Free CGRC Compliance and Policy Questions and Answers — Questions and Answers
Question 1: The determination of whether a system should be deemed a national security system is required by FISMA and supported by which NIST publication?
- NIST SP 800-70
- NIST SP 800-69
- NIST SP 800-60
- NIST SP 800-59 (Correct answer)
Correct answer: NIST SP 800-59
Explanation: <br> NIST Special Publication (SP) 800-59 provides guidance on the determination of whether a system should be deemed a national security system, as required by the Federal Information Security Modernization Act (FISMA). This publication assists organizations in identifying systems that require special consideration due to their significance for national security purposes.
Question 2: There are many prospective risks, categories of risk, and manners in which risk is evaluated. Federal law requires the consideration of mission, assets, other organizations and:
- Financial
- Individuals (Correct answer)
- Policy
- None of the above
Correct answer: Individuals
Explanation: <br> Federal law requires the consideration of mission, assets, other organizations, and individuals when evaluating risks. This emphasizes the importance of assessing risks not only in terms of organizational objectives and assets but also in terms of potential impacts on individuals who may be affected by the risks.
Question 3: The security objectives are:
- Confidentiality, integrity, and availability (Correct answer)
- Confidentiality, integrity, and authenticity
- Confidentiality, sensitivity, and availability
- Risk management, risk mitigation, and risk monitoring
Correct answer: Confidentiality, integrity, and availability
Explanation: <br> The security objectives, as commonly recognized in information security, are confidentiality, integrity, and availability (CIA). These objectives guide organizations in implementing measures to protect sensitive information, ensure data accuracy and reliability, and maintain access to resources when needed.
Question 4: According to the Risk Management Framework (RMF), which role has a primary responsibility to report the security status of the information system to the authorizing official (AO) and other appropriate organizational officials on an ongoing basis in accordance with the monitoring strategy?
- Information system security officer (ISSO)
- Common control provider (Correct answer)
- Independent assessor
- Senior information assurance officer (SIAO)
Correct answer: Common control provider
Explanation: <br> According to the Risk Management Framework (RMF), the Common Control Provider has the primary responsibility to report the security status of the information system to the authorizing official (AO) and other appropriate organizational officials on an ongoing basis in accordance with the monitoring strategy. The Common Control Provider ensures that common controls are effectively implemented and maintained across the organization's information systems.
Question 5: Which authorization approach considers time elapsed since the authorization results were produced, the environment of operation, the criticality/sensitivity of the information, and the risk tolerance of the other organization?
- Leveraged (Correct answer)
- Single
- Joint
- Site-specific
Correct answer: Leveraged
Explanation: <br> The leveraged authorization approach considers factors such as time elapsed since the authorization results were produced, the environment of operation, the criticality/sensitivity of the information, and the risk tolerance of the other organization. This approach leverages existing authorization results and documentation to streamline the authorization process for similar systems or environments, reducing duplication of effort and ensuring consistency in security posture.
Question 6: When should the information system owner document the information system and authorization boundary description in the security plan?
- After security controls are implemented
- While assembling the authorization package
- After security categorization (Correct answer)
- When reviewing the security control assessment plan
Correct answer: After security categorization
Explanation: <br> The information system owner should document the information system and authorization boundary description in the security plan after security categorization. This step ensures that the security plan accurately reflects the security requirements and considerations identified during the categorization process, which forms the basis for subsequent security control implementation and assessment.
Question 7: Information developed from Federal Information Processing Standard (FIPS) 199 may be used as an input to which authorization package document?
- Security assessment report (SAR)
- System security plan (SSP) (Correct answer)
- Plan of actions and milestones (POA&M)
- Authorization decision document
Correct answer: System security plan (SSP)
Explanation: <br> Information developed from Federal Information Processing Standard (FIPS) 199, which defines security categorization levels for information systems, may be used as input to the system security plan (SSP). The SSP documents the security requirements, controls, and implementation details for an information system, including its categorization level based on FIPS 199. Incorporating FIPS 199 information into the SSP ensures alignment with established security objectives and requirements.
Question 8: Who procures, develops, integrates, or modifies an information system?
- Program Manager
- Chief Information Officer
- Certification Program Manager
- Information System Owner (Correct answer)
Correct answer: Information System Owner
Explanation: <br> The Information System Owner is responsible for procuring, developing, integrating, or modifying an information system. This role ensures that the system meets organizational requirements and aligns with security objectives. Other options listed may have responsibilities related to information systems, but the Information System Owner holds primary accountability for these activities.
Question 9: You have just completed the Control Analysis step in the NIST SP 800-30 process. What reference would most likely be used to identify controls that are not documented in the SSP?
- NIST SP 800-47 Rev 1
- NIST SP 800-39
- NIST SP 800-53 (Correct answer)
- NIST SP 800-30
Correct answer: NIST SP 800-53
Explanation: <br> After completing the Control Analysis step in the NIST SP 800-30 process, if controls not documented in the System Security Plan (SSP) are identified, reference to additional controls can be found in NIST SP 800-53. This publication provides a comprehensive catalog of security controls that can be tailored to specific system requirements and environments.
Question 10: OMB Circular A-130 states information security must be:
- Risk Based-Cost Effective (Correct answer)
- Reduce risk to acceptable levels as determined by the System Owner
- Eliminate risk
- Reduce risk to negligible level
Correct answer: Risk Based-Cost Effective
Explanation: <br> OMB Circular A-130 states that information security must be risk-based and cost-effective. This means that security measures should be implemented in proportion to the assessed risks, ensuring that resources are allocated efficiently and effectively to mitigate the most significant risks while considering the cost-effectiveness of security investments. Options b, c, and d represent extreme approaches that may not align with the principles of risk management and cost-effectiveness outlined in OMB Circular A-130.
Question 11: Adequate Security is:
- Based on the maximum harm to information
- Commensurate with risk (Correct answer)
- Required by law regardless of cost
- Cost-effective, based on projected budgets
Correct answer: Commensurate with risk
Explanation: <br> Adequate security is commensurate with risk, meaning that security measures should be proportionate to the level of risk faced by an organization. This approach ensures that resources are allocated appropriately to address the most significant risks while avoiding over or under-investment in security measures. Options a, c, and d represent incomplete or inaccurate descriptions of adequate security, as security measures should not solely be based on maximum harm, legal requirements regardless of cost, or projected budgets.
Free CGRC Compliance and Policy Questions and Answers
The determination of whether a system should be deemed a national security system is required by FISMA and supported by which NIST publication?