – Planning

Answer

PM – Program Management

Answer

SA – System and Services Acquisition

Answer

CA – Assessment, Authorization, and Monitoring