CGRC Scope OF System — 10 Questions

Question 1

You are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cloud service provider's physical security controls for the hosting data center.. Under NIST SP 800-37, the authorization boundary must encompass all components that process, store, or transmit federal information, including supporting infrastructure. For a cloud-hosted application, the CSP's physical security controls for the data center are inherited controls that directly protect the confidentiality, integrity, and availability of the system. Therefore, they must be explicitly included within the boundary to ensure a complete and accurate security assessment.

Answer

The end-user's local home router configuration.

Answer

The public internet backbone routing protocols.

Answer

The organization's global human resources policy.

Question 2

Which TWO statements regarding FIPS 199 'High Water Mark' are accurate? (Select TWO)

Accepted Answer

The overall system categorization is the highest of the three individual security objectives.. Option A is correct because FIPS 199 defines the system's overall security category using the high water mark concept: the system is categorized at the highest impact level among the three security objectives—confidentiality, integrity, and availability—so if any one objective is rated High, the entire system is treated as High. Option E is correct because once the high water mark sets the system's overall categorization, that category drives the baseline selection and application of security controls across the entire system boundary, meaning all controls are applied at the level dictated by the highest-rated objective. Option B is incorrect because the high water mark is a general FIPS 199 rule applicable to any system being categorized, not limited to federal systems handling only High impact data. Option C is incorrect because FIPS 199 explicitly rejects averaging; the overall category is the maximum, not a mean, of the individual objective ratings. Option D is incorrect because the high water mark considers all three objectives—confidentiality, integrity, and availability—not availability alone.

Answer

The high water mark only applies to federal systems with 'High' impact data.

Answer

Categorization must be performed by averaging the impact scores.

Answer

The high water mark is only determined by availability.

Question 3

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)

Accepted Answer

Administrative personnel managing the system.. In RMF terms, an information system comprises the people, processes, and technology that support the system within its authorization boundary. Option A (Administrative personnel managing the system) is correct because the personnel who administer, operate, and support the system are part of the information system and fall within the authorization boundary. Option C (Operating systems) is correct because operating systems are core technology components (hardware, software, firmware) that constitute the information system. Option D (Physical security guards at the facility gate) is correct because the personnel and physical protection mechanisms safeguarding the system are part of the information system's boundary. Option B (The local library book catalog) is not part of the system's boundary because it is an unrelated external information resource. Option E (The public social media feed of the organization) is not part of the authorization boundary because it is an external, publicly accessible communication channel outside the system's control.

Answer

The local library book catalog.

Answer

The public social media feed of the organization.

Question 4

A security architect is defining the authorization boundary for a new payroll processing system. The system runs on a virtual server hosted in a government cloud, uses a managed database service from the same cloud provider, and connects to an on-premises mainframe for employee records. The architect needs to decide whether the cloud provider's infrastructure should be inside the boundary. According to NIST SP 800-37 Rev. 2, what is the most appropriate action?

Accepted Answer

Exclude the cloud infrastructure and document it as an external service with inherited controls.. The authorization boundary should include only the assets the organization owns or directly controls. Cloud infrastructure managed by the provider is typically excluded and addressed through inherited controls from the provider's own authorization, such as a FedRAMP provisional authorization. This approach keeps the boundary realistic and leverages existing assessments.

Answer

Define the boundary at the cloud provider's data center perimeter to ensure all hardware is covered.

Answer

Include the cloud infrastructure within the boundary because the system cannot function without it.

Answer

Include only the virtual server and managed database, but exclude the physical cloud infrastructure.

Question 5

A security architect is defining the authorization boundary for a new system that will process, store, and transmit controlled unclassified information (CUI). The system will use a shared database service and a separate authentication server. Which TWO components should the architect consider as part of the system boundary? (Choose two.)

Accepted Answer

The authentication server that provides identity verification for the system's users.. The authorization boundary should include components that directly process, store, or transmit the system's data, or that provide security services essential to the system. The authentication server and the backup server meet these criteria because they are integral to the system's security and data protection. Shared infrastructure like network switches, shared databases, and provider personnel are typically excluded as they are covered by separate authorizations or common controls.

Answer

The shared database service that stores CUI on behalf of multiple systems.

Answer

The network switch that routes traffic between the system and the authentication server.

Answer

The cloud service provider's physical security guards who protect the data center.

Question 6

A security analyst is reviewing the authorization boundary for a system that processes Controlled Unclassified Information (CUI). The system consists of a web front end, an application server, a database, and a backup server. The analyst must identify which components are typically considered part of the information system boundary. (Choose two.)

Accepted Answer

The web front end that directly interfaces with users.. The web front end and application server are core components that directly process and handle CUI, making them integral to the information system boundary. Shared infrastructure like network switches and provider hypervisors are usually excluded and covered by separate authorizations or common controls. Backup servers may be included or treated as shared services depending on the architecture.

Answer

The backup server that stores CUI backups.

Answer

The cloud provider's hypervisor that hosts the virtual machines.

Answer

The network switch that routes traffic between the web front end and the application server.

Question 7

A security practitioner is defining the authorization boundary for a system that includes a web server, an application server, and a database server. The web server is hosted on a physical server in the organization's data center. The application server is a virtual machine running on a hypervisor managed by the organization. The database server is a physical server that also hosts a database for another department. The other department's database is logically separated but shares the same operating system. How should the practitioner handle the database server in the boundary definition?

Accepted Answer

Include the database server in the boundary but document that the other department's database is logically separated and assess the shared operating system controls.. The database server is part of the system because it processes the system's data. The other department's database is logically separated and can be excluded, but the shared operating system must be included and assessed. This approach ensures the boundary covers all components that support the system while avoiding unnecessary inclusion of unrelated data.

Answer

Include the entire database server in the boundary because the operating system is shared and cannot be logically separated.

Answer

Exclude the database server from the boundary because it is shared with another department and therefore cannot be authorized.

Answer

Include only the database instance used by the system and exclude the operating system, because the operating system is a shared infrastructure component.

Question 8

A security manager is defining the authorization boundary for a new major application that will process Controlled Unclassified Information (CUI). The application will run on a dedicated server within the agency's data center and will interface with an external identity management system. Which TWO of the following should be included within the authorization boundary? (Choose two.)

Accepted Answer

The security policies and procedures that govern the operation of the dedicated server.. The authorization boundary should include the dedicated server, its software, and the security policies and procedures that govern its operation. These are directly under the system owner's control and are essential for processing CUI. External systems like the identity management system and shared network infrastructure are outside the boundary and are handled as common controls or external dependencies.

Answer

The network infrastructure that connects the dedicated server to the external identity management system.

Answer

The external identity management system that provides authentication services.

Answer

The backup tapes stored offsite at a commercial storage facility.

Question 9

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. The System Security Plan (SSP) is the RMF artifact that documents the system boundary — the people, processes, and technologies that make up the system and its authorization boundary. The boundary description within the SSP defines what is inside versus outside the authorization, which directly supports categorization, control selection, and assessment scoping in the RMF process.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 10

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

Accepted Answer

Moderate. Per FIPS 199, the overall security categorization of an information system is determined by the high-water mark of the three security objectives: confidentiality, integrity, and availability. Since integrity and availability are both Moderate and confidentiality is Low, the highest impact level is Moderate, making the overall system categorization Moderate. This ensures that the system is protected at the level of its most critical security objective.

Answer

Not Categorized

Answer

Low

Answer

High