Test
CAP DC
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (121)
1Which one the following roles is responsible for testing the non‐technical controls in an information system?
- AAuthorizing Official
- BSecurity Control Assessor
- CDesignated Representative
- DInformation System Owner
2Which reference provides detailed guidance on risk mitigation for the State Department?
- ASP 800‐37 Federal Risk Management Framework
- BSP 800‐30 Risk Assessment
- CSP 800‐39 Organization-Wide Risk Management for Information Systems
- DSP 800‐53 Security and Privacy Controls for Federal Information Systems and Organizations
3Which of the following roles has the responsibility to ensure that the enterprise architecture supports the mission and business processes?
- AInformation Security Architect
- BInformation System Security Engineer
- CCommon Control Provider
- DRisk Executive
4During which step of the Risk Management Framework (RMF) does the Information System Owner register the information system?
- ASelect Security Controls
- BImplement Security Controls
- CAuthorize Information System
- DCategorize Information System
5Who signs the authorization decision letter?
- AAuthorizing Official
- BChief Executive Officer
- CDesignated Representative
- DInformation System Owner
6 A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source is the definition of which key term?
- APredisposing Condition
- BThreat
- CRisk Determination
- DVulnerability
7Who procures, develops, integrates, or modifies an information system?
- AProgram Manager
- BChief Information Officer
- CCertification Program Manager
- DInformation System Owner
8Who develops and maintains information security policies, procedures, and control techniques to address all applicable requirements?
- AAuthorizing Official
- BChief Information Officer
- CChief Executive Officer
- DInformation System Owner
9Who has the responsibility to prepare the plan of action and milestones based on the findings and recommendations of the security assessment report?
- ASecurity Control Assessor
- BCommon Control Provider
- CAuthorizing Official
- DInformation Owner/Steward
10You have just completed the Risk Assessment defined by NIST SP 800‐30. What reference identifies the risk management strategy alternatives that can be applied to the information system?
- ANIST SP 800‐47
- BNIST SP 800‐39
- CNIST SP 800‐53
- DNIST SP 800‐30
11In which phase of the NIST SP 800‐30 process does one produce the Risk Assessment Report (RAR)?
- AStep 1
- BStep 2
- CStep 3
- DStep 4
12Which step of the NIST SP 800‐30 process would most likely identify the CVE database as a risk assessment information source?
- AStep 1
- BStep 2
- CStep 3
- DStep 4
13Organizations should view assessments as an information gathering activity, not as a security producing activity. In accordance with NIST SP 800‐53A, security control assessments create the following benefits: identify potential problems or shortfalls in the organization’s implementation of the NIST Risk Management Framework; support budgetary decisions and capital investment processes, and:
- ACorrect identified weaknesses and deficiencies.
- BSupport information system authorization decisions.
- CProvide a mechanism to hold the Information System Security Officer accountable.
- DProvides an opportunity to authorize the system without further action.
14The last step in the Risk Assessment process model is called?
- AManage
- BMonitor
- CMaintain
- DModify
15When using NIST SP 800‐53A, during which SDLC phase are security assessments used to increase confidence or assurance that the security controls are working correctly for a system?
- ADevelopment and Implementation
- BDevelopment only
- COperations and Maintenance
- DDevelopment, Implementation, and Operations and Maintenance
16Which of these is a valid response to address risk?
- AResearch and Engineering
- BAcquisition Management
- CSecurity Control Assessment
- DAccept the risk to the system
17OMB Circular A‐130 states information security must:
- ABe risk-based, and cost effective
- BReduce risk to acceptable levels as determined by the System Owner
- CEliminate risk
- DReduce risk to negligible levels
18In accordance with Public Law 107‐347, Executive Agencies must:
- AUse the federal Risk Management Framework (RMF)
- BEnsure security controls reduce risk
- CAuthorize system processing prior to operation
- DAuthorize systems each year to meet SP 800‐37 requirements
19Adequate Security is:
- ABased on the maximum harm to information
- BCommensurate with risk
- CRequired by law regardless of cost
- DCost effective, based on projected budgets
20In the Risk Management Framework as described in NIST SP 800‐37, what is the next task after “Information System Registration” called?
- ACommon Control Identification
- BSecurity Categorization
- CSecurity Control Selection
- DSecurity Control Implementation
21Which role has PRIMARY responsibility for ongoing remediation actions?
- ASecurity Control Assessor
- BInformation System Security Officer
- CAuthorizing Official
- DInformation System Owner
22Security Control Assessment tries to determine if the controls are
- ASelected from NIST SP 800‐53
- BIn compliance with NIST SP 800‐37
- CProducing the desired results or outcomes
- DMeeting the requirements from the Information Management Model (IMM)
23Which of the following terms are used in NIST SP 800‐60 to describe information that would have a serious impact on the operation of the organization if confidentiality were breached?
- AModerate because it concerns Confidentiality
- BHigh because it concerns Personally Identifiable Information (PII)
- CModerate because it concerns data sensitivity
- DHigh because it concerns Confidentiality
24What is the minimum frequency periodic testing and evaluation of the effectiveness of policies should be done?
- AQuarterly in accordance with (IAW) FISMA
- BEvery three years IAW OMB A‐130
- CWhenever the System Authorization process is ongoing
- DAnnually
25The primary reference for development of a System Security Plan is?
- ANIST SP 800-16
- BNIST SP 800-18
- CNIST SP 800-30
- DNIST SP 800-53
26NIST SP 800‐53A describes assessment objects as specific items to be assessed and includes the following: mechanisms; activities; individuals, and?
- AObjectives
- BSpecifications
- CProcedures
- DRequirements
27NIST SP 800‐53A identifies that the assessment methods that can be utilized by the Security Control Assessor include: interview; test, and?
- AExamine
- BDocumentation
- CScan
- DEvaluate
28In accordance with FIPS 199, what word is used to describe potential “LOW” impact items?
- ASerious
- BLimited
- CMinor
- DLow
29The security assessment plan provides:
- AThe detailed criteria that the Authorizing Official must use to select the Authorization decision.
- BThe objectives for the security control assessment and a detailed roadmap of how to conduct such an assessment.
- CThe objectives that the Information System Owner has establish to ensure that s/he has enough information to form a proper POA&M in accordance with OMB Memorandum 02‐01.
- DThe list of threats and vulnerabilities used in determining the correct level of risk and controls for the SSP.
30The main purpose of System Authorization is:
- AAcceptance and management of risk
- BTo maintain control of the Agency assets
- CReduction of risk to as low a level as possible
- DEnsure the Authoring Officials maintain operational control of systems
31Security control assessment is:
- AFormal acceptance of risk
- BUsed to select additional controls for the system prior to authorization
- CEvaluation of technical and non‐technical controls
- DValidation of test results
32NIST SP 800‐18, Guide for Developing Security Plans describes the purpose of a security plan is to provide an overview of the system requirements, and:
- AThe controls in place
- BSecurity operations to ensure it passes certification
- CHow configuration from phase three of the System Authorization process will be maintained
- DThe ongoing assessment of system security operations
33The goals of NIST SP 800‐39 include: encourage senior leaders to recognize the importance of engaging in the management of risk; encourage senior leaders to understand the role of information security in managing overall organization risk, and?
- AFoster an organizational climate where the risk from information systems is automatically considered on a system by system basis.
- BHelp individuals with information system implementation and operational responsibilities understand how the information security issues associated with their systems translate into organizational security concerns
- CEncourage senior leaders to manage risk on a system by system basis.
- DEnsure that the organization understands that the Risk Executive makes all risk decisions.
34You have just completed the final Security Assessment Report, which RMF Step and SDLC phase are you about to enter?
- ARMF Step 6, and the Operation/Maintenance phase.
- BRMF Step 5, and the Operations/Maintenance phase.
- CRMF Step 5, and the Implementation phase.
- DRMF Step 4, and the Development and Implementation phase.
35Title III of the E‐Government Act, known as the Federal Information Security Management Act (FISMA), states that effective information security programs include:
- APeriodic assessment of risk
- BUsers, Rules, and Responsibilities that ensure all compliance requirements are met
- CAn Information Protection Policy (IPP)
- DSecurity awareness training to inform personnel (except contractors) of the information security risks associated with their activities and their responsibilities in complying with organizations policies and procedures
36In accordance with NIST SP 800‐37, what follows the Implement Security Control step?
- ASelect Security Controls
- BAuthorize Information Systems
- CSystem Risk Assessment
- DAssess Security Controls
37Who serves as principal staff advisor to the Information System Owner on all matters involving the security of the information system?
- AInformation Security Architect
- BRisk Executive
- CInformation System Security Engineer
- DInformation System Security Officer
38As described by NIST SP 800-39, the Risk Executive’s role includes: promote the cooperation and collaboration among authorizing officials; provides senior leaders input and oversight for all risk management and information security activities, and?
- AAccept risk from operating information systems.
- BDetermines the common controls that should be implemented to address organizational risk.
- CIdentifies the overall risk posture based on the aggregated risk from each information system.
- DEnsures that the Information Security Architects integrate security into the tier 3.
39Who is responsible for ensuring that configuration and change control processes are followed?
- AAuthorizing Official
- BInformation System Security Engineer
- CInformation System Security Officer
- DInformation System Owner
40Which of the following is NOT evaluated as part of assessing security risk?
- AMonitor changes over time
- BPrioritize risks
- CAssess risk for each exposure
- DSystem threats
41Who is responsible for managing, coordinating, and overseeing all risk management activities, agency‐wide?
- ARisk Executive
- BChief Information Officer
- CInformation System Security Officer
- DChief Information Security Officer
42What does NIST SP 800‐39 provide as the two factors affecting trustworthiness of an information system?
- ASecurity functionality and security assurance
- BSecurity functionality and user awareness training
- CRisk management and user awareness training
- DRisk analysis and security assurance
43Which of the following should be the MAIN consideration when establishing a trust relationship between two information systems?
- ASystem Security Plan
- BSecurity Assessment Report
- CPlan of Action and Milestones
- DBusiness/Mission needs
44Who provides an independent assessment of the system security plan?
- ARisk Executive
- BInformation System Security Officer
- CAuthorizing Official
- DSecurity Control Assessor
45Who is responsible for identifying mission and operational requirements?
- AAuthorizing Official
- BAuthorization Official Designated Representative
- CInformation System Owner
- DSecurity Control Assessor
46 The federal Risk Management Framework has six steps, in Task 2-2, which roles are primary, and what is the SDLC phase?
- ACIO, CISO, CCP, and ISA; and the Initiate phase.
- BISO and ISA; and the Initiate phase.
- CISO and ISA; and the Development phase.
- DCIO, CISO, CCP, and ISA; and the Development phase
47Who is primarily responsible for supporting the System Authorization process during the Implementation phase of the SDLC?
- AInformation Security Architect
- BAuthorizing Official
- CSecurity Control Assessor
- DRisk Executive
48Ultimately, the responsibility for assurance that risks from the use of external service providers have been adequately mitigated remains with whom?
- AInformation System Owner
- BAuthorizing Officials
- CRisk Executive
- DSecurity Control Assessor
49To mitigate risk from the supply chain, a comprehensive information security strategy should be considered that employs a strategic, organization‐wide defense‐in‐breadth approach. Which of the following is suggested in NIST SP 800‐39 to assist in accomplishing this objective?
- AKnow the provenance of the information technology products and services provided by vendors and suppliers.
- BMaximize the time distance between decisions to purchase information products and services and the time of delivery to ensure the product testing can be completed.
- CUse a single vendor’s products to reduce the chance of misconfiguration and additional training costs.
- DUse information technology products provided by the lowest priced vendors to allow for the purchase of additional controls and provide better overall coverage.
50The process to tailor security controls includes?
- AEnsuring that the information system has been properly categorized.
- BEnsuring that the security controls can be assessed.
- CEnsuring that all security controls have been properly allocated.
- DProviding additional specification information for control implementation, if needed.
51Assessment procedures can be tailored by:
- AWorking with the System Engineer to determine the system requirement and selecting the most cost‐effective controls prior to each security control assessment.
- BConfiguring the security controls within the limitations of the optimum operational system configuration.
- CSelecting the assessment methods and objects needed to most cost‐effectively make appropriate determinations and to satisfy assessment objectives.
- DFocusing the tests by limiting the tests to areas where the System Owner indicates that risk is either extreme or unknown.
52The NIST SP 800‐37 process allows for security control assessment as which RMF Task?
- ATask 3-1
- BTask 3-2
- CTask 4-1
- DTask 4-2
53NIST SP 800‐39 provides several ways to address risk. Which of the following most closely represents the concept of “Risk Acceptance”?
- ASystem Authorization
- BSecurity Control Implementation
- CAssessment of Security Control
- DContinuous Monitoring
54Which of the following match of the possible primary role, RMF Step, and primary publication is possible?
- ARisk Executive, RMF Step 6, SP 800-37
- BChief Information Security Officer, RMF Step 6, SP 800-137
- CAuthorization Official, RMF Step 6, SP 800-18
- DInformation System Owner, RMF Step 6, SP 800-88
55What term does FIPS 199 and NIST SP 800‐60 use to describe a threat that has a HIGH impact?
- ASerious
- BLimited
- CModerate
- DSevere
56Which reference describes what should be contained in a POA&M?
- AOMB M 02‐11
- BOMB M 02‐03
- CNIST SP 800‐37 Rev 1
- DOMB M 02‐01
57In accordance with NIST SP 800‐59, a National Security System must meet which one of the following criteria?
- ACritical to the direct fulfillment of military or intelligence missions
- BCritical to function of government
- CCritical to the support functions of military operations
- DCritical to the support of the strategic goals of the United States
58NIST SP 800‐39 proscribes that the assessor’s findings should be:
- AFactual and unbiased
- BTechnically focused and detailed
- COnly documented with System Owner agreement
- DAssessed in accordance with SP 800‐30 procedures
59OMB’s Business Reference Model (BRM) describes four business areas containing 39 types of information. Which of the following roles will be the PRIMARY user of this reference?
- AInformation System Owner as part of the FIPS 199 analysis
- BInformation Owner as part of the NIST SP 800‐60 analysis
- CAuthorization Official as part of the FIPS 199 analysis
- DSecurity Control Assessor as part of the NIST SP 800-115 analysis
60Personally Identifiable Information will be categorized at what minimum level?
- AModerate of Integrity
- BHigh for Confidentiality
- CHigh for Integrity
- DModerate for Confidentiality
61During the SP 800‐60 analysis, which two values are considered by the security objectives?
- AData sensitivity, and information criticality
- BInformation sensitivity, and data criticality
- CInformation sensitivity, and criticality
- DData sensitivity, and criticality
62When doing cost‐benefit analysis for proposed new controls or enhanced controls, which of the following is NOT considered?
- ADetermining the impact of implementing the new or enhanced controls
- BDetermining the impact of NOT implementing the new or enhanced controls
- CEstimating the length of time to implement the new or enhanced controls
- DEstimating the costs of the implementation
63Residual risk can be defined as:
- AThe risk remaining after the implementation of new or enhanced controls
- BThe risk level determined before adjusting the security control baseline
- CThe risk level determined during the control analysis phase of the risk assessment process
- DThe risk remaining after common controls are implemented
64During the FIPS 199 analysis the Information System Owner determines the system High Water Mark. How is the high water mark used in the system authorization process?
- AIt establishes the minimum controls that MUST be employed to protect the information system
- BIt establishes the scoping guidance
- CIt provides the proposed control set found in NIST SP 800‐53
- DIt establishes the final control set after tailoring the security controls
65What risk management activity occurs during the Implementation phase of the System Development Life Cycle?
- ARisk management supports the assessment of the system implementation against the requirements
- BRisk management provides a detailed list of required controls
- CRisk management supports the ongoing analysis of the system operations and maintenance
- DRisk management activities are performed against system components prior to disposal
66What is the definition of a threat?
- AThe magnitude of harm that can be expected to result.
- BA specific category of information.
- CA condition that exists within an organization
- DAny circumstance or event with the potential to create adverse impacts
67Which organization created the FISMA requirement requiring System Authorization?
- AThe White House
- BDISA
- CDepartment of Defense
- DCongress
68Security commensurate with risk, including the magnitude of harm, defines:
- ARisk Analysis
- BAdequate Security
- CControl Threshold
- DRisk Based Security
69Which of the following is required by OMB A‐130?
- ACertification and Accreditation at least every three years
- BSecurity Control Selection
- CInformation Assurance (IA) Training and Certification
- DFISMA reporting
70In accordance with (IAW) NIST SP 800‐64, which of the following is NOT part of the System Development Life Cycle?
- AImplementation Phase
- BProgram Startup Phase
- CDisposition Phase
- DOperations/Maintenance Phase
71When considering risk from an organizational perspective, what is the correct order of these steps?
I. Authorize Information Systems
II. Categorize Information Systems
III. Implement Security Controls
IV. Assess Security Controls
V. Monitor Security State
VI. Select Security Controls- AVI, III, I, II, IV, V
- BI, II, III, VI, V, IV
- CII, VI, III, IV, I, V
- DVI, III, I, II, V, IV
72Compensating controls are:
- AUsed in place of, or to augment, specific controls
- BUsed because they are common controls
- CUsed because they are specific controls
- DUsed because they are usually less expensive
73NIST SP 800‐37 provides a process for:
- ACertifying Department of Defense networks
- BComplying with FISMA reporting requirements
- CSecurity Categorization of systems
- DSystem Authorization
74What is the purpose of scoping guidance?
- ATo establish which controls will not part of the baseline and need not be tailored
- BTo establish the organizationally defined security parameters
- CTo establish the low water mark as part of FIPS 199 analysis
- DTo establish and express guidance on tailoring the security control baseline
75What is the PRIMARY purpose of System Authorization?
- AComply with Public Law 107‐347 requirements.
- BUpdate the SSP for FISMA reporting.
- CFormal management acceptance of risk and permission to operate the system
- DThe testing of technical and non‐technical controls.
76Which of these are characteristics considered when conducting NIST SP 800‐60 analysis?
I. Interfacing Mode
II. Processing Mode
III. Availability
IV. Confidentiality
V. Integrity
VI. Information Categories- AV, IV, III, I
- BI, II, III, IV
- CV, III, IV
- DVI, III, I, IV
77Which of the following are authorization decisions that can be issued by the authorizing official in the Authorization Decision Document?
- AAuthorization to Operate
- BAuthorization to Test
- CInterim Approval to Connect
- DAuthorization Renewal
78FIPS PUB 199, Standards for Security Categorization uses the word to describe potential impact of LOW.
- ASerious
- BSevere
- CLimited
- DSignificant
79Who has responsibility for ensuring that the System Categorization is correctly established?
- AInformation System Owner
- BInformation Owner
- CAuthorizing Official
- DInformation System Security Officer
80The intent of risk management is to identify potential problems:
- ABefore they occur
- BTo Avoid Risk
- CTo ensure risk is fully funded in accordance with (IAW) FISMA
- DTo ensure risk is considered in the Information Assurance Technical Framework (IATF)
81Who performs the initial risk assessment in RMF Step 1?
- AInformation System Owner
- BInformation System Security Officer
- CInformation Owner
- DInformation System Security Engineer
82What is the purpose of the FIPS 199 “Low Water Mark”?
- ATo provide the minimum controls to protect the system itself.
- BTo define the information system baseline security controls.
- CTo mandate the common controls for a system.
- DTo provide the counter‐balance for the High Water Mark.
83Who has the responsibility to provide the resources required for the security control assessment?
- AChief Information Officer
- BAuthorizing Official
- CInformation System Security Officer
- DInformation System Owner
84What potential role does aggregation play in the system categorization process?
- AIt is the same as the information categorization for the system
- BIt could cause the system to be categorized higher than any of the data on the system
- CIt is the same as the low water mark on systems that have no data stored on them
- DIt ensures the availability of the system during peak times
85Which of the following roles reviews the reports provided by the Information System Security Officer once the System Authorization has been granted?
- AChief Information Security Officer
- BInformation Owner
- CInformation Security Architect
- DAuthorizing Official
86From a system authorization perspective, why are potential system software patches tested prior to deployment?
- ATo identify potential security impacts that may be caused by the patch
- BTo ensure that the system documentation is current with the changes
- CTo support long‐term investments
- DTo comply with Public Law 107‐347
87Why is configuration management a concern during the continuous monitoring phase of NIST SP 800‐37?
- ATo ensure that risks from new threats can be evaluated.
- BTo ensure that the IT section can properly be staffed during less critical times.
- CTo provide direct support to the Continuity of Operations plan.
- DTo support the IT enterprise architecture plan.
88NIST SP 800-55 defines key performance measures as?
- AMeasures of compliance, measures of effectiveness, and measures of efficiency.
- BMeasures of compliance, measures of effectiveness, and impact measures.
- CMeasures of effectiveness, measures of efficiency, and measures of performance.
- DMeasures of effectiveness, measures of efficiency, and impact measures.
89During the Continuous Monitoring Phase of NIST SP 800‐37, which of the following is NOT being monitored by the Information System Security Officer?
- AAre the controls implemented correctly?
- BAre the controls operating as intended?
- CAre the controls producing the desired outcome?
- DAre the controls operating within the established budget?
90Why might the POA&M need to be updated when the system completes security control testing?
- ANew vulnerabilities might have been identified that could not be corrected prior to the authorization decision.
- BThe SSP might have been lost and the POA&M is the only document remaining.
- CThe POA&M might have new controls that were installed during testing.
- DA decrease in system risk may require updating of the risk assessment data.
91Which of the following is a goal of Public Law 107‐347?
- AReduce cost of security controls.
- BCompartmentalization of security information to increase security within departments of the government.
- CEnsure that Authorizing Officials do not have budgetary authority over the systems they provide authorization decisions for thus preventing a conflict of interest.
- DComplete, reliable, and trustworthy information for Authorizing Officials.
92Public Law 107‐347 states that re‐accreditation of a system is NOT required:
- AWhen federal or agency policy waives the requirement
- BWhen the Information System Owner determines that any system configuration changes are not significant
- CWhen continuous monitoring reports indicate that the residual risk remains within the acceptable range
- DAfter a significant change to the operational environment
93Which of the following roles should NEVER be combined with the role of Authorizing Official?
- ACertification Agent
- BInformation System Owner
- CC. Chief Executive Officer
- DChief Information Officer
94The Authoring Official’s Designated Representative is not allowed to do which of the following?
- APrepare the accreditation decision letter
- BObtain the Authorizing Official’s signature
- CRecommend the terms and conditions
- DSign the authorization decision letter
95Information is categorized using NIST SP 800‐60 based on:
- AMission impact
- BWhere the system is located
- CCost to create the information
- DNumber of users that access the information
9696. Trade Secrets are categorized as:
- AA. Moderate for availability
- BB. Moderate for confidentiality
- CC. Moderate for integrity
- DD. High for confidentiality
9797. Specific controls are often designated by:
- AA. Chief Information Officer
- BB. Information System Security Engineer
- CC. Information System Owner
- DD. Information Security Architect
98In accordance with NIST SP 800‐53, the security control classes are based on?
- AOperational, Management, and Technical
- BAdministrative, Technical, and Physical
- CManagement, Technical, and Physical
- DManagement, Operating, and Technical
99NIST SP 800‐53 describes a family of controls as:
- AA grouping of like controls covering the same subject
- BA grouping of controls that provides a complete protection package for a system
- CA grouping of control tests that form assessment procedures
- DA grouping of interoperating controls from all three classes of controls
100Organizations are encouraged to develop a broad‐based, organization‐wide strategy for conducting security assessments, facilitating more cost‐effective and consistent assessments across the inventory of information systems. Which of the following is FALSE when considering how to accomplish this objective?
- AAn organization‐wide strategy begins by applying the initial steps of the Risk Management Framework
- BWith an organizational view of the security categorization process.
- CMaximizing the number of common controls employed within an organization.
- DThe Risk Management Framework cannot be used on multiple systems.
101Subsequent to a security breach, which of the following techniques are used with the intention to limit the extent of damage caused by the incident?
- ACorrective controls
- BPreventive controls
- CChange controls
- DIncident controls
102What is RMF?
- ARisk Manager Framework
- BRisk Management Framework
- CRequired Management Framework
103Where does the federal requirements for Categorization come from?
- AFederal Information Processing Standard Publication 200: Minimum Security Requirements for Federal Information and Information Systems
- BNational Institute of Standards and Technology: Recommended Security Controls for Federal Information Systems
- CFederal Information Processing Standard Publication 199: Standards for Security Categorization of Federal Information and Information Systems
104A loss of _________________ is the unauthorized disclosure of information.
- AIntegrity
- BConfidentiality
- CAvailability
105A loss of _________________ is the unauthorized modification or destruction of information.
- AIntegrity
- BConfidentiality
- CAvailability
106A loss of _________ is the disruption of access to or use of information or an information system.
- AIntegrity
- BConfidentiality
- CAvailability
107What are the three impact values?
- ALow-Moderate-High
- BLow-Medium-High
- CLow-Medium-Critical
108In an impact level, _____ Loss of CIA could have a severe or catastrophic adverse effect on organizational operations/assets/individuals
- AHigh
- BModerate
- CMedium
109 Which factor does an organization not need to take into account when implementing a holistic approach to organization risk management?
- AStrategic goals and objectives.
- BSystem of Records (SORN)
- CRelationships between mission/business processes and the supporting information systems.
- DOrganizations Culture and infrastructure.
110As indicated in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, the Risk Management Framework (RMF) begins with starting point inputs, which include architectural descriptions, system boundaries, and:
- AThe Department of Defense Architecture Framework (DODAF)
- BThe Open Group Architecture Framework (TOGAF)
- CThe Zachman Framework
- DMission and Business Processes.
111As indicated in NIST SP 800-37, the RMF starting point provides organizational inputs that include laws, directives, and policy guidance, strategic goals and objectives, and:
- APriorities and resource availability
- BBusiness process management
- CAcquisition management
- DGAO and IG audit remediation
112The collection of process employed to ensure that an agency conforms to the legal, policy, and associated regulatory mandates that apply to a system is known as:
- AAuthorization
- BCertification
- CAccreditation
- DCompliance
113Risk assessment and risk determination include, in the proper order:
- AThreats, probability, impact, and vulnerability
- BThreats, vulnerability, probability, and impact
- CVulnerability, threats, probability, and impact
- DProbability, threats, vulnerabilities, and impact
1146. What system impact level is defined as “The loss of confidentiality, integrity, or availability could be expect to have a serious adverse effect on organizational operations, organizational assets, or individuals”?
- AA. Adequate
- BB. Low
- CC. Moderate
- DD. High
115NIST SP 800-30, Guide for conducting Risk Assessment, defines the appropriate assessment approaches as quantitative, qualitative, and:
- AThose are the only two assessment approaches
- BSemi-qualitative
- CSemi-quantitative
- DHybrid
116A Risk assessment methodology includes the risk assessment process, the assessment approach, the analysis approach, and:
- AAssessment alternatives
- BAssessment results
- CRisk Constraints
- DRisk Model
117The Risk Management process comprises which four components?
- APlan, Do, Check, Act
- BFrame, Action, Respond, Manage
- CFormulation, Assess, Respond, Manage
- DFrame, Assess, Respond, Monitor
118NIST SP 800-60 discusses which two concepts with respect to security categorization?
- AImpact and consequences
- BLikelihood and impact
- CCriticality and sensitivity
- DProvisional data classification and special factors
119A condition that exists within an organization, a mission or business process, enterprise architecture, information system, or environment of operation is known as:
- AA predisposing condition
- BA Risk
- CAn Impact
- DA consequence
120As identified in NIST SP 800-30, a risk analysis approach can be threat oriented, vulnerability-oriented, and:
- AImpact-Oriented
- BMitigation-Oriented
- CLikelihood-Oriented
- DAsset/Impact-oriented
12113. In NIST SP 800-39, risk framing requires that organizations identify:
- AA. Risk assumption, risk constraints, risk tolerance, and priorities and trade-offs.
- BB. Risk planning, risk methodology, risk tolerance, and risk management.
- CC. Risk Assumption, risk constraints, and risk tolerance.
- DD. Risk planning, risk methodology, and risk tolerance.
Información
- Descripción
- Test sobre CAP DC , creado por Luis EZ el 10/05/2017.
- Autor
- Luis EZ
- Idioma
- English
- Visitas
- 3
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test