CGRC Information System Categorization 3

Question 1

Which federal law requires all federal agencies to categorize their information and information systems using FIPS 199?

Accepted Answer

Federal Information Security Modernization Act (FISMA)

Answer

Privacy Act of 1974

Answer

Gramm-Leach-Bliley Act (GLBA)

Answer

Computer Fraud and Abuse Act (CFAA)

Question 2

An agency's financial system that, if unavailable, would halt mission-critical payment operations for more than 24 hours would likely receive what availability impact level?

Accepted Answer

High

Answer

Low

Answer

Moderate

Answer

Critical

Question 3

Under NIST SP 800-60, which federal government function is an example of a 'Management and Support' information type?

Accepted Answer

Human Resources Management

Answer

Border and Transportation Security

Answer

Disaster Management

Answer

Environmental Monitoring

Question 4

What is the relationship between FIPS 199 categorization and FIPS 200 security requirements?

Accepted Answer

FIPS 199 categorization determines the minimum security requirements mandated by FIPS 200

Answer

FIPS 200 must be completed before FIPS 199 categorization

Answer

FIPS 199 and FIPS 200 are independent and unrelated standards

Answer

FIPS 200 replaces FIPS 199 for modern systems

Question 5

Which stakeholder is primarily responsible for identifying the information types processed by a system during categorization?

Accepted Answer

System Owner in coordination with the Information Owner

Answer

Authorizing Official (AO)

Answer

Information System Security Officer (ISSO)

Answer

Risk Executive (Function)

Question 6

A 'LOW' impact level in FIPS 199 indicates that loss of the security objective would have what type of effect?

Accepted Answer

Limited adverse effects on organizational operations, assets, or individuals

Answer

Catastrophic adverse effects on organizational operations

Answer

Severe adverse effects on organizational operations

Answer

No measurable effect on operations

Question 7

When a single information system supports multiple missions with different information types at different impact levels, how is the overall system security category determined?

Accepted Answer

Apply the high-water mark across all information types for each security objective

Answer

Use the lowest impact level across all information types

Answer

Assign a separate category per mission

Answer

Average the impact levels of all information types