SFPC Information Systems Security and Cybersecurity Basics 2

Question 1

Which DoD process replaced DIACAP for authorizing information systems?

Accepted Answer

Risk Management Framework (RMF)

Answer

DoDI 8510.01 adopted the NIST-based Risk Management Framework, replacing DIACAP.

Question 2

Who formally accepts residual risk and grants an Authorization to Operate (ATO) for a DoD information system?

Accepted Answer

The Authorizing Official (AO)

Answer

The Authorizing Official is the senior official accountable for accepting risk and issuing the ATO.

Question 3

Which NIST publication provides the catalog of security and privacy controls used in RMF?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 is the control catalog from which RMF baselines are selected.

Question 4

In RMF, which step assigns an impact level to a system based on the information it processes?

Accepted Answer

Categorize

Answer

The Categorize step uses CNSSI 1253 and FIPS 199 to set confidentiality, integrity, and availability impact levels.

Question 5

What is the primary responsibility of an Information System Security Manager (ISSM) at a cleared contractor facility?

Accepted Answer

Overseeing the security of classified information systems and their authorization packages

Answer

The ISSM manages the facility's classified IS program, including security plans and authorization support.

SFPC - Security Fundamentals Professional Certification Practice Test