SFPC Information Systems Security and Cybersecurity Basics 5

Question 1

A DoD component system has finished its Risk Management Framework (RMF) assessment. The Security Control Assessor (SCA) found several residual weaknesses, and these are documented in the Plan of Action and Milestones (POA&M). Under DoDI 8510.01, who has the authority to formally accept the remaining risk and issue an Authorization to Operate (ATO)?

Accepted Answer

The Authorizing Official (AO), a senior official formally accountable for accepting operational risk

Answer

Under RMF, only the Authorizing Official (AO) can formally accept residual risk on behalf of the organization and issue an authorization decision such as an ATO or DATO. The SCA assesses the controls and recommends a decision but cannot accept risk. The ISSM and ISO manage the system's security and its operations, but they have no authority to authorize it.

Question 2

An employee emails a document to a colleague over the unclassified network (NIPRNet). The document is later found to contain SECRET information. What is the MOST appropriate immediate response?

Accepted Answer

Isolate the affected systems without deleting or forwarding anything, and report the spillage right away to the ISSM or security manager

Answer

This is a classified spillage, also called a data spill. Users must not delete, forward, or try to clean up the data themselves. Deleting it leaves recoverable remnants and destroys evidence, and forwarding it spreads the contamination further. The correct response is to stop all activity, isolate the affected systems (for example, disconnect them from the network but do not power them off unless told to), and report right away to the ISSM or security manager. They will coordinate containment, sanitization, and notifications.

Question 3

A magnetic hard disk drive that processed classified information is being removed from service. Under NSA/CSS Policy Manual 9-12, which method is acceptable for sanitizing it?

Accepted Answer

Degaussing the drive with an NSA/CSS-evaluated degausser and then physically destroying it

Answer

NSA/CSS Policy Manual 9-12 does not accept overwriting, Secure Erase, or cryptographic erase as sanitization for classified magnetic hard drives. The drive must be degaussed with a degausser listed on the NSA/CSS Evaluated Products List and then physically destroyed (for example, by disintegrating, shredding, or crushing it). The older 'DoD 5220.22-M overwrite' is a well-known myth and is not an approved method for classified media.

Question 4

A single standalone workstation processes SECRET information in the morning and only UNCLASSIFIED information in the afternoon. Between sessions, its removable storage is swapped out and its memory is cleared using approved procedures. What is this approved mode of operation called?

Accepted Answer

Periods processing

Answer

Periods processing means using one system at different classification levels or with different need-to-know at different times. Approved sanitization and media-swap procedures are performed between periods so that no information carries over. MLS processes several levels at the same time and relies on trusted mechanisms. System high treats all data at the highest level present. Compartmented mode restricts access by formal access approvals within one level.

Question 5

A cleared defense contractor needs to operate an information system that processes classified information at its facility under the NISP (32 CFR Part 117). Who normally serves as the Authorizing Official for that system?

Accepted Answer

The DCSA Authorizing Official, through the NISP Authorization Office (NAO)

Answer

For contractor classified systems under DoD cognizance, the Defense Counterintelligence and Security Agency (DCSA) is the Cognizant Security Agency's designated authority. Its NISP Authorization Office (NAO) provides the Authorizing Official, who issues the authorization under the DCSA Assessment and Authorization Process Manual (DAAPM). The contractor's FSO and ISSM prepare the security package and maintain the system, but they cannot authorize it.

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC - Security Fundamentals Professional Certification Practice Test

SFPC Information Systems Security and Cybersecurity Basics 5