CGRC Information System Categorization 2

Question 1

When categorizing information types, if an information system processes both 'Moderate' confidentiality data and 'High' availability data, what is the system's overall security category?

Accepted Answer

High

Answer

Moderate

Answer

Low

Answer

It depends on the number of information types

Question 2

Which document formally records the security categorization decision for an information system as part of the RMF process?

Accepted Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Answer

Plan of Action and Milestones (POA&M)

Answer

Privacy Impact Assessment (PIA)

Question 3

In the NIST SP 800-60 framework, information is grouped into what two broad categories?

Accepted Answer

Mission-based and Management support

Answer

Classified and Unclassified

Answer

Operational and Management

Answer

Technical and Non-technical

Question 4

A system that stores Social Security Numbers and other PII is likely to receive a HIGH impact rating for which security objective above others?

Accepted Answer

Confidentiality

Answer

Availability

Answer

Integrity

Answer

Accountability

Question 5

Which of the following best describes a 'HIGH' impact level under FIPS 199?

Accepted Answer

Severe or catastrophic adverse effects on organizational operations, assets, or individuals

Answer

Limited adverse effects on organizational operations or assets

Answer

Serious adverse effects on organizational operations, assets, or individuals

Answer

No adverse effects on mission capabilities

Question 6

What term does FIPS 199 use to describe the format for expressing a system's security category?

Accepted Answer

SC (system) = {(confidentiality, impact), (integrity, impact), (availability, impact)}

Answer

SC = {confidentiality impact, integrity impact, availability impact}

Answer

SC = {C:impact, I:impact, A:impact}

Answer

SC = C/I/A

Question 7

When should security categorization be revisited during the system lifecycle?

Accepted Answer

Whenever significant changes occur to the system or its operating environment

Answer

Only during the initial Authorization process

Answer

Once every five years regardless of system changes

Answer

Only when the Authorizing Official requests a review