Scope OF System

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

You are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

What is the primary risk of having an inaccurately defined authorization boundary?

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

Which document is mandatory to finalize the system categorization and begin the RMF process?

An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?

When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)

Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Which TWO statements regarding FIPS 199 'High Water Mark' are accurate? (Select TWO)

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)