CGRC CGRC Information Security Controls 4

Question 1

Which NIST SP 800-53 control family specifically addresses the protection of system and communications at the boundary of an information system?

Accepted Answer

System and Communications Protection (SC)

Answer

The SC (System and Communications Protection) family covers boundary protection, cryptographic controls, and network segmentation.

Question 2

An organization discovers that a compensating control is needed because implementing a required baseline control is technically infeasible. What document must be formally approved to justify this?

Accepted Answer

Plan of Action Waiver / Control Tailoring Justification

Answer

A tailoring justification (sometimes called a waiver) must be documented and approved by the Authorizing Official when a baseline control cannot be implemented.

Question 3

Under NIST SP 800-53, which control requires organizations to monitor and control communications at external boundaries and key internal boundaries?

Accepted Answer

SC-7 Boundary Protection

Answer

SC-7 (Boundary Protection) specifically mandates monitoring and controlling network communications at external and key internal boundaries.

Question 4

A security control assessment reveals that an implemented control partially satisfies the stated requirements. How should this finding be categorized?

Accepted Answer

Other Than Satisfied — Control Deficiency

Answer

NIST SP 800-53A uses 'Other Than Satisfied' to classify controls that are partially implemented or partially effective.

Question 5

Which of the following best describes the purpose of continuous monitoring in the context of NIST RMF Step 6?

Accepted Answer

To maintain ongoing awareness of security and privacy posture over time

Answer

RMF Step 6 (Monitor) aims to maintain ongoing situational awareness of the security and privacy posture of information systems.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC CGRC Information Security Controls 4