CGRC Information System Categorization — Questions and Answers

Question 1: Which NIST publication provides the primary guidance for categorizing federal information and information systems?

NIST SP 800-53
NIST SP 800-37
FIPS 199 (Correct answer)
FIPS 200

Correct answer: FIPS 199

FIPS 199 (Standards for Security Categorization of Federal Information and Information Systems) is the primary standard that defines security categories for federal information and systems.

Question 2: In the NIST RMF, information system categorization is which step of the framework?

Step 1 – Prepare
Step 2 – Categorize (Correct answer)
Step 3 – Select
Step 4 – Implement

Correct answer: Step 2 – Categorize

Categorize is Step 2 of the NIST RMF, occurring after the Prepare step and before the Select step.

Question 3: FIPS 199 defines the security category of an information system based on which three security objectives?

Availability, Authenticity, and Integrity
Confidentiality, Integrity, and Availability (Correct answer)
Accountability, Integrity, and Availability
Confidentiality, Non-repudiation, and Availability

Correct answer: Confidentiality, Integrity, and Availability

FIPS 199 uses Confidentiality, Integrity, and Availability (CIA) as the three security objectives for determining an information system's security category.

Question 4: When applying FIPS 199, what are the three potential impact levels for each security objective?

Negligible, Moderate, Severe
Low, Medium, High
Low, Moderate, High (Correct answer)
Minor, Major, Critical

Correct answer: Low, Moderate, High

FIPS 199 defines Low, Moderate, and High as the three potential impact levels for each of the three security objectives.

Question 5: The overall security category of an information system in FIPS 199 is determined by applying which rule to the impact levels of each security objective?

Average of all impact values
High-water mark (highest impact level) (Correct answer)
Low-water mark (lowest impact level)
Median impact level across objectives

Correct answer: High-water mark (highest impact level)

FIPS 199 uses the high-water mark principle, meaning the overall system categorization is the highest impact level assigned to any individual security objective.

Question 6: Which NIST publication provides supplemental guidance on how to determine the security category of information types and systems per FIPS 199?

NIST SP 800-60 (Correct answer)
NIST SP 800-53A
NIST SP 800-137
NIST SP 800-39

Correct answer: NIST SP 800-60

NIST SP 800-60 (Guide for Mapping Types of Information and Information Systems to Security Categories) supplements FIPS 199 by providing mappings for categorizing specific information types.

Question 7: Who is ultimately responsible for approving the security categorization of an information system according to the NIST RMF?

Information System Security Officer (ISSO)
Authorizing Official (AO)
System Owner (Correct answer)
Senior Agency Information Security Officer (SAISO)

Correct answer: System Owner

The System Owner is responsible for categorizing the information system and ensuring the categorization is reviewed and approved by senior officials, with the AO ultimately concurring.

Question 8: When categorizing information types, if an information system processes both 'Moderate' confidentiality data and 'High' availability data, what is the system's overall security category?

Moderate
High (Correct answer)
Low
It depends on the number of information types

Correct answer: High

Using the high-water mark principle from FIPS 199, the overall security category is High because that is the highest impact level across all security objectives.

Question 9: Which document formally records the security categorization decision for an information system as part of the RMF process?

System Security Plan (SSP) (Correct answer)
Security Assessment Report (SAR)
Plan of Action and Milestones (POA&M)
Privacy Impact Assessment (PIA)

Correct answer: System Security Plan (SSP)

The System Security Plan (SSP) formally documents the security categorization along with the system description, boundary, and selected controls.

Question 10: In the NIST SP 800-60 framework, information is grouped into what two broad categories?

Classified and Unclassified
Mission-based and Management support (Correct answer)
Operational and Management
Technical and Non-technical

Correct answer: Mission-based and Management support

NIST SP 800-60 groups government information into Mission-based information types and Management and Support information types.

Question 11: A system that stores Social Security Numbers and other PII is likely to receive a HIGH impact rating for which security objective above others?

Availability
Integrity
Confidentiality (Correct answer)
Accountability

Correct answer: Confidentiality

Personally Identifiable Information (PII) is primarily sensitive because unauthorized disclosure can cause serious harm, making Confidentiality the primary concern with a High impact rating.

Question 12: Which of the following best describes a 'HIGH' impact level under FIPS 199?

Limited adverse effects on organizational operations or assets
Serious adverse effects on organizational operations, assets, or individuals
Severe or catastrophic adverse effects on organizational operations, assets, or individuals (Correct answer)
No adverse effects on mission capabilities

Correct answer: Severe or catastrophic adverse effects on organizational operations, assets, or individuals

FIPS 199 defines a HIGH impact as one where a loss could be expected to have a severe or catastrophic adverse effect on organizational operations, assets, or individuals.

Question 13: What term does FIPS 199 use to describe the format for expressing a system's security category?

SC = {confidentiality impact, integrity impact, availability impact}
SC = {C:impact, I:impact, A:impact}
SC (system) = {(confidentiality, impact), (integrity, impact), (availability, impact)} (Correct answer)
SC = C/I/A

Correct answer: SC (system) = {(confidentiality, impact), (integrity, impact), (availability, impact)}

FIPS 199 expresses a security category as SC (information type) = {(confidentiality, impact level), (integrity, impact level), (availability, impact level)}.

Question 14: When should security categorization be revisited during the system lifecycle?

Only during the initial Authorization process
Whenever significant changes occur to the system or its operating environment (Correct answer)
Once every five years regardless of system changes
Only when the Authorizing Official requests a review

Correct answer: Whenever significant changes occur to the system or its operating environment

Security categorization should be reviewed and updated whenever significant changes occur to the system, the information it processes, or the operating environment.

Question 15: Which federal law requires all federal agencies to categorize their information and information systems using FIPS 199?

Privacy Act of 1974
Federal Information Security Modernization Act (FISMA) (Correct answer)
Gramm-Leach-Bliley Act (GLBA)
Computer Fraud and Abuse Act (CFAA)

Correct answer: Federal Information Security Modernization Act (FISMA)

FISMA requires federal agencies to comply with FIPS publications, including FIPS 199, for categorizing information and information systems.

Question 16: An agency's financial system that, if unavailable, would halt mission-critical payment operations for more than 24 hours would likely receive what availability impact level?

Low
Moderate
High (Correct answer)
Critical

Correct answer: High

A system whose unavailability halts critical mission operations represents severe or catastrophic consequences, warranting a High availability impact level under FIPS 199.

Question 17: Under NIST SP 800-60, which federal government function is an example of a 'Management and Support' information type?

Border and Transportation Security
Human Resources Management (Correct answer)
Disaster Management
Environmental Monitoring

Correct answer: Human Resources Management

Human Resources Management is a Management and Support information type under SP 800-60, as it supports internal organizational functions rather than direct mission delivery.

Question 18: What is the relationship between FIPS 199 categorization and FIPS 200 security requirements?

FIPS 199 categorization determines the minimum security requirements mandated by FIPS 200 (Correct answer)
FIPS 200 must be completed before FIPS 199 categorization
FIPS 199 and FIPS 200 are independent and unrelated standards
FIPS 200 replaces FIPS 199 for modern systems

Correct answer: FIPS 199 categorization determines the minimum security requirements mandated by FIPS 200

FIPS 200 specifies minimum security requirements for federal information systems, and the categorization from FIPS 199 determines which baseline of controls from NIST SP 800-53 applies.

Question 19: Which stakeholder is primarily responsible for identifying the information types processed by a system during categorization?

Authorizing Official (AO)
System Owner in coordination with the Information Owner (Correct answer)
Information System Security Officer (ISSO)
Risk Executive (Function)

Correct answer: System Owner in coordination with the Information Owner

The System Owner, working with Information Owners/Stewards, identifies the information types processed by the system as part of the categorization task.

Question 20: A 'LOW' impact level in FIPS 199 indicates that loss of the security objective would have what type of effect?

Catastrophic adverse effects on organizational operations
Severe adverse effects on organizational operations
Limited adverse effects on organizational operations, assets, or individuals (Correct answer)
No measurable effect on operations

Correct answer: Limited adverse effects on organizational operations, assets, or individuals

FIPS 199 defines LOW impact as loss of confidentiality, integrity, or availability that could be expected to have a limited adverse effect on organizational operations, assets, or individuals.

Question 21: When a single information system supports multiple missions with different information types at different impact levels, how is the overall system security category determined?

Use the lowest impact level across all information types
Assign a separate category per mission
Apply the high-water mark across all information types for each security objective (Correct answer)
Average the impact levels of all information types

Correct answer: Apply the high-water mark across all information types for each security objective

The high-water mark principle is applied separately to each security objective across all information types; the highest impact level for each objective determines the system-level category.

CGRC Information System Categorization

Which NIST publication provides the primary guidance for categorizing federal information and information systems?

🃏 CGRC Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full CGRC Study Guide →

What Practice Test Geeks adds beyond an AI chat for CGRC

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length CGRC mock exam — 125 questions in 180 minutes with a 70% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed CGRC question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable CGRC cheat sheet you can print or save as a PDF.
CGRC flashcards built from the same question bank.

Start the Timed CGRC Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isc2.org — Test delivery, eligibility, passing score, time limit, renewal, score validity, score release, fees, exam information · verified Nov 2026