CGRC Scope OF System Practice Test 2 — 15 Questions

Question 1

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. The authorization boundary defines exactly which systems, components, and data are included in a security assessment and authorization decision. If that boundary is drawn inaccurately — too narrow or misaligned with the actual system — assets and vulnerabilities that should have been assessed fall outside the scope. Those excluded assets remain unprotected and unmitigated, which is the core risk the question is testing.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 2

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

Accepted Answer

NIST SP 800-60.. NIST SP 800-60, 'Guide for Mapping Types of Information and Information Systems to Security Categories,' is the definitive guidance that operationalizes FIPS 199. FIPS 199 defines the categorization model (low/moderate/high for confidentiality, integrity, availability), while SP 800-60 provides the actual mapping tables and methodology for assigning those impact levels to specific information types. Together they form the categorization foundation of the RMF.

Answer

NIST SP 800-37.

Answer

NIST SP 800-53.

Answer

FIPS 140-3.

Question 3

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

Accepted Answer

List the identity service as an external provider and inherit the controls.. When a system relies on a shared service for identity management, that service is typically outside the system's authorization boundary. The correct approach is to list the identity service as an external provider and inherit its controls, documenting the reliance and the controls it provides. This reflects the shared responsibility model and avoids duplicating assessments.

Answer

Force the service provider to sign a full system authorization for you.

Answer

The identity service must be fully assessed as part of your system.

Answer

Exclude the identity service from the documentation entirely.

Question 4

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

Accepted Answer

Implementing consistent security controls across all boundary nodes regardless of location.. When a system boundary spans multiple geographic locations, the practitioner must ensure that consistent security controls are implemented across all boundary nodes, regardless of location. This maintains a uniform security posture and ensures that the authorization boundary is protected end-to-end. FIPS 199 and NIST SP 800-37 emphasize that the boundary defines what is included in the authorization, and all components within it must meet the same control baseline.

Answer

Categorizing each site as a separate information system.

Answer

Excluding remote offices from the authorization boundary.

Answer

Allowing each site to define its own unique security policy.

Question 5

Which document is mandatory to finalize the system categorization and begin the RMF process?

Accepted Answer

The FIPS 199 Security Categorization document.. The FIPS 199 Security Categorization document is mandatory to finalize the system categorization and formally begin the RMF process. It documents the security category of the system based on the potential impact of a breach, and without it, the subsequent RMF steps (selecting controls, assessing, authorizing) cannot be properly executed.

Answer

The Incident Response Policy.

Answer

The Penetration Test Report.

Answer

The Contingency Plan.

Question 6

An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?

Accepted Answer

The dependency of the system on the database for operational integrity.. The deciding factor for including a legacy database in an authorization boundary is whether the system depends on it for operational integrity — that is, whether the database's confidentiality, integrity, or availability directly affects the system's security posture and mission. If the application cannot function correctly or securely without the database, the database is within the boundary (or must be treated as an interconnected system with a documented interface). Physical location, hardware age, and data volume are not boundary criteria.

Answer

Whether the database is hosted in the same physical rack.

Answer

The age of the hardware.

Answer

The amount of data stored.

Question 7

When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)

Accepted Answer

The information types processed, stored, or transmitted by the system.. Option A is correct because defining the system boundary requires identifying the information types that are processed, stored, or transmitted by the system, since the boundary must encompass all data flows and information assets subject to the applicable security controls and categorization (e.g., FIPS 199 / SP 800-60 impact levels). Option D is correct because the system boundary must account for all interconnections with other internal and external systems, as these connections define where the system ends and where external dependencies, shared services, and cross-boundary data exchanges begin (e.g., documented in the SSP's system boundary description and interconnection agreements). Option B is not a defining factor of the boundary itself; personnel access is an authorization and access-control consideration that applies within the boundary rather than determining where it lies. Option C is incorrect because budget for hardware replacement is a lifecycle and funding concern, not a boundary-defining attribute. Option E is incorrect because the physical location of a cloud data center is a deployment and infrastructure detail; the boundary is defined by logical and data-flow scope, not by geography.

Answer

The organizational personnel who have access to the system.

Answer

The fiscal budget allocated for hardware replacement.

Answer

The physical location of the cloud data center.

Question 8

Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)

Accepted Answer

System interconnections and data flow paths.. Option A is correct because an effective system inventory must document system interconnections and data flow paths, which are required by NIST SP 800-53 controls (e.g., CA-3, AC-4) to understand boundary crossings, shared interfaces, and information exchange flows for authorization and risk assessment. Option B is correct because hardware serial numbers and physical asset tags provide unique identification and traceability of assets, supporting configuration management (CM-8) and enabling accurate tracking of ownership, location, and lifecycle status. Option E is correct because recording software versions and patch levels is essential for vulnerability management (RA-5, SI-2), allowing the agency to identify outdated or unpatched components and prioritize remediation. Option C does not belong because employee performance evaluation scores are personnel records unrelated to technical system inventory or security posture. Option D does not belong because coffee machine maintenance dates are facility trivia with no bearing on IT asset inventory, configuration management, or federal security requirements.

Answer

The employee performance evaluation score for the system admin.

Answer

The exact date of the last office coffee machine maintenance.

Question 9

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Accepted Answer

Availability.. FIPS 199 defines three security objectives for information types and information systems: confidentiality, integrity, and availability, so the two correct answers here are A (Availability) and E (Confidentiality). Availability (A) is correct because FIPS 199 requires assessing the potential impact of a loss of timely and reliable access to the system and its data, with the resulting categorization of low, moderate, or high. Confidentiality (E) is correct because FIPS 199 requires evaluating the impact of unauthorized disclosure of information, again producing a low, moderate, or high rating. The unmarked options do not belong because authentication, accountability, and non-repudiation are not among the three FIPS 199 impact objectives; they are related security services or controls addressed in other standards such as FIPS 200 and NIST SP 800-53, not the FIPS 199 impact triad.

Answer

Authentication.

Answer

Accountability.

Answer

Non-repudiation.

Question 10

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Accepted Answer

Network architecture diagrams.. The Authorizing Official validates the system boundary using artifacts that define what is inside the authorization boundary and how it connects to external systems. Option B, network architecture diagrams, is correct because they show the topology, subnetting, and placement of components (routers, firewalls, servers) that delineate where the boundary begins and ends. Option C, data flow diagrams illustrating external interfaces, is correct because they trace information entering and leaving the system, making explicit which external connections and interconnections cross the boundary. Option D, the System Security Plan (SSP) boundary description, is correct because the SSP formally documents the authorization boundary, including the components, users, and interconnections covered by the authorization. Options A and E are incorrect because a janitorial service contract and a holiday schedule are administrative/logistical documents unrelated to the technical or documented definition of an information system boundary.

Answer

The janitorial service contract for the building.

Answer

The organization's holiday schedule.

Question 11

A security architect is defining the authorization boundary for a new cloud-hosted financial system. The system uses a managed database service and a serverless compute service from the cloud provider. The provider's infrastructure (hypervisor, physical network, data center) is outside the boundary. According to NIST SP 800-37, which statement best describes how the shared responsibility model affects the authorization boundary?

Accepted Answer

The authorization boundary includes only the organization's account, its data, and the configured services, while the provider's underlying infrastructure is inherited and assessed separately.. In cloud environments, the authorization boundary should encompass the components the organization configures and operates, such as its account, data, and service configurations. The provider's infrastructure is assessed separately and inherited. This aligns with NIST SP 800-37's guidance on defining boundaries and leveraging shared responsibility to avoid unnecessary duplication of assessments.

Answer

The authorization boundary must be expanded to include all cloud provider data centers that host the system, regardless of ownership.

Answer

The authorization boundary must include the provider's hypervisor and physical network because they process the organization's data.

Answer

The authorization boundary is irrelevant in cloud environments because the provider assumes all security responsibilities.

Question 12

A security manager is defining the authorization boundary for a system that processes Controlled Unclassified Information (CUI). The system consists of a web server, an application server, and a database server, all hosted on-premises. The system also uses a shared network switch and a shared firewall that are used by other systems in the same data center. Which two components should be included in the authorization boundary? (Choose two.)

Accepted Answer

The web server, because it directly processes CUI and is dedicated to the system.. The authorization boundary should include dedicated components that process, store, or transmit CUI, such as the web server and application server. Shared components like the network switch and firewall are common controls and are inherited, not included in the boundary. This approach aligns with NIST SP 800-37's guidance on defining boundaries around system-specific components.

Answer

The data center physical security controls, because they protect the servers.

Answer

The shared firewall, because it enforces security policies for the system.

Answer

The shared network switch, because it carries CUI traffic for the system.

Question 13

A security analyst is documenting the authorization boundary for a new system. The system will be deployed on a government cloud environment and will interface with an external identity provider for authentication. The identity provider is owned and operated by another agency. How should the analyst represent the external identity provider in the authorization boundary documentation?

Accepted Answer

Document the identity provider as an external interface and describe the trust relationship and any inherited controls.. The external identity provider should be documented as an external interface, with details about the trust relationship and any inherited controls. This aligns with NIST SP 800-37, which requires external dependencies to be described in the authorization boundary documentation. This ensures that the system's risk assessment considers the provider's security posture and any reliance on its controls.

Answer

Represent the identity provider as a common control that is fully inherited without further documentation.

Answer

Exclude the identity provider entirely from the boundary documentation because it is external.

Answer

Include the identity provider as an internal component of the system boundary because it is critical to authentication.

Question 14

A security analyst is preparing to categorize a new human resources system that will store PII for 5,000 employees. The system will be hosted in a government cloud environment. According to FIPS 199, what is the FIRST step the analyst should take to determine the security category?

Accepted Answer

Identify the information types processed, stored, or transmitted by the system and determine the potential impact of a security breach.. FIPS 199 mandates that security categorization begins with identifying the information types the system handles and assessing the potential impact of a breach on confidentiality, integrity, and availability. This impact analysis drives the overall security category, which then informs control selection and other RMF activities. The other options describe later RMF phases or actions that depend on the categorization outcome.

Answer

Conduct a vulnerability assessment to identify weaknesses in the cloud hosting environment.

Answer

Select the appropriate security controls from NIST SP 800-53 based on the system's processing environment.

Answer

Document the system boundary and obtain approval from the Authorizing Official before assigning impact levels.

Question 15

A security analyst is defining the authorization boundary for a new financial system hosted entirely within a commercial cloud Infrastructure as a Service (IaaS) environment. The system consists of virtual machines, a managed database service, and a load balancer, all provisioned by the organization's cloud team. The cloud provider's physical data center and hypervisor layer are outside the organization's direct control. According to NIST SP 800-37 Rev. 2, which statement best describes how the authorization boundary should be defined?

Accepted Answer

The boundary includes the virtual machines, managed database service, and load balancer, but excludes the cloud provider's hypervisor and physical infrastructure.. The authorization boundary is defined by the components the organization directly controls and that are necessary for the system's operation. In an IaaS deployment, the organization controls the virtual machines, managed database, and load balancer, so these belong inside. The cloud provider's hypervisor and physical infrastructure are outside the boundary and are covered by the provider's own authorizations and FedRAMP packages.

Answer

The boundary must include the entire cloud region, because all resources in a region share the same physical network and management plane.

Answer

The boundary includes only the virtual machines and the managed database, because the load balancer is a shared network device and must be excluded.

Answer

The boundary includes the virtual machines, managed database, load balancer, and the underlying cloud infrastructure because the system cannot operate without it.