System Compliance

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

What is the purpose of the Security Assessment Report (SAR)?

Which document provides the formal authority to operate a system?

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

When a system is undergoing a major change, what is the impact on the existing ATO?

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

What is the primary role of the Security Control Assessor (SCA)?

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Which THREE of the following are valid components of an Authorization Package?

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Which TWO documents are essential for an Authorizing Official to make an informed risk-based decision?

Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?

Which THREE types of information should be included in a risk acceptance memo?

Which THREE categories of controls are identified in NIST SP 800-53?

Which TWO of the following are responsibilities of the Authorizing Official?

Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?

Which THREE elements are necessary for a compliant continuous monitoring program?