CGRC Information System Categorization 2

Question 1

When categorizing information types, if an information system processes both 'Moderate' confidentiality data and 'High' availability data, what is the system's overall security category?

Accepted Answer

High

Answer

Using the high-water mark principle from FIPS 199, the overall security category is High because that is the highest impact level across all security objectives.

Question 2

Which document formally records the security categorization decision for an information system as part of the RMF process?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) formally documents the security categorization along with the system description, boundary, and selected controls.

Question 3

In the NIST SP 800-60 framework, information is grouped into what two broad categories?

Accepted Answer

Mission-based and Management support

Answer

NIST SP 800-60 groups government information into Mission-based information types and Management and Support information types.

Question 4

A system that stores Social Security Numbers and other PII is likely to receive a HIGH impact rating for which security objective above others?

Accepted Answer

Confidentiality

Answer

Personally Identifiable Information (PII) is primarily sensitive because unauthorized disclosure can cause serious harm, making Confidentiality the primary concern with a High impact rating.

Question 5

Which of the following best describes a 'HIGH' impact level under FIPS 199?

Accepted Answer

Severe or catastrophic adverse effects on organizational operations, assets, or individuals

Answer

FIPS 199 defines a HIGH impact as one where a loss could be expected to have a severe or catastrophic adverse effect on organizational operations, assets, or individuals.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Information System Categorization 2