CGRC Scope OF System — 20 Questions

Question 1

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. A boundary diagram or description is required for the System Security Plan to define what is subject to assessment.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 2

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

Accepted Answer

Moderate. FIPS 199 defines the high-water mark based on the highest value among the three security objectives.

Answer

Not Categorized

Answer

Low

Answer

High

Question 3

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

Accepted Answer

The Information System Owner (ISO).. The Information System Owner (ISO) is responsible for the categorization, which is then approved by the Authorizing Official (AO).

Answer

The Lead System Administrator.

Answer

The Chief Information Security Officer (CISO).

Answer

The Third-Party Auditor.

Question 4

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

Accepted Answer

To identify controls that are implemented once and applied to multiple systems.. Common controls are inherited from the organization or another system, reducing the burden on the individual system owner.

Answer

To ensure they are manually tested for every individual system.

Answer

To increase the system's FIPS 199 impact level.

Answer

To exclude them from the System Security Plan (SSP).

Question 5

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

Accepted Answer

Define the boundary based on the specific services and data flows owned by the sub-system.. Clearly defining trust zones and interface points prevents the boundary from expanding unnecessarily.

Answer

Include only the database tier.

Answer

Include the entire enterprise infrastructure to be safe.

Answer

Include all internal network segments regardless of use.

Question 6

You are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?

Accepted Answer

The cloud service provider's physical security controls for the hosting data center.. The authorization boundary must include all components for which the authorizing official accepts risk, including third-party cloud services that manage the security controls.

Answer

The end-user's local home router configuration.

Answer

The public internet backbone routing protocols.

Answer

The organization's global human resources policy.

Question 7

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A System Interconnection Agreement (SIA) or Data Use Agreement (DUA) provides the formal record of cross-boundary data flows.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 8

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

Accepted Answer

Confidentiality=Low, Integrity=Low, Availability=High.. Categorization must account for the impact on the organization, regardless of data classification (e.g., public vs. sensitive).

Answer

Exclude the system from FIPS 199 requirements.

Answer

Categorize only based on Confidentiality.

Answer

Confidentiality=Low, Integrity=Low, Availability=Low.

Question 9

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. An inaccurate boundary leads to 'security gaps' where assets go unmonitored or unprotected.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 10

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

Accepted Answer

NIST SP 800-60.. NIST SP 800-60 is the guide for mapping information types to FIPS 199 security objectives.

Answer

NIST SP 800-37.

Answer

NIST SP 800-53.

Answer

FIPS 140-3.

Question 11

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

Accepted Answer

List the identity service as an external provider and inherit the controls.. When using shared services, the system owner documents the inheritance of controls from the shared service provider.

Answer

Force the service provider to sign a full system authorization for you.

Answer

The identity service must be fully assessed as part of your system.

Answer

Exclude the identity service from the documentation entirely.

Question 12

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

Accepted Answer

Implementing consistent security controls across all boundary nodes regardless of location.. Centralizing the security management and standardizing controls across locations ensures uniform protection.

Answer

Categorizing each site as a separate information system.

Answer

Excluding remote offices from the authorization boundary.

Answer

Allowing each site to define its own unique security policy.

Question 13

Which document is mandatory to finalize the system categorization and begin the RMF process?

Accepted Answer

The FIPS 199 Security Categorization document.. The FIPS 199 Categorization document (or the categorization section of the SSP) is required to select appropriate security controls.

Answer

The Incident Response Policy.

Answer

The Penetration Test Report.

Answer

The Contingency Plan.

Question 14

An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?

Accepted Answer

The dependency of the system on the database for operational integrity.. If the new application relies on the database for security or operational functionality, it must be included.

Answer

Whether the database is hosted in the same physical rack.

Answer

The age of the hardware.

Answer

The amount of data stored.

Question 15

When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)

Accepted Answer

The information types processed, stored, or transmitted by the system.. Defining the boundary requires understanding the system's operational scope, its connection points, and its data ownership.

Answer

The organizational personnel who have access to the system.

Answer

The fiscal budget allocated for hardware replacement.

Answer

The physical location of the cloud data center.

Question 16

Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)

Accepted Answer

System interconnections and data flow paths.. An inventory must track hardware, software, and operational connections to be useful for risk management.

Answer

The employee performance evaluation score for the system admin.

Answer

The exact date of the last office coffee machine maintenance.

Question 17

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Accepted Answer

Availability.. FIPS 199 defines three objectives: Confidentiality, Integrity, and Availability. You are selecting two from this list.

Answer

Authentication.

Answer

Accountability.

Answer

Non-repudiation.

Question 18

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Accepted Answer

Network architecture diagrams.. The AO needs visual, written, and logical proof of what they are authorizing.

Answer

The janitorial service contract for the building.

Answer

The organization's holiday schedule.

Question 19

Which TWO statements regarding FIPS 199 'High Water Mark' are accurate? (Select TWO)

Accepted Answer

The overall system categorization is the highest of the three individual security objectives.. The high water mark ensures that the entire system is protected at the level of its most sensitive component.

Answer

The high water mark only applies to federal systems with 'High' impact data.

Answer

Categorization must be performed by averaging the impact scores.

Answer

The high water mark is only determined by availability.

Question 20

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)

Accepted Answer

Administrative personnel managing the system.. An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Answer

The local library book catalog.

Answer

The public social media feed of the organization.