CGRC Authorization Process 4

Question 1

Which element of the authorization decision communicates specific conditions the system owner must maintain for the authorization to remain valid?

Accepted Answer

Authorization terms and conditions

Answer

Authorization terms and conditions specify the constraints and requirements the system must meet to maintain its authorization status.

Question 2

What is the relationship between continuous monitoring and the authorization process under RMF?

Accepted Answer

Monitoring results feed into ongoing authorization decisions and can trigger re-authorization

Answer

Continuous monitoring provides ongoing security status data that informs the AO's ongoing authorization decisions and can trigger re-authorization if risks change significantly.

Question 3

An organization is authorizing a system that processes both classified and unclassified data on the same network segment. The primary concern during authorization would be:

Accepted Answer

Data spillage and inadequate boundary protections

Answer

Mixed-classification environments require robust boundary controls to prevent classified data from commingling with unclassified data.

Question 4

Under the DoD Risk Management Framework (RMF), the term equivalent to NIST's 'Authorizing Official' is:

Accepted Answer

Authorizing Official (same term)

Answer

DoD adopted NIST RMF terminology and uses 'Authorizing Official' consistent with NIST SP 800-37 (replacing the legacy DAA title).

Question 5

A system owner discovers a new critical vulnerability after receiving an ATO. What is the correct course of action?

Accepted Answer

Immediately notify the AO and document it in the POA&M

Answer

New critical vulnerabilities must be promptly reported to the AO and tracked in the POA&M to support informed ongoing authorization decisions.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Authorization Process 4