CSPM Security Industry-Specific Knowledge 2

Question 1

Under NIST SP 800-37, which step in the Risk Management Framework (RMF) involves defining the system boundary and the types of information processed?

Accepted Answer

Categorize

Answer

The Categorize step establishes the system boundary and classifies information based on impact levels using FIPS 199 criteria.

Question 2

A physical security project must comply with PACS (Physical Access Control System) integration requirements. Which standard governs interoperability between PACS and government identity credentials?

Accepted Answer

FIPS 201 / PIV

Answer

FIPS 201 establishes the Personal Identity Verification (PIV) standard that PACS must support to accept government-issued credentials.

Question 3

Which document type is used to formally record acceptance of residual risk by an authorizing official in a government security program?

Accepted Answer

Authorization to Operate (ATO)

Answer

An ATO is issued by the authorizing official to formally accept residual risk and permit the system to operate.

Question 4

In the context of supply chain security, what does the term 'counterfeit electronic part' most directly threaten in a security project?

Accepted Answer

System integrity and mission assurance

Answer

Counterfeit parts can introduce hidden vulnerabilities or fail prematurely, directly threatening system integrity and mission assurance.

Question 5

A security manager is reviewing a contract for a guard force provider. Which labor regulation most directly governs wage and benefit requirements for private security officers on federal contracts?

Accepted Answer

Service Contract Act (SCA)

Answer

The Service Contract Act sets minimum wage, fringe benefit, and working condition requirements for employees on federal service contracts, including guard services.

(CSPM) Certified Security Project Manager Practice Test

(CSPM) Certified Security Project Manager Practice Test

CSPM Security Industry-Specific Knowledge 2