Be able to define and document an authorization boundary, including interfaces, inherited controls, and common controls. The single most important thing is correctly deciding what is inside the boundary and who is responsible for assessing each control, then recording that in the system description and boundary diagram.
Start practicing
Scope OF System — choose a session length
Free · No account required
Domain overview
This domain covers how to define, document, and defend an authorization boundary under the RMF process. Questions present scenarios involving system descriptions, boundary diagrams, common controls, inherited controls, and external interfaces, then ask which artifact, responsibility, or boundary decision is correct. Expect to apply NIST SP 800-37 and SP 800-18 concepts to realistic federal and CUI systems.
Exam objectives
Selecting the system description and boundary diagram artifacts required by NIST SP 800-18 and RMF Step 1
Determining authorization boundary scope when systems use cloud, PaaS, or shared services
Assigning responsibility for common controls provided by another organizational unit
Identifying interfaces, external connections, and inherited controls that cross the boundary
Treating a shared common control as automatically in scope, rather than documenting inheritance and the providing unit's assessment
Drawing the boundary around physical hardware instead of the people, processes, and technology supporting the mission
Assuming cloud or PaaS components are always outside the boundary without documenting the provider-customer split
Click any question to see the full explanation and answer options, or start a focused practice session above.
Which of the following is an example of a 'System Boundary' document that assists with the RMF process?
2A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?
3When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?
4When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?
5Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?
6You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?
7You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?
8What is the primary risk of having an inaccurately defined authorization boundary?
9Which NIST publication provides the definitive guidance on FIPS 199 security categorization?
10You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?
11When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?
12Which document is mandatory to finalize the system categorization and begin the RMF process?
13An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?
14When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)
15Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)
16When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)
17Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)
18A security architect is defining the authorization boundary for a new cloud-hosted financial system. The system uses a managed database service and a serverless compute service from the cloud provider. The provider's infrastructure (hypervisor, physical network, data center) is outside the boundary. According to NIST SP 800-37, which statement best describes how the shared responsibility model affects the authorization boundary?
19A security manager is defining the authorization boundary for a system that processes Controlled Unclassified Information (CUI). The system consists of a web server, an application server, and a database server, all hosted on-premises. The system also uses a shared network switch and a shared firewall that are used by other systems in the same data center. Which two components should be included in the authorization boundary? (Choose two.)
20A security analyst is documenting the authorization boundary for a new system. The system will be deployed on a government cloud environment and will interface with an external identity provider for authentication. The identity provider is owned and operated by another agency. How should the analyst represent the external identity provider in the authorization boundary documentation?
21A security analyst is preparing to categorize a new human resources system that will store PII for 5,000 employees. The system will be hosted in a government cloud environment. According to FIPS 199, what is the FIRST step the analyst should take to determine the security category?
22A security analyst is defining the authorization boundary for a new financial system hosted entirely within a commercial cloud Infrastructure as a Service (IaaS) environment. The system consists of virtual machines, a managed database service, and a load balancer, all provisioned by the organization's cloud team. The cloud provider's physical data center and hypervisor layer are outside the organization's direct control. According to NIST SP 800-37 Rev. 2, which statement best describes how the authorization boundary should be defined?
23A large federal agency is modernizing its benefits processing system. The new architecture will integrate a legacy mainframe system, a commercial off-the-shelf (COTS) case management product hosted on-premises, and a new cloud-based document repository. The legacy mainframe and the COTS product are owned by the agency, while the cloud repository is provided by a FedRAMP-authorized cloud service provider. The agency's Information System Owner (ISO) must define the authorization boundary for the overall benefits processing capability. Which approach is most appropriate?
24A federal agency is deploying a cloud-based case management system. The system uses a virtual private cloud (VPC) for compute, a managed database service, and an external identity provider for authentication. The security team must define the authorization boundary. Which approach best aligns with NIST SP 800-37 and FIPS 199?
25An organization is beginning the RMF process for a new human resources system. The Information System Owner (ISO) needs to identify the system boundary. Which of the following best describes the purpose of defining the authorization boundary?
26A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common control provided by a separate organizational unit. The common control's assessment was performed by that unit, and the results are documented in a shared assessment report. What should the Assessor do to support the system's authorization?
27A system owner is defining the authorization boundary for a new information system that will process personally identifiable information (PII). The system will use a cloud-based customer relationship management (CRM) service, an on-premises database, and a web application hosted on a government-furnished server. Which TWO components should be included within the authorization boundary? (Choose two.)
28A program manager is working with the Information System Owner (ISO) to determine the scope of a new payroll system. The system will interface with an external banking system for direct deposits. What should the ISO do regarding the external banking system when defining the authorization boundary?
29A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact is specifically designed to depict the system boundary and its interfaces?
30A program manager is preparing to categorize a new information system under FIPS 199. The system will handle financial data, and the program manager wants to ensure the categorization is accurate. Which document should the program manager reference to identify the potential impact levels for confidentiality, integrity, and availability?
31A security manager is leading an effort to define the authorization boundary for a system that uses a virtualized environment. The system consists of multiple virtual machines (VMs) on a hypervisor that also hosts VMs for other systems. How should the security manager address the hypervisor when defining the boundary?
32An organization is defining the authorization boundary for a system that will use a shared database service managed by a different business unit. The database will store sensitive data for multiple systems. What should the security manager do to properly address this shared service in the authorization process?
33A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)
34An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end, an application server, and a database. The database is hosted in a separate virtual private cloud (VPC) managed by the same organization. The ISO wants to minimize the boundary while ensuring all necessary components are included. What should the ISO do?
35An Information System Owner (ISO) is defining the authorization boundary for a system that will be deployed in a government cloud environment. The cloud provider offers infrastructure as a service (IaaS). Which of the following should the ISO consider as part of the system boundary?
36A security assessor is reviewing a system boundary for a high-impact system. The boundary includes a web server, an application server, and a database server, all located in the same data center. The system also uses an external identity provider for authentication. During the review, the assessor notices that the identity provider is not listed in the boundary diagram. What is the most significant risk of this omission?
37A federal agency is deploying a new cloud-based case management system. The system consists of a web front end, an application server, and a database, all hosted in a single virtual private cloud (VPC). The system owner must define the authorization boundary for the system. Which of the following best describes the authorization boundary in this context?
38A federal agency is initiating the authorization process for a new information system. The system owner is working with the information system security officer (ISSO) to define the system boundary. Which of the following best describes the purpose of defining the system boundary?
Be able to define and document an authorization boundary, including interfaces, inherited controls, and common controls. The single most important thing is correctly deciding what is inside the boundary and who is responsible for assessing each control, then recording that in the system description and boundary diagram.
The Courseiva CGRC question bank contains 38 questions in the Scope OF System domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Scope OF System domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included