Compliance and Auditing IT Compliance and Security 2

Question 1

What is a 'system security plan' (SSP) required by FISMA?

Accepted Answer

A formal document that provides an overview of security requirements and describes the controls in place

Answer

A System Security Plan (SSP) is a formal document required by FISMA that describes the system boundary, security requirements, and security controls implemented to protect a federal information system.

Question 2

Which process under NIST RMF involves selecting and implementing security controls?

Accepted Answer

Select and Implement

Answer

The NIST Risk Management Framework (RMF) Select step involves choosing appropriate security controls from NIST SP 800-53 based on the system's security categorization, and the Implement step involves putting those controls in place.

Question 3

What is a 'vulnerability scan' primarily used for in IT compliance?

Accepted Answer

Automatically identifying known security weaknesses in systems and software

Answer

Vulnerability scanning uses automated tools to identify known security vulnerabilities, misconfigurations, and weaknesses in systems, applications, and network devices.

Question 4

What is 'patch management' as an IT compliance control?

Accepted Answer

The systematic process of identifying, acquiring, testing, and deploying software updates to fix vulnerabilities

Answer

Patch management is a systematic process for identifying security vulnerabilities in software and applying vendor-released patches in a timely manner to reduce the window of exposure to exploitation.

Question 5

In cybersecurity compliance, what is a 'Security Information and Event Management' (SIEM) system used for?

Accepted Answer

Collecting and analyzing security event logs to detect threats and support compliance reporting

Answer

A SIEM system aggregates and analyzes security event logs from across the IT environment to detect suspicious activity, support incident response, and generate compliance reports.

Compliance and Auditing Practice Test

Compliance and Auditing Practice Test

Compliance and Auditing IT Compliance and Security 2