CySA+ Test Compliance Frameworks 3

Question 1

Which framework uses a maturity model with five levels (Initial, Managed, Defined, Quantitatively Managed, Optimizing) to assess cybersecurity processes?

Accepted Answer

CMMI

Answer

CMMI (Capability Maturity Model Integration) defines five maturity levels used to benchmark and improve organizational processes including security.

Question 2

Under the FedRAMP authorization process, which impact level applies to federal systems where breach could cause serious adverse effects?

Accepted Answer

High

Answer

FedRAMP High impact level applies to systems where unauthorized disclosure could cause severe or catastrophic adverse effects on federal operations or national security.

Question 3

A company performing a gap analysis against ISO 27001 identifies missing controls. What document defines the scope of controls selected for implementation?

Accepted Answer

Statement of Applicability (SoA)

Answer

The Statement of Applicability (SoA) lists all ISO 27001 Annex A controls, indicating which are applicable, implemented, or excluded with justification.

Question 4

Which CIS Control focuses on continuous vulnerability management through scanning and remediation?

Accepted Answer

CIS Control 7 — Continuous Vulnerability Management

Answer

CIS Control 7 specifically addresses continuous vulnerability management, requiring organizations to regularly scan for and remediate vulnerabilities.

Question 5

FISMA requires federal agencies to categorize information systems using which standard?

Accepted Answer

FIPS 199

Answer

FIPS 199 provides the standards for security categorization of federal information and information systems based on potential impact.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Compliance Frameworks 3