CGRC Control Selection — 25 Questions

Question 1

What document provides the most granular guidance on tailoring security controls for federal systems?

Accepted Answer

NIST SP 800-53.. NIST SP 800-53 is the comprehensive catalog of security and privacy controls for federal information systems, and it provides the most granular guidance on tailoring those controls. It includes detailed control baselines, control enhancements, and explicit tailoring guidance (such as scoping, parameterization, and compensating controls) in Appendixes and supplemental materials. FIPS 200 and SP 800-37 reference SP 800-53 but do not themselves contain the granular tailoring instructions. CNSSI 1253 provides tailoring for national security systems, but it is not the primary federal guidance for general federal systems.

Answer

FIPS 200.

Answer

NIST SP 800-37.

Answer

CNSSI 1253.

Question 2

Which of the following is the first step in the RMF that involves the selection of security controls?

Accepted Answer

Select.. The Select step is the third step in the Risk Management Framework (RMF).

Answer

Categorize.

Answer

Assess.

Answer

Implement.

Question 3

Which of the following describes a 'Hybrid' control?

Accepted Answer

A control with shared responsibility between the organization and the system.. In the context of security control baselines (e.g., NIST SP 800-53), a 'Hybrid' control refers to a control that can be implemented as either a common control (shared across systems) or a system-specific control, depending on the organization's decision. This shared responsibility means the control may be managed by the organization (common) and inherited by the system, or implemented specifically for the system. Thus, option B best describes a hybrid control.

Answer

A control that covers both physical and logical security.

Answer

A control that is always automated.

Answer

A control that is used in both cloud and on-premise environments.

Question 4

Which TWO of the following characterize the 'Select' step in the RMF?

Accepted Answer

Identifying and selecting the security controls to be implemented.. Option B is correct because the Select step of the NIST RMF is where security and privacy controls are identified and selected based on the system's security categorization, using baselines such as NIST SP 800-53B and tailoring them as needed. Option D is correct because the selected controls and their implementation details are documented in the System Security Plan (SSP), which is a key output of the Select step. Option A is incorrect because verifying that controls operate as expected is part of the Assess step, not Select. Option C is incorrect because determining impact categorization is performed in the Categorize step, which precedes Select. Option E is incorrect because authorizing the system for operation occurs in the Authorize step, after assessment.

Answer

Verifying that the controls are operating as expected.

Answer

Determining the impact categorization of the system.

Answer

Authorizing the system for operation.

Question 5

A security manager is tailoring the NIST SP 800-53 control baseline for a new human resources system that will be deployed in a public cloud environment. The system will process sensitive employee data but will not interconnect with any other organizational systems. The organization wants to ensure that the selected controls are appropriate and that any unnecessary controls are removed or scoped appropriately. Which TWO of the following actions are appropriate when tailoring the control baseline for this system? (Choose two.)

Accepted Answer

Scoping out controls that are not applicable because the system does not interconnect with other systems, such as certain boundary protection controls.. Scoping out non-applicable controls and applying compensating controls are both valid tailoring actions that adapt the baseline to the system's specific environment and constraints. These actions ensure the control set is appropriate and cost-effective while maintaining security. Documentation of these decisions is required but is not itself a tailoring action; it supports the tailoring process.

Answer

Removing all controls related to physical security because the cloud provider is responsible for the data center.

Answer

Documenting the tailoring decisions in the system security plan, including the rationale for scoping out or compensating controls.

Answer

Adding controls from the NIST SP 800-53 high baseline to ensure the system is secure, regardless of the system's impact level.

Question 6

You are a security analyst selecting controls for a federal information system categorized as MODERATE impact. You are using NIST SP 800-53B to tailor the baseline. You need to apply scoping considerations to reduce the control set. Which two of the following are appropriate scoping considerations according to NIST SP 800-53B? (Choose two.)

Accepted Answer

Removing controls that are not applicable due to the system's technology or environment.. According to NIST SP 800-53B, scoping considerations include allocating controls to specific system components and removing controls that are not applicable. These actions help tailor the baseline to the system's specific characteristics. Selecting a higher baseline, using compensating controls, or adding controls from other frameworks are not scoping considerations; they are separate tailoring or enhancement activities.

Answer

Using compensating controls to replace controls that cannot be implemented.

Answer

Selecting a different baseline from a higher impact level to ensure adequate security.

Answer

Adding controls from a different framework to enhance security.

Question 7

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Accepted Answer

To define specific parameters for control implementation.. In NIST SP 800-53, assignment statements are placeholders within a control that the organization must fill in with specific values or parameters tailored to its environment. For example, a control might say 'the organization reviews audit records [Assignment: organization-defined frequency]' — the organization defines that frequency. This makes controls adaptable rather than one-size-fits-all.

Answer

To categorize the control by its priority level.

Answer

To link the control to a regulatory requirement.

Answer

To assign the control to a specific system administrator.

Question 8

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Accepted Answer

Add additional controls to the baseline to address specific threat vectors.. In NIST SP 800-53 Rev. 5 tailoring, 'supplementing' means adding controls to the baseline to address specific threats, technologies, or organizational requirements not covered by the initial baseline. The authorization official's request to supplement therefore means adding additional controls (B).

Answer

Replace a control with a vendor-provided security feature.

Answer

Remove controls from the baseline that are technically infeasible.

Answer

Adjust the parameters of existing controls to lower operational impact.

Question 9

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Accepted Answer

Compensating Control.. This is an example of a compensating control. A compensating control is an alternative control implemented when the original control cannot be applied due to constraints, but it still mitigates the same risk. The system owner is substituting a different control to achieve the same security objective, which is the definition of a compensating control.

Answer

Risk Acceptance.

Answer

Baseline Tailoring.

Answer

Control Supplementation.

Question 10

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

Accepted Answer

Control ID prefix.. In NIST SP 800-53, controls are identified by a unique control ID that consists of a two-letter family prefix followed by a number (e.g., AC-1 for Access Control). The prefix indicates the control family. Therefore, the control ID prefix (Option C) identifies the specific family to which a control belongs.

Answer

Control priority tag.

Answer

The assignment statement.

Answer

The control parameter list.

Question 11

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

Accepted Answer

Document the removal of the family with a justification.. NIST SP 800-53B and the RMF allow organizations to tailor the control baseline by removing controls that are not applicable — but any removal must be documented with a justification in the system security plan or tailoring worksheet. Since the system does not process PII, the PRIV family is not applicable, so the correct action is to document the removal with a rationale rather than silently dropping it or implementing it anyway.

Answer

Replace the family with general security controls.

Answer

Keep the controls but set them to 'manual' mode.

Answer

Implement the controls as high-priority items.

Question 12

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

Accepted Answer

Individual systems do not need to address password complexity.. A 'common control' is a control that is implemented once and inherited by multiple systems. If the organization has documented a common control for password complexity, individual systems do not need to address password complexity separately because they inherit the control from the common control provider. This avoids duplication and ensures consistency.

Answer

Individual systems must override the common control.

Answer

Common controls cannot be used for password complexity.

Answer

Individual systems must report their own password status.

Question 13

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

Accepted Answer

To provide a standardized starting point based on impact level.. NIST SP 800-53B defines control baselines (Low, Moderate, High, Privacy) as standardized sets of controls derived from SP 800-53 that serve as a starting point for any system at a given impact level. For a MODERATE-impact federal system, the initial baseline is the Moderate baseline, which the organization then tailors (scoping, parameterization, compensating controls) to fit the specific system. The baseline's purpose is to give a consistent, defensible foundation rather than a system-specific final control set.

Answer

To remove all controls that do not apply to the local network.

Answer

To define the continuous monitoring strategy for the system.

Answer

To identify all system-specific compensations.

Question 14

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

Accepted Answer

NIST SP 800-53B.. NIST SP 800-53B, 'Control Baselines for Information Systems and Organizations,' is the document that defines the Low, Moderate, and High security control baselines. It provides the specific control sets that correspond to each FIPS 199 impact category, serving as the starting point for tailoring in the RMF. SP 800-53B is the authoritative source for baseline selection.

Answer

NIST SP 800-53A.

Answer

FIPS 199.

Answer

NIST SP 800-37.

Question 15

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Accepted Answer

Document the removal and the justification in the SSP.. When a control is marked 'Not Applicable' during tailoring, the correct approach is to document the removal and provide a justification in the System Security Plan (SSP). This ensures transparency and auditability, allowing authorizing officials to understand why the control was excluded. The SSP serves as the primary documentation for control implementation and tailoring decisions.

Answer

Mark the control as 'Implemented' and leave the field blank.

Answer

Request a waiver from the CISO.

Answer

Just delete the control from the system security plan (SSP).

Question 16

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Accepted Answer

The overlay supplements the baseline.. In NIST SP 800-53, an overlay is a set of additional or modified controls applied to a baseline to address specific technology, environment, or mission needs. The overlay supplements the baseline (Option A) by adding controls or tailoring existing ones; it does not replace or discard the baseline. The baseline remains the foundation, and the overlay enhances it.

Answer

The overlay is used only if the system is High impact.

Answer

The baseline is discarded if an overlay is used.

Answer

The overlay replaces the entire baseline.

Question 17

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Accepted Answer

It provides a standardized set of controls for a specific technology stack.. A control overlay is a pre-defined set of controls and control enhancements that can be applied to a baseline to address specific technologies, environments, or mission needs — such as cloud computing. In the NIST RMF context, overlays provide a standardized, reusable way to tailor a baseline for a particular technology stack (e.g., cloud, mobile, industrial control systems) without starting from scratch. The primary benefit is consistency and efficiency: organizations get a vetted set of controls appropriate to the cloud environment, reducing ad hoc tailoring and ensuring coverage of cloud-specific risks.

Answer

It replaces the need for FIPS 199 categorization.

Answer

It eliminates the need for manual tailoring.

Answer

It automatically tests the controls for compliance.

Question 18

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

Accepted Answer

To serve as a comprehensive list of all possible security controls.. The NIST SP 800-53 Control Catalog is a comprehensive list of security and privacy controls that organizations use as a source for selecting controls during the RMF process. Its main purpose is to provide the full set of possible controls from which tailored baselines (Low, Moderate, High) are derived for a given system.

Answer

To automate the scanning process.

Answer

To mandate the order of implementation.

Answer

To identify which vendors are compliant.

Question 19

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

Accepted Answer

Define the frequency based on organizational policy.. In NIST SP 800-53, '[Assignment: organization-defined frequency]' is an explicit placeholder indicating that the organization must fill in the value as part of tailoring the control. The system owner, in coordination with the Authorizing Official and organizational policy, defines the frequency (e.g., annually, quarterly) and documents it in the system security plan. Leaving it blank or removing the control would break the control baseline and fail assessment.

Answer

Use the default value provided in the appendix.

Answer

Remove the control since it is not fully defined.

Answer

Leave the assignment blank.

Question 20

What is the primary role of the authorization official (AO) during the Control Selection phase?

Accepted Answer

To approve the tailoring decisions.. During the Control Selection phase, the Authorizing Official (AO) is responsible for approving the tailoring decisions made by the system owner and security team, ensuring the selected controls adequately address the system's risk profile. The AO's approval formalizes the agreed-upon control set before it moves into implementation and assessment. This approval is a key governance step that ties control selection to the authorization decision.

Answer

To configure the security appliances.

Answer

To write the security policy.

Answer

To perform the technical assessment.