Quiz
CAP 101
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (103)
1A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. What are the different types of policies?
Each correct answer represents a complete solution. Choose all that apply.- ASystematic
- BRegulatory
- CAdvisory
- DInformative
2Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?
- ATCSEC
- BFIPS
- CSSAA
- DFITSAF
3Which of the following statements correctly describes residual risk?
- AIt is the remaining risk to the information system after risk palliation has occurred.
- BIt is a process of security authorization.
- CIt is the technical implementation of the security design.
- DIt is used to validate the information system.
4Which one the following roles is responsible for testing the non‐technical controls in an information system?
- AAuthorizing Official
- BSecurity Control Assessor
- CDesignated Representative
- DInformation System Owner
5 Which reference provides detailed guidance on risk mitigation for the State Department?
- ASP 800‐37 Federal Risk Management Framework
- BSP 800‐30 Risk Assessment
- CSP 800‐39 Organization-Wide Risk Management for Information Systems
- DSP 800‐53 Security and Privacy Controls for Federal Information Systems and Organizations
6Which of the following roles has the responsibility to ensure that the enterprise architecture supports the mission and business processes?
- AInformation Security Architect
- BInformation System Security Engineer
- CCommon Control Provider
- DRisk Executive
7During which step of the Risk Management Framework (RMF) does the Information System Owner register the information system?
- ASelect Security Controls
- BImplement Security Controls
- CAuthorize Information System
- DCategorize Information System
8Who signs the authorization decision letter?
- AAuthorizing Official
- BChief Executive Officer
- CDesignated Representative
- DInformation System Owner
9Who develops and maintains information security policies, procedures, and control techniques to address all applicable requirements?
- AAuthorizing Official
- BChief Information Officer
- CChief Executive Officer
- DInformation System Owner
10A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source is the definition of which key term?
- APredisposing Condition
- BThreat
- CRisk Determination
- DVulnerability
11Who procures, develops, integrates, or modifies an information system?
- AProgram Manager
- BChief Information Officer
- CCertification Program Manager
- DInformation System Owner
12Who has the responsibility to prepare the plan of action and milestones based on the findings and recommendations of the security assessment report?
- ASecurity Control Assessor
- BCommon Control Provider
- CAuthorizing Official
- DInformation Owner/Steward
13You have just completed the Risk Assessment defined by NIST SP 800‐30. What reference identifies the risk management strategy alternatives that can be applied to the information system?
- ANIST SP 800‐47
- BNIST SP 800‐39
- CNIST SP 800‐53
- DNIST SP 800‐30
14In which phase of the NIST SP 800‐30 process does one produce the Risk Assessment Report (RAR)?
- AStep 1
- BStep 2
- CStep 3
- DStep 4
15Which step of the NIST SP 800‐30 process would most likely identify the CVE database as a risk assessment information source?
- AStep 1
- BStep 2
- CStep 3
- DStep 4
16Organizations should view assessments as an information gathering activity, not as a security producing activity. In accordance with NIST SP 800‐53A, security control assessments create the following benefits: identify potential problems or shortfalls in the organization’s implementation of the NIST Risk Management Framework; support budgetary decisions and capital investment processes, and:
- ACorrect identified weaknesses and deficiencies.
- BSupport information system authorization decisions.
- CProvide a mechanism to hold the Information System Security Officer accountable.
- DProvides an opportunity to authorize the system without further action.
17The last step in the Risk Assessment process model is called?
- AManage
- BMonitor
- CMaintain
- DModify
18When using NIST SP 800‐53A, during which SDLC phase are security assessments used to increase confidence or assurance that the security controls are working correctly for a system?
- ADevelopment and Implementation
- BDevelopment only
- COperations and Maintenance
- DDevelopment, Implementation, and Operations and Maintenance
19Which of these is a valid response to address risk?
- AResearch and Engineering
- BAcquisition Management
- CSecurity Control Assessment
- DAccept the risk to the system
20OMB Circular A‐130 states information security must:
- ABe risk-based, and cost effective
- BReduce risk to acceptable levels as determined by the System Owner
- CEliminate risk
- DReduce risk to negligible levels
21In accordance with Public Law 107‐347, Executive Agencies must:
- AUse the federal Risk Management Framework (RMF)
- BEnsure security controls reduce risk
- CAuthorize system processing prior to operation
- DAuthorize systems each year to meet SP 800‐37 requirements
22Adequate Security is:
- ABased on the maximum harm to information
- BCommensurate with risk
- CRequired by law regardless of cost
- DCost effective, based on projected budgets
23In the Risk Management Framework as described in NIST SP 800‐37, what is the next task after “Information System Registration” called?
- ACommon Control Identification
- BSecurity Categorization
- CSecurity Control Selection
- DSecurity Control Implementation
24Which role has PRIMARY responsibility for ongoing remediation actions?
- ASecurity Control Assessor
- BInformation System Security Officer
- CAuthorizing Official
- DInformation System Owner
25Security Control Assessment tries to determine if the controls are
- ASelected from NIST SP 800‐53
- BIn compliance with NIST SP 800‐37
- CProducing the desired results or outcomes
- DMeeting the requirements from the Information Management Model (IMM)
26Which of the following terms are used in NIST SP 800‐60 to describe information that would have a serious impact on the operation of the organization if confidentiality were breached?
- AModerate because it concerns Confidentiality
- BHigh because it concerns Personally Identifiable Information (PII)
- CModerate because it concerns data sensitivity
- DHigh because it concerns Confidentiality
27What is the minimum frequency periodic testing and evaluation of the effectiveness of policies should be done?
- AQuarterly in accordance with (IAW) FISMA
- BEvery three years IAW OMB A‐130
- CWhenever the System Authorization process is ongoing
- DAnnually
28The primary reference for development of a System Security Plan is?
- ANIST SP 800-16
- BNIST SP 800-18
- CNIST SP 800-30
- DNIST SP 800-53
29NIST SP 800‐53A describes assessment objects as specific items to be assessed and includes the following: mechanisms; activities; individuals, and?
- AObjectives
- BSpecifications
- CProcedures
- DRequirements
30NIST SP 800‐53A identifies that the assessment methods that can be utilized by the Security Control Assessor include: interview; test, and?
- AExamine
- BDocumentation
- CScan
- DEvaluate
31In accordance with FIPS 199, what word is used to describe potential “LOW” impact items?
- ASerious
- BLimited
- Cminor
- DLow
32The security assessment plan provides:
- AThe detailed criteria that the Authorizing Official must use to select the Authorization decision.
- BThe objectives for the security control assessment and a detailed roadmap of how to conduct such an assessment.
- CThe objectives that the Information System Owner has establish to ensure that s/he has enough information to form a proper POA&M in accordance with OMB Memorandum 02‐01.
- DThe list of threats and vulnerabilities used in determining the correct level of risk and controls for the SSP.
33The main purpose of System Authorization is:
- AAcceptance and management of risk
- BTo maintain control of the Agency assets
- CReduction of risk to as low a level as possible
- DEnsure the Authoring Officials maintain operational control of systems
34Security control assessment is:
- AFormal acceptance of risk
- BUsed to select additional controls for the system prior to authorization
- CEvaluation of technical and non‐technical controls
- DValidation of test results
35NIST SP 800‐18, Guide for Developing Security Plans describes the purpose of a security plan is to provide an overview of the system requirements, and:
- AThe controls in place
- BSecurity operations to ensure it passes certification
- CHow configuration from phase three of the System Authorization process will be maintained
- DThe ongoing assessment of system security operations
36The goals of NIST SP 800‐39 include: encourage senior leaders to recognize the importance of engaging in the management of risk; encourage senior leaders to understand the role of information security in managing overall organization risk, and?
- AFoster an organizational climate where the risk from information systems is automatically considered on a system by system basis.
- BHelp individuals with information system implementation and operational responsibilities understand how the information security issues associated with their systems translate into organizational security concerns
- CEncourage senior leaders to manage risk on a system by system basis.
- DEnsure that the organization understands that the Risk Executive makes all risk decisions.
37You have just completed the final Security Assessment Report, which RMF Step and SDLC phase are you about to enter?
- ARMF Step 6, and the Operation/Maintenance phase.
- BRMF Step 5, and the Operations/Maintenance phase.
- CRMF Step 5, and the Implementation phase.
- DRMF Step 4, and the Development and Implementation phase.
38Title III of the E‐Government Act, known as the Federal Information Security Management Act (FISMA), states that effective information security programs include:
- APeriodic assessment of risk
- BUsers, Rules, and Responsibilities that ensure all compliance requirements are met
- CAn Information Protection Policy (IPP)
- DSecurity awareness training to inform personnel (except contractors) of the information security risks associated with their activities and their responsibilities in complying with organizations policies and procedures
39In accordance with NIST SP 800‐37, what follows the Implement Security Control step?
- ASelect Security Controls
- BAuthorize Information Systems
- CSystem Risk Assessment
- DAssess Security Controls
40Who serves as principal staff advisor to the Information System Owner on all matters involving the security of the information system?
- AInformation Security Architect
- BRisk Executive
- CInformation System Security Engineer
- DInformation System Security Officer
41As described by NIST SP 800-39, the Risk Executive’s role includes: promote the cooperation and collaboration among authorizing officials; provides senior leaders input and oversight for all risk management and information security activities, and?
- AAccept risk from operating information systems.
- BDetermines the common controls that should be implemented to address organizational risk.
- CIdentifies the overall risk posture based on the aggregated risk from each information system.
- DEnsures that the Information Security Architects integrate security into the tier 3.
42Who is responsible for ensuring that configuration and change control processes are followed?
- AAuthorizing Official
- BInformation System Security Engineer
- CInformation System Security Officer
- DInformation System Owner
43Which of the following is NOT evaluated as part of assessing security risk?
- AMonitor changes over time
- BPrioritize risks
- CAssess risk for each exposure
- DSystem threats
44Who is responsible for managing, coordinating, and overseeing all risk management activities, agency‐wide?
- ARisk Executive
- BChief Information Officer
- CInformation System Security Officer
- DChief Information Security Officer
45What does NIST SP 800‐39 provide as the two factors affecting trustworthiness of an information system?
- ASecurity functionality and security assurance
- BSecurity functionality and user awareness training
- CRisk management and user awareness training
- DRisk analysis and security assurance
46Which of the following should be the MAIN consideration when establishing a trust relationship between two information systems?
- ASystem Security Plan
- BSecurity Assessment Report
- CPlan of Action and Milestones
- DBusiness/Mission needs
47Who provides an independent assessment of the system security plan?
- ARisk Executive
- BInformation System Security Officer
- CAuthorizing Official
- DSecurity Control Assessor
48Who is responsible for identifying mission and operational requirements?
- AAuthorizing Official
- BAuthorization Official Designated Representative
- CInformation System Owner
- DSecurity Control Assessor
49 The federal Risk Management Framework has six steps, in Task 2-2, which roles are primary, and what is the SDLC phase?
- ACIO, CISO, CCP, and ISA; and the Initiate phase.
- BISO and ISA; and the Initiate phase.
- CISO and ISA; and the Development phase.
- DCIO, CISO, CCP, and ISA; and the Development phase
50Who is primarily responsible for supporting the System Authorization process during the Implementation phase of the SDLC?
- AInformation Security Architect
- BAuthorizing Official
- CSecurity Control Assessor
- DRisk Executive
51Ultimately, the responsibility for assurance that risks from the use of external service providers have been adequately mitigated remains with whom?
- AInformation System Owner
- BAuthorizing Officials
- CRisk Executive
- DSecurity Control Assessor
52To mitigate risk from the supply chain, a comprehensive information security strategy should be considered that employs a strategic, organization‐wide defense‐in‐breadth approach. Which of the following is suggested in NIST SP 800‐39 to assist in accomplishing this objective?
- AKnow the provenance of the information technology products and services provided by vendors and suppliers.
- BMaximize the time distance between decisions to purchase information products and services and the time of delivery to ensure the product testing can be completed.
- CUse a single vendor’s products to reduce the chance of misconfiguration and additional training costs.
- DUse information technology products provided by the lowest priced vendors to allow for the purchase of additional controls and provide better overall coverage.
53The process to tailor security controls includes?
- AEnsuring that the information system has been properly categorized.
- BEnsuring that the security controls can be assessed.
- CEnsuring that all security controls have been properly allocated.
- DProviding additional specification information for control implementation, if needed.
54Assessment procedures can be tailored by:
- AWorking with the System Engineer to determine the system requirement and selecting the most cost‐effective controls prior to each security control assessment.
- BConfiguring the security controls within the limitations of the optimum operational system configuration.
- CSelecting the assessment methods and objects needed to most cost‐effectively make appropriate determinations and to satisfy assessment objectives.
- DFocusing the tests by limiting the tests to areas where the System Owner indicates that risk is either extreme or unknown.
55The NIST SP 800‐37 process allows for security control assessment as which RMF Task?
- ATask 3-1
- BTask 3-2
- CTask 4-1
- DTask 4-2
56NIST SP 800‐39 provides several ways to address risk. Which of the following most closely represents the concept of “Risk Acceptance”?
- ASystem Authorization
- BSecurity Control Implementation
- CAssessment of Security Control
- DContinuous Monitoring
57Which of the following match of the possible primary role, RMF Step, and primary publication is possible?
- ARisk Executive, RMF Step 6, SP 800-37
- BChief Information Security Officer, RMF Step 6, SP 800-137
- CAuthorization Official, RMF Step 6, SP 800-18
- DInformation System Owner, RMF Step 6, SP 800-88
5855. What term does FIPS 199 and NIST SP 800‐60 use to describe a threat that has a HIGH impact?
- ASerious
- BLimited
- CModerate
- DSevere
59Which reference describes what should be contained in a POA&M?
- AOMB M 02‐11
- BOMB M 02‐03
- CNIST SP 800‐37 Rev 1
- DOMB M 02‐01
60In accordance with NIST SP 800‐59, a National Security System must meet which one of the following criteria?
- ACritical to the direct fulfillment of military or intelligence missions
- BCritical to function of government
- CCritical to the support functions of military operations
- DCritical to the support of the strategic goals of the United States
61NIST SP 800‐39 proscribes that the assessor’s findings should be:
- AFactual and unbiased
- BTechnically focused and detailed
- COnly documented with System Owner agreement
- DAssessed in accordance with SP 800‐30 procedures
62OMB’s Business Reference Model (BRM) describes four business areas containing 39 types of information. Which of the following roles will be the PRIMARY user of this reference?
- AInformation System Owner as part of the FIPS 199 analysis
- BInformation Owner as part of the NIST SP 800‐60 analysis
- CAuthorization Official as part of the FIPS 199 analysis
- DSecurity Control Assessor as part of the NIST SP 800-115 analysis
63Personally Identifiable Information will be categorized at what minimum level?
- AModerate of Integrity
- BHigh for Confidentiality
- CHigh for Integrity
- DModerate for Confidentiality
64During the SP 800‐60 analysis, which two values are considered by the security objectives?
- AData sensitivity, and information criticality
- BInformation sensitivity, and data criticality
- CInformation sensitivity, and criticality
- DData sensitivity, and criticality
65When doing cost‐benefit analysis for proposed new controls or enhanced controls, which of the following is NOT considered?
- ADetermining the impact of implementing the new or enhanced controls
- BDetermining the impact of NOT implementing the new or enhanced controls
- CEstimating the length of time to implement the new or enhanced controls
- DEstimating the costs of the implementation
66Residual risk can be defined as:
- AThe risk remaining after the implementation of new or enhanced controls
- BThe risk level determined before adjusting the security control baseline
- CThe risk level determined during the control analysis phase of the risk assessment process
- DThe risk remaining after common controls are implemented
67During the FIPS 199 analysis the Information System Owner determines the system High Water Mark. How is the high water mark used in the system authorization process?
- AIt establishes the minimum controls that MUST be employed to protect the information system
- BIt establishes the scoping guidance
- CIt provides the proposed control set found in NIST SP 800‐53
- DIt establishes the final control set after tailoring the security controls
68What risk management activity occurs during the Implementation phase of the System Development Life Cycle?
- ARisk management supports the assessment of the system implementation against the requirements
- BRisk management provides a detailed list of required controls
- CRisk management supports the ongoing analysis of the system operations and maintenance
- DRisk management activities are performed against system components prior to disposal
69What is the definition of a threat?
- AThe magnitude of harm that can be expected to result.
- BA specific category of information.
- CA condition that exists within an organization
- DAny circumstance or event with the potential to create adverse impacts
70Which organization created the FISMA requirement requiring System Authorization?
- AThe White House
- BDISA
- CDepartment of Defense
- DCongress
71Security commensurate with risk, including the magnitude of harm, defines:
- ARisk Analysis
- BAdequate Security
- CControl Threshold
- DRisk Based Security
72Which of the following is required by OMB A‐130?
- ACertification and Accreditation at least every three years
- BSecurity Control Selection
- CInformation Assurance (IA) Training and Certification
- DFISMA reporting
73In accordance with (IAW) NIST SP 800‐64, which of the following is NOT part of the System Development Life Cycle?
- AImplementation Phase
- BProgram Startup Phase
- CDisposition Phase
- DOperations/Maintenance Phase
74When considering risk from an organizational perspective, what is the correct order of these steps?
I. Authorize Information Systems
II. Categorize Information Systems
III. Implement Security Controls
IV. Assess Security Controls
V. Monitor Security State
VI. Select Security Controls- AVI, III, I, II, IV, V
- BI, II, III, VI, V, IV
- CII, VI, III, IV, I, V
- DVI, III, I, II, V, IV
75Compensating controls are:
- AUsed in place of, or to augment, specific controls
- BUsed because they are common controls
- CUsed because they are specific controls
- DUsed because they are usually less expensive
76NIST SP 800‐37 provides a process for:
- ACertifying Department of Defense networks
- BComplying with FISMA reporting requirements
- CSecurity Categorization of systems
- DSystem Authorization
77What is the purpose of scoping guidance?
- ATo establish which controls will not part of the baseline and need not be tailored
- BTo establish the organizationally defined security parameters
- CTo establish the low water mark as part of FIPS 199 analysis
- DTo establish and express guidance on tailoring the security control baseline
78What is the PRIMARY purpose of System Authorization?
- AComply with Public Law 107‐347 requirements.
- BUpdate the SSP for FISMA reporting.
- CFormal management acceptance of risk and permission to operate the system
- DThe testing of technical and non‐technical controls.
79Which of these are characteristics considered when conducting NIST SP 800‐60 analysis?
I. Interfacing Mode
II. Processing Mode
III. Availability
IV. Confidentiality
V. Integrity
VI. Information Categories- AV, IV, III, I
- BI, II, III, IV
- CV, III, IV
- DVI, III, I, IV
80Which of the following are authorization decisions that can be issued by the authorizing official in the Authorization Decision Document?
- AAuthorization to Operate
- BAuthorization to Test
- CInterim Approval to Connect
- DAuthorization Renewal
81FIPS PUB 199, Standards for Security Categorization uses the word to describe potential impact of LOW.
- ASerious
- BSevere
- CLimited
- DSignificant
82Who has responsibility for ensuring that the System Categorization is correctly established?
- AInformation System Owner
- BInformation Owner
- CAuthorizing Official
- DInformation System Security Officer
83The intent of risk management is to identify potential problems:
- ABefore they occur
- BTo Avoid Risk
- CTo ensure risk is fully funded in accordance with (IAW) FISMA
- DTo ensure risk is considered in the Information Assurance Technical Framework (IATF)
84Who performs the initial risk assessment in RMF Step 1?
- AInformation System Owner
- BInformation System Security Officer
- CInformation Owner
- DInformation System Security Engineer
85What is the purpose of the FIPS 199 “Low Water Mark”?
- ATo provide the minimum controls to protect the system itself.
- BTo define the information system baseline security controls.
- CTo mandate the common controls for a system.
- DTo provide the counter‐balance for the High Water Mark.
86Who has the responsibility to provide the resources required for the security control assessment?
- AChief Information Officer
- BAuthorizing Official
- CInformation System Security Officer
- DInformation System Owner
87What potential role does aggregation play in the system categorization process?
- AIt is the same as the information categorization for the system
- BIt could cause the system to be categorized higher than any of the data on the system
- CIt is the same as the low water mark on systems that have no data stored on them
- DIt ensures the availability of the system during peak times
88Which of the following roles reviews the reports provided by the Information System Security Officer once the System Authorization has been granted?
- AChief Information Security Officer
- BInformation Owner
- CInformation Security Architect
- DAuthorizing Official
89From a system authorization perspective, why are potential system software patches tested prior to deployment?
- ATo identify potential security impacts that may be caused by the patch
- BTo ensure that the system documentation is current with the changes
- CTo support long‐term investments
- DTo comply with Public Law 107‐347
90Why is configuration management a concern during the continuous monitoring phase of NIST SP 800‐37?
- ATo ensure that risks from new threats can be evaluated.
- BTo ensure that the IT section can properly be staffed during less critical times.
- CTo provide direct support to the Continuity of Operations plan.
- DTo support the IT enterprise architecture plan.
91NIST SP 800-55 defines key performance measures as?
- AMeasures of compliance, measures of effectiveness, and measures of efficiency.
- BMeasures of compliance, measures of effectiveness, and impact measures.
- CMeasures of effectiveness, measures of efficiency, and measures of performance.
- DMeasures of effectiveness, measures of efficiency, and impact measures.
92During the Continuous Monitoring Phase of NIST SP 800‐37, which of the following is NOT being monitored by the Information System Security Officer?
- AAre the controls implemented correctly?
- BAre the controls operating as intended?
- CAre the controls producing the desired outcome?
- DAre the controls operating within the established budget?
93Why might the POA&M need to be updated when the system completes security control testing?
- ANew vulnerabilities might have been identified that could not be corrected prior to the authorization decision.
- BThe SSP might have been lost and the POA&M is the only document remaining.
- CThe POA&M might have new controls that were installed during testing.
- DA decrease in system risk may require updating of the risk assessment data
94Which of the following is a goal of Public Law 107‐347?
- AReduce cost of security controls.
- BCompartmentalization of security information to increase security within departments of the government.
- CEnsure that Authorizing Officials do not have budgetary authority over the systems they provide authorization decisions for thus preventing a conflict of interest.
- DComplete, reliable, and trustworthy information for Authorizing Officials.
95Public Law 107‐347 states that re‐accreditation of a system is NOT required:
- AWhen federal or agency policy waives the requirement
- BWhen the Information System Owner determines that any system configuration changes are not significant
- CWhen continuous monitoring reports indicate that the residual risk remains within the acceptable range
- DAfter a significant change to the operational environment
96Which of the following roles should NEVER be combined with the role of Authorizing Official?
- ACertification Agent
- BInformation System Owner
- CChief Executive Officer
- DChief Information Officer
97The Authoring Official’s Designated Representative is not allowed to do which of the following?
- APrepare the accreditation decision letter
- BObtain the Authorizing Official’s signature
- CRecommend the terms and conditions
- DSign the authorization decision letter
98Information is categorized using NIST SP 800‐60 based on:
- AMission impact
- BWhere the system is located
- CCost to create the information
- DNumber of users that access the information
99Trade Secrets are categorized as:
- AModerate for availability
- BModerate for confidentiality
- CModerate for integrity
- DHigh for confidentiality
100Specific controls are often designated by:
- AChief Information Officer
- BInformation System Security Engineer
- CInformation System Owner
- DInformation Security Architect
101In accordance with NIST SP 800‐53, the security control classes are based on?
- AOperational, Management, and Technical
- BAdministrative, Technical, and Physical
- CManagement, Technical, and Physical
- DManagement, Operating, and Technical
102NIST SP 800‐53 describes a family of controls as:
- AA grouping of like controls covering the same subject
- BA grouping of controls that provides a complete protection package for a system
- CA grouping of control tests that form assessment procedures
- DA grouping of interoperating controls from all three classes of controls
103Organizations are encouraged to develop a broad‐based, organization‐wide strategy for conducting security assessments, facilitating more cost‐effective and consistent assessments across the inventory of information systems. Which of the following is FALSE when considering how to accomplish this objective?
- AAn organization‐wide strategy begins by applying the initial steps of the Risk Management Framework
- BWith an organizational view of the security categorization process.
- CMaximizing the number of common controls employed within an organization.
- DThe Risk Management Framework cannot be used on multiple systems.
Information
- Description
- Quiz on CAP 101, created by Luis EZ on 01/03/2017.
- Author
- Luis EZ
- Language
- English
- Views
- 1
- History
- Created on 1 Mar 2017 · updated on 26 Apr 2017
- Tags
- Rating
- No ratings yet Rate this quiz