CGRC CGRC Information Security Controls 5

Question 1

According to NIST SP 800-53 Rev 5, which control enhancement for Least Privilege requires that privileged accounts be used only for administrative tasks and not for general-purpose activities?

Accepted Answer

AC-6(2) Non-Privileged Access for Non-Privileged Functions

Answer

AC-6(2) requires that users with privileged accounts use non-privileged accounts for non-privileged functions such as web browsing or email.

Question 2

Which document produced during the RMF process describes a system's security and privacy requirements, the controls selected to satisfy those requirements, and the implementation status of each control?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) is the primary document that records selected controls, their implementation details, and planned milestones.

Question 3

An auditor finds that user access rights have not been reviewed in over 18 months despite a policy requiring annual reviews. Which NIST SP 800-53 control is most directly violated?

Accepted Answer

AC-2 Account Management

Answer

AC-2 (Account Management) requires periodic review of user accounts and access privileges to ensure they remain appropriate.

Question 4

What is the primary distinction between a vulnerability and a threat in information security risk terminology?

Accepted Answer

A vulnerability is a weakness that can be exploited; a threat is a potential event that could exploit a weakness

Answer

In NIST risk terminology, a vulnerability is a flaw or weakness while a threat is an event or actor with the potential to exploit that vulnerability.

Question 5

Which NIST SP 800-53 control family addresses requirements for auditing and accountability, including audit log generation and protection?

Accepted Answer

AU — Audit and Accountability

Answer

The AU (Audit and Accountability) control family covers audit log creation, content, storage, protection, and review.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC CGRC Information Security Controls 5