CGRC Control Selection — 25 Questions

Question 1

Which of the following is the first step in the RMF that involves the selection of security controls?

Accepted Answer

Select.. The Select step is the third step in the Risk Management Framework (RMF).

Answer

Categorize.

Answer

Assess.

Answer

Implement.

Question 2

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Accepted Answer

To define specific parameters for control implementation.. Assignment statements provide a mechanism to tailor the control by specifying organization-defined values or frequencies.

Answer

To categorize the control by its priority level.

Answer

To link the control to a regulatory requirement.

Answer

To assign the control to a specific system administrator.

Question 3

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Accepted Answer

Add additional controls to the baseline to address specific threat vectors.. Supplementing is the process of adding controls to a baseline to address specific mission or business requirements that are not covered by the standard baseline.

Answer

Replace a control with a vendor-provided security feature.

Answer

Remove controls from the baseline that are technically infeasible.

Answer

Adjust the parameters of existing controls to lower operational impact.

Question 4

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. A compensating control is an alternate measure used to satisfy the requirement of a security control that cannot be implemented as stated.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 5

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

Accepted Answer

Control ID prefix.. Control identifiers in NIST 800-53 follow a format such as AC-2, where 'AC' refers to the Access Control family.

Answer

Control priority tag.

Answer

The assignment statement.

Answer

The control parameter list.

Question 6

What document provides the most granular guidance on tailoring security controls for federal systems?

Accepted Answer

NIST SP 800-53.. NIST SP 800-53, specifically the tailoring guidance section, provides the framework for modifying baselines.

Answer

FIPS 200.

Answer

NIST SP 800-37.

Answer

CNSSI 1253.

Question 7

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

Accepted Answer

Document the removal of the family with a justification.. If a control or family is not applicable to the system's function, it should be scoped out or documented as not applicable during the tailoring process.

Answer

Replace the family with general security controls.

Answer

Keep the controls but set them to 'manual' mode.

Answer

Implement the controls as high-priority items.

Question 8

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

Accepted Answer

Individual systems do not need to address password complexity.. Common controls are controls provided by the infrastructure or enterprise that individual information systems inherit, reducing the burden on system owners.

Answer

Individual systems must override the common control.

Answer

Common controls cannot be used for password complexity.

Answer

Individual systems must report their own password status.

Question 9

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Accepted Answer

To provide a standardized starting point based on impact level.. NIST SP 800-53B focuses on establishing a starting point of security controls based on the FIPS 199 impact categorization to ensure a minimum security posture.

Answer

To remove all controls that do not apply to the local network.

Answer

To define the continuous monitoring strategy for the system.

Answer

To identify all system-specific compensations.

Question 10

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

Accepted Answer

NIST SP 800-53B.. NIST SP 800-53B provides the control baselines for the various impact levels.

Answer

NIST SP 800-53A.

Answer

FIPS 199.

Answer

NIST SP 800-37.

Question 11

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Accepted Answer

Document the removal and the justification in the SSP.. When controls are removed from the baseline during tailoring, the justification must be recorded to support auditability.

Answer

Mark the control as 'Implemented' and leave the field blank.

Answer

Request a waiver from the CISO.

Answer

Just delete the control from the system security plan (SSP).

Question 12

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Accepted Answer

The overlay supplements the baseline.. Overlays are used to augment the base control set; they don't replace the baseline but tailor it for a specific context.

Answer

The overlay is used only if the system is High impact.

Answer

The baseline is discarded if an overlay is used.

Answer

The overlay replaces the entire baseline.

Question 13

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Accepted Answer

It provides a standardized set of controls for a specific technology stack.. Overlays are pre-defined sets of controls that address specific environments, technologies, or missions, ensuring consistent security posture.

Answer

It replaces the need for FIPS 199 categorization.

Answer

It eliminates the need for manual tailoring.

Answer

It automatically tests the controls for compliance.

Question 14

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

Accepted Answer

To serve as a comprehensive list of all possible security controls.. The catalog serves as the central repository from which organizations select appropriate controls based on their system-specific security needs.

Answer

To automate the scanning process.

Answer

To mandate the order of implementation.

Answer

To identify which vendors are compliant.

Question 15

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

Accepted Answer

Define the frequency based on organizational policy.. Organizations must define the value for the assignment within the bracket to make the control actionable.

Answer

Use the default value provided in the appendix.

Answer

Remove the control since it is not fully defined.

Answer

Leave the assignment blank.

Question 16

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. The AO reviews and approves the selected control set to ensure it meets the risk appetite of the organization.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.

Question 17

During tailoring, what is the 'Refinement' process?

Accepted Answer

Adjusting the control statement to make it more precise.. Refinement is the process of adjusting the implementation of a control to be more specific to the technology or mission.

Answer

Changing the impact level of the system.

Answer

Removing controls that are too expensive.

Answer

Adding new controls to the baseline.

Question 18

If a control is determined to be 'system-specific', what does that mean?

Accepted Answer

It is implemented by the system owner for that system only.. A system-specific control is one that is implemented solely by the information system and is not inherited from an enterprise service.

Answer

It is a hybrid control.

Answer

It must be implemented by the vendor.

Answer

It is inherited from the enterprise.

Question 19

Which of the following describes a 'Hybrid' control?

Accepted Answer

A control with shared responsibility between the organization and the system.. A hybrid control is a control where both the organization (or provider) and the information system share responsibility for implementation.

Answer

A control that covers both physical and logical security.

Answer

A control that is always automated.

Answer

A control that is used in both cloud and on-premise environments.

Question 20

Which TWO of the following characterize the 'Select' step in the RMF?

Accepted Answer

Identifying and selecting the security controls to be implemented.. The select step focuses on choosing the appropriate controls and documenting them in the system security plan.

Answer

Verifying that the controls are operating as expected.

Answer

Determining the impact categorization of the system.

Answer

Authorizing the system for operation.