ISP ISP Information & Cybersecurity 3

Question 1

Which document formally authorizes a system to operate by accepting identified residual risks?

Accepted Answer

Authority to Operate (ATO)

Answer

An ATO is an official management decision that a system's risk level is acceptable and it is authorized for operation.

Question 2

Encryption of data in transit is BEST enforced in an industrial network by requiring:

Accepted Answer

Transport Layer Security (TLS) or equivalent cryptographic protocols on all network channels

Answer

TLS ensures data integrity and confidentiality while in transit across networks that may traverse untrusted segments.

Question 3

A 'security baseline' in an industrial information security program refers to:

Accepted Answer

The minimum acceptable configuration and security controls applied uniformly to all systems

Answer

A security baseline defines the minimum set of controls every system must have, ensuring a consistent security floor across the organization.

Question 4

Which approach to cybersecurity assumes that no user, device, or network segment should be trusted by default, even inside the perimeter?

Accepted Answer

Zero Trust Architecture

Answer

Zero Trust operates on the principle of 'never trust, always verify,' requiring continuous authentication and authorization regardless of network location.

Question 5

Which regulatory framework governs the protection of Controlled Unclassified Information (CUI) in non-federal U.S. industrial organizations?

Accepted Answer

NIST SP 800-171 / CMMC

Answer

NIST SP 800-171 and its enforcement mechanism CMMC apply to contractors and industrial firms handling CUI on behalf of the U.S. government.

(ISP) Industrial Security Professional Certification Practice Test

(ISP) Industrial Security Professional Certification Practice Test

ISP ISP Information & Cybersecurity 3