CGRC Scope OF System — 20 Questions

Question 1

You are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cloud service provider's physical security controls for the hosting data center.. Under NIST SP 800-37, the authorization boundary must encompass all components that process, store, or transmit federal information, including supporting infrastructure. For a cloud-hosted application, the CSP's physical security controls for the data center are inherited controls that directly protect the confidentiality, integrity, and availability of the system. Therefore, they must be explicitly included within the boundary to ensure a complete and accurate security assessment.

Answer

The end-user's local home router configuration.

Answer

The public internet backbone routing protocols.

Answer

The organization's global human resources policy.

Question 2

Which TWO statements regarding FIPS 199 'High Water Mark' are accurate? (Select TWO)

Accepted Answer

The overall system categorization is the highest of the three individual security objectives.. Option A is correct because FIPS 199 defines the system's overall security category using the high water mark concept: the system is categorized at the highest impact level among the three security objectives—confidentiality, integrity, and availability—so if any one objective is rated High, the entire system is treated as High. Option E is correct because once the high water mark sets the system's overall categorization, that category drives the baseline selection and application of security controls across the entire system boundary, meaning all controls are applied at the level dictated by the highest-rated objective. Option B is incorrect because the high water mark is a general FIPS 199 rule applicable to any system being categorized, not limited to federal systems handling only High impact data. Option C is incorrect because FIPS 199 explicitly rejects averaging; the overall category is the maximum, not a mean, of the individual objective ratings. Option D is incorrect because the high water mark considers all three objectives—confidentiality, integrity, and availability—not availability alone.

Answer

The high water mark only applies to federal systems with 'High' impact data.

Answer

Categorization must be performed by averaging the impact scores.

Answer

The high water mark is only determined by availability.

Question 3

In the context of the RMF, which THREE of the following are considered 'Information System' components that contribute to the authorization boundary? (Select THREE)

Accepted Answer

Administrative personnel managing the system.. In RMF terms, an information system comprises the people, processes, and technology that support the system within its authorization boundary. Option A (Administrative personnel managing the system) is correct because the personnel who administer, operate, and support the system are part of the information system and fall within the authorization boundary. Option C (Operating systems) is correct because operating systems are core technology components (hardware, software, firmware) that constitute the information system. Option D (Physical security guards at the facility gate) is correct because the personnel and physical protection mechanisms safeguarding the system are part of the information system's boundary. Option B (The local library book catalog) is not part of the system's boundary because it is an unrelated external information resource. Option E (The public social media feed of the organization) is not part of the authorization boundary because it is an external, publicly accessible communication channel outside the system's control.

Answer

The local library book catalog.

Answer

The public social media feed of the organization.

Question 4

A security architect is defining the authorization boundary for a new payroll processing system. The system runs on a virtual server hosted in a government cloud, uses a managed database service from the same cloud provider, and connects to an on-premises mainframe for employee records. The architect needs to decide whether the cloud provider's infrastructure should be inside the boundary. According to NIST SP 800-37 Rev. 2, what is the most appropriate action?

Accepted Answer

Exclude the cloud infrastructure and document it as an external service with inherited controls.. The authorization boundary should include only the assets the organization owns or directly controls. Cloud infrastructure managed by the provider is typically excluded and addressed through inherited controls from the provider's own authorization, such as a FedRAMP provisional authorization. This approach keeps the boundary realistic and leverages existing assessments.

Answer

Define the boundary at the cloud provider's data center perimeter to ensure all hardware is covered.

Answer

Include the cloud infrastructure within the boundary because the system cannot function without it.

Answer

Include only the virtual server and managed database, but exclude the physical cloud infrastructure.

Question 5

A security architect is defining the authorization boundary for a new system that will process, store, and transmit controlled unclassified information (CUI). The system will use a shared database service and a separate authentication server. Which TWO components should the architect consider as part of the system boundary? (Choose two.)

Accepted Answer

The authentication server that provides identity verification for the system's users.. The authorization boundary should include components that directly process, store, or transmit the system's data, or that provide security services essential to the system. The authentication server and the backup server meet these criteria because they are integral to the system's security and data protection. Shared infrastructure like network switches, shared databases, and provider personnel are typically excluded as they are covered by separate authorizations or common controls.

Answer

The shared database service that stores CUI on behalf of multiple systems.

Answer

The network switch that routes traffic between the system and the authentication server.

Answer

The cloud service provider's physical security guards who protect the data center.

Question 6

A security analyst is reviewing the authorization boundary for a system that processes Controlled Unclassified Information (CUI). The system consists of a web front end, an application server, a database, and a backup server. The analyst must identify which components are typically considered part of the information system boundary. (Choose two.)

Accepted Answer

The web front end that directly interfaces with users.. The web front end and application server are core components that directly process and handle CUI, making them integral to the information system boundary. Shared infrastructure like network switches and provider hypervisors are usually excluded and covered by separate authorizations or common controls. Backup servers may be included or treated as shared services depending on the architecture.

Answer

The backup server that stores CUI backups.

Answer

The cloud provider's hypervisor that hosts the virtual machines.

Answer

The network switch that routes traffic between the web front end and the application server.

Question 7

A security practitioner is defining the authorization boundary for a system that includes a web server, an application server, and a database server. The web server is hosted on a physical server in the organization's data center. The application server is a virtual machine running on a hypervisor managed by the organization. The database server is a physical server that also hosts a database for another department. The other department's database is logically separated but shares the same operating system. How should the practitioner handle the database server in the boundary definition?

Accepted Answer

Include the database server in the boundary but document that the other department's database is logically separated and assess the shared operating system controls.. The database server is part of the system because it processes the system's data. The other department's database is logically separated and can be excluded, but the shared operating system must be included and assessed. This approach ensures the boundary covers all components that support the system while avoiding unnecessary inclusion of unrelated data.

Answer

Include the entire database server in the boundary because the operating system is shared and cannot be logically separated.

Answer

Exclude the database server from the boundary because it is shared with another department and therefore cannot be authorized.

Answer

Include only the database instance used by the system and exclude the operating system, because the operating system is a shared infrastructure component.

Question 8

A security manager is defining the authorization boundary for a new major application that will process Controlled Unclassified Information (CUI). The application will run on a dedicated server within the agency's data center and will interface with an external identity management system. Which TWO of the following should be included within the authorization boundary? (Choose two.)

Accepted Answer

The security policies and procedures that govern the operation of the dedicated server.. The authorization boundary should include the dedicated server, its software, and the security policies and procedures that govern its operation. These are directly under the system owner's control and are essential for processing CUI. External systems like the identity management system and shared network infrastructure are outside the boundary and are handled as common controls or external dependencies.

Answer

The network infrastructure that connects the dedicated server to the external identity management system.

Answer

The external identity management system that provides authentication services.

Answer

The backup tapes stored offsite at a commercial storage facility.

Question 9

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. The System Security Plan (SSP) is the RMF artifact that documents the system boundary — the people, processes, and technologies that make up the system and its authorization boundary. The boundary description within the SSP defines what is inside versus outside the authorization, which directly supports categorization, control selection, and assessment scoping in the RMF process.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 10

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

Accepted Answer

Moderate. Per FIPS 199, the overall security categorization of an information system is determined by the high-water mark of the three security objectives: confidentiality, integrity, and availability. Since integrity and availability are both Moderate and confidentiality is Low, the highest impact level is Moderate, making the overall system categorization Moderate. This ensures that the system is protected at the level of its most critical security objective.

Answer

Not Categorized

Answer

Low

Answer

High

Question 11

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

Accepted Answer

The Information System Owner (ISO).. Under FIPS 199 and the NIST RMF, the Information System Owner (ISO) is the stakeholder responsible for the overall procurement, development, integration, modification, operation, and maintenance of the system, and is therefore the appropriate person to sign off on the final security categorization. The ISO ensures the categorization aligns with the system's mission and data sensitivity.

Answer

The Lead System Administrator.

Answer

The Chief Information Security Officer (CISO).

Answer

The Third-Party Auditor.

Question 12

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

Accepted Answer

To identify controls that are implemented once and applied to multiple systems.. Common controls are security controls that are implemented once — typically at the organization, facility, or shared-service level — and inherited by multiple information systems. Identifying them during scope definition lets the organization document inheritance in each system's SSP, avoid duplicative testing, and focus system-specific assessment on controls not covered by the common provider. This is a core RMF/SP 800-37 concept for efficient authorization.

Answer

To ensure they are manually tested for every individual system.

Answer

To increase the system's FIPS 199 impact level.

Answer

To exclude them from the System Security Plan (SSP).

Question 13

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

Accepted Answer

Define the boundary based on the specific services and data flows owned by the sub-system.. When defining the boundary for a sub-system within a System of Systems architecture, the best practice is to define it based on the specific services and data flows owned by that sub-system. This approach ensures a clear, manageable scope that aligns with the sub-system's responsibilities and avoids including unrelated components that would cause scope creep. It also facilitates independent authorization and risk management for each sub-system.

Answer

Include only the database tier.

Answer

Include the entire enterprise infrastructure to be safe.

Answer

Include all internal network segments regardless of use.

Question 14

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A network topology diagram that shows external service endpoints, connection paths, and system boundaries is the most effective artifact for demonstrating that all system interconnections have been inventoried, because it visually and explicitly maps every connection into and out of the system. The SAP references this diagram to support the interconnection inventory required by NIST 800-53 controls like CA-3 and SA-9. Vulnerability scans, risk registers, and patch lists do not enumerate interconnections.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 15

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

Accepted Answer

Confidentiality=Low, Integrity=Low, Availability=High.. FIPS 199 requires separate categorization of the three security objectives: confidentiality, integrity, and availability. Because the data is publicly available, confidentiality impact is Low; because the question gives no indication of integrity requirements, integrity defaults to Low. However, the system provides critical government services and catastrophic loss of availability means the availability impact must be High, producing Confidentiality=Low, Integrity=Low, Availability=High.

Answer

Exclude the system from FIPS 199 requirements.

Answer

Categorize only based on Confidentiality.

Answer

Confidentiality=Low, Integrity=Low, Availability=Low.

Question 16

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. The authorization boundary defines exactly which systems, components, and data are included in a security assessment and authorization decision. If that boundary is drawn inaccurately — too narrow or misaligned with the actual system — assets and vulnerabilities that should have been assessed fall outside the scope. Those excluded assets remain unprotected and unmitigated, which is the core risk the question is testing.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 17

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

Accepted Answer

NIST SP 800-60.. NIST SP 800-60, 'Guide for Mapping Types of Information and Information Systems to Security Categories,' is the definitive guidance that operationalizes FIPS 199. FIPS 199 defines the categorization model (low/moderate/high for confidentiality, integrity, availability), while SP 800-60 provides the actual mapping tables and methodology for assigning those impact levels to specific information types. Together they form the categorization foundation of the RMF.

Answer

NIST SP 800-37.

Answer

NIST SP 800-53.

Answer

FIPS 140-3.

Question 18

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

Accepted Answer

List the identity service as an external provider and inherit the controls.. When a system relies on a shared service for identity management, that service is typically outside the system's authorization boundary. The correct approach is to list the identity service as an external provider and inherit its controls, documenting the reliance and the controls it provides. This reflects the shared responsibility model and avoids duplicating assessments.

Answer

Force the service provider to sign a full system authorization for you.

Answer

The identity service must be fully assessed as part of your system.

Answer

Exclude the identity service from the documentation entirely.

Question 19

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

Accepted Answer

Implementing consistent security controls across all boundary nodes regardless of location.. When a system boundary spans multiple geographic locations, the practitioner must ensure that consistent security controls are implemented across all boundary nodes, regardless of location. This maintains a uniform security posture and ensures that the authorization boundary is protected end-to-end. FIPS 199 and NIST SP 800-37 emphasize that the boundary defines what is included in the authorization, and all components within it must meet the same control baseline.

Answer

Categorizing each site as a separate information system.

Answer

Excluding remote offices from the authorization boundary.

Answer

Allowing each site to define its own unique security policy.

Question 20

Which document is mandatory to finalize the system categorization and begin the RMF process?

Accepted Answer

The FIPS 199 Security Categorization document.. The FIPS 199 Security Categorization document is mandatory to finalize the system categorization and formally begin the RMF process. It documents the security category of the system based on the potential impact of a breach, and without it, the subsequent RMF steps (selecting controls, assessing, authorizing) cannot be properly executed.

Answer

The Incident Response Policy.

Answer

The Penetration Test Report.

Answer

The Contingency Plan.