CGRC Scope OF System Practice Test 3 — 15 Questions

Question 1

A large federal agency is modernizing its benefits processing system. The new architecture will integrate a legacy mainframe system, a commercial off-the-shelf (COTS) case management product hosted on-premises, and a new cloud-based document repository. The legacy mainframe and the COTS product are owned by the agency, while the cloud repository is provided by a FedRAMP-authorized cloud service provider. The agency's Information System Owner (ISO) must define the authorization boundary for the overall benefits processing capability. Which approach is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a boundary for the mainframe and COTS product as one system, and treat the cloud repository as a separate system, documenting the interconnection and relying on the cloud provider's FedRAMP authorization.. The authorization boundary should group components under the same management control. The mainframe and COTS product are both agency-owned and can be assessed as one system. The cloud repository is managed by a FedRAMP-authorized provider and should be treated as a separate system, with the agency documenting the interconnection and inheriting controls from the provider's authorization package.

Answer

Define three separate authorization boundaries, one for each component, and require each to undergo a full RMF process independently, including the cloud repository.

Answer

Define a single authorization boundary that encompasses the mainframe, the COTS product, and the cloud repository, because they collectively deliver the benefits processing capability.

Answer

Define the boundary to include only the new cloud repository, because the legacy mainframe and COTS product are already accredited under earlier authority to operate (ATO) decisions.

Question 2

A federal agency is deploying a cloud-based case management system. The system uses a virtual private cloud (VPC) for compute, a managed database service, and an external identity provider for authentication. The security team must define the authorization boundary. Which approach best aligns with NIST SP 800-37 and FIPS 199?

Accepted Answer

Define the boundary to include all components that process, store, or transmit system data, including the identity provider if it enforces access to the system.. The authorization boundary must include every component that processes, stores, or transmits system data, as well as those that enforce security controls. The identity provider enforces authentication, so it belongs within the boundary. Excluding it or relying solely on a provider's authorization would leave the agency unable to assess its own risk. A correct boundary ensures accurate FIPS 199 categorization and a valid authorization decision.

Answer

Include only the physical servers and network devices located in the agency's data center, treating all cloud services as external dependencies.

Answer

Include only the VPC and managed database, since the identity provider is a separate external service and always outside the boundary.

Answer

Use the cloud provider's existing FedRAMP authorization for the entire infrastructure and exclude all components from the agency's boundary.

Question 3

An organization is beginning the RMF process for a new human resources system. The Information System Owner (ISO) needs to identify the system boundary. Which of the following best describes the purpose of defining the authorization boundary?

Accepted Answer

To establish the scope of the system for which the organization will implement and assess security controls.. The authorization boundary establishes the scope of the system for which the organization is responsible. It defines which components, processes, and personnel are included so that security controls can be implemented and assessed appropriately. This scope is fundamental to the RMF process, ensuring that the assessment covers all relevant parts of the system.

Answer

To identify the physical location of all servers and network devices that process organizational data.

Answer

To list all external organizations that will connect to the system and require interconnection agreements.

Answer

To determine which data is sensitive and requires encryption both at rest and in transit.

Question 4

A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common control provided by a separate organizational unit. The common control's assessment was performed by that unit, and the results are documented in a shared assessment report. What should the Assessor do to support the system's authorization?

Accepted Answer

Review the shared assessment report to determine if it meets the system's assurance requirements and document any inheritance of the control in the system security plan.. Common controls can be leveraged across systems, and their assessment results can be reused if they meet the receiving system's assurance requirements. The Assessor should review the shared report for currency, scope, and relevance, then document the inheritance in the system security plan. Re-assessing or excluding the control would be inefficient or incorrect. This practice aligns with the RMF's goal of reuse and reciprocity.

Answer

Re-assess the common control independently because the system's high-impact level requires a full assessment of all controls.

Answer

Perform a penetration test of the common control to validate the shared assessment report before accepting it.

Answer

Exclude the common control from the system's assessment because it is outside the system's authorization boundary.

Question 5

A system owner is defining the authorization boundary for a new information system that will process personally identifiable information (PII). The system will use a cloud-based customer relationship management (CRM) service, an on-premises database, and a web application hosted on a government-furnished server. Which TWO components should be included within the authorization boundary? (Choose two.)

Accepted Answer

The cloud-based CRM service that stores and processes PII.. The authorization boundary must include all components that process, store, or transmit system data. The cloud CRM service and the on-premises database both handle PII, so they are within the boundary. Physical security controls from a separate unit are common controls, while the ISP and web browser are external to the system's data processing. Correctly scoping the boundary ensures a complete risk assessment and accurate FIPS 199 categorization.

Answer

The web browser used by end users to access the web application.

Answer

The internet service provider (ISP) that provides connectivity to the cloud CRM service.

Answer

The physical security controls of the data center hosting the on-premises database, if they are provided by a separate facility management unit.

Question 6

A program manager is working with the Information System Owner (ISO) to determine the scope of a new payroll system. The system will interface with an external banking system for direct deposits. What should the ISO do regarding the external banking system when defining the authorization boundary?

Accepted Answer

Document the external banking system as an external interface and establish a formal agreement for data exchange.. When an external system interfaces with the system being authorized, it is not included in the boundary but must be documented as an external interface. A formal agreement, such as an ISA, defines the security responsibilities and data exchange rules. This approach maintains a clear boundary while ensuring that the interface is securely managed. The other options either incorrectly include the external system or fail to document it.

Answer

Include the external banking system within the authorization boundary because it processes payroll data.

Answer

Require the external banking system to undergo a full security assessment by the payroll system's assessment team.

Answer

Exclude the external banking system entirely from all RMF documentation since it is not part of the boundary.

Question 7

A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact is specifically designed to depict the system boundary and its interfaces?

Accepted Answer

Authorization Boundary Diagram. The Authorization Boundary Diagram is the artifact specifically created to depict the system boundary, including components and interfaces. It provides a clear visual scope for the assessment and is essential for the Authorizing Official to understand what is being authorized. Other documents like the SSP reference the boundary but do not serve as the primary depiction.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Privacy Impact Assessment (PIA)

Question 8

A program manager is preparing to categorize a new information system under FIPS 199. The system will handle financial data, and the program manager wants to ensure the categorization is accurate. Which document should the program manager reference to identify the potential impact levels for confidentiality, integrity, and availability?

Accepted Answer

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems. FIPS 199 establishes the security categorization standard, defining the potential impact levels for confidentiality, integrity, and availability. It is the authoritative document for determining the security category of an information system. While SP 800-37 describes the RMF process and SP 800-60 offers mapping guidance, FIPS 199 is the specific standard that provides the impact criteria. Using it ensures the categorization is compliant and accurate.

Answer

NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

Answer

NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories

Answer

NIST SP 800-37, Risk Management Framework for Information Systems and Organizations

Question 9

A security manager is leading an effort to define the authorization boundary for a system that uses a virtualized environment. The system consists of multiple virtual machines (VMs) on a hypervisor that also hosts VMs for other systems. How should the security manager address the hypervisor when defining the boundary?

Accepted Answer

Treat the hypervisor as a common control and document the inheritance of its security controls in the system security plan.. In a virtualized environment, the hypervisor is typically a shared component that provides security controls to multiple systems. It should be treated as a common control, and the system security plan should document the inheritance of its controls. This approach maintains a clear boundary for the system while ensuring that the hypervisor's security is properly assessed and managed. The other options either incorrectly include or exclude the hypervisor without proper documentation.

Answer

Exclude the hypervisor entirely from the boundary and from any security documentation.

Answer

Include the hypervisor within the system boundary because it provides essential virtualization services.

Answer

Include only the VMs used by the system in the boundary, and ignore the hypervisor because it is not a VM.

Question 10

An organization is defining the authorization boundary for a system that will use a shared database service managed by a different business unit. The database will store sensitive data for multiple systems. What should the security manager do to properly address this shared service in the authorization process?

Accepted Answer

Treat the shared database as a common control provider and inherit its controls via a customer responsibility matrix.. Shared services are optimally handled as common control providers, allowing systems to inherit controls rather than reassess them. A customer responsibility matrix documents which controls are inherited and which remain the system's responsibility. This approach reduces duplication and ensures the Authorizing Official has visibility into the shared controls.

Answer

Exclude the shared database entirely and document it as an external interface without any control inheritance.

Answer

Define the boundary to include only the database schema and exclude the underlying infrastructure.

Answer

Include the shared database within the system boundary and assess all its controls.

Question 11

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Accepted Answer

The on-premises servers are included in the boundary because they are under the agency's direct control and process CUI.. The boundary should include components under the agency's direct control that process CUI, such as on-premises servers. For cloud services with FedRAMP authorizations, the agency can exclude those components if it documents inherited controls and accepts residual risk. This approach aligns with NIST guidance on leveraging external authorizations and focusing on the agency's own responsibilities.

Answer

The boundary must include all cloud components regardless of the provider's authorization status to ensure end-to-end security.

Answer

The boundary should be defined based on the physical location of the servers to ensure data sovereignty requirements are met.

Answer

The PaaS provider's underlying infrastructure is included in the boundary because the agency's applications run on it.

Question 12

An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end, an application server, and a database. The database is hosted in a separate virtual private cloud (VPC) managed by the same organization. The ISO wants to minimize the boundary while ensuring all necessary components are included. What should the ISO do?

Accepted Answer

Include the web front-end, application server, and database in the boundary, and document the network segmentation and controls between the VPCs.. The authorization boundary must include all components that process, store, or transmit system data, regardless of their location. The database, even in a separate VPC, is part of the system. Documenting the network segmentation and controls ensures that the interconnections are assessed. Excluding the database or the network infrastructure would create gaps, while including the entire organization would be overbroad. The ISO should define a boundary that accurately reflects the system's logical and physical components.

Answer

Define the boundary as the entire organization's network because all components are managed by the same organization.

Answer

Include only the web front-end and application server, treating the database as an external service because it is in a separate VPC.

Answer

Include the web front-end, application server, and database, but exclude the network infrastructure that connects the VPCs.

Question 13

An Information System Owner (ISO) is defining the authorization boundary for a system that will be deployed in a government cloud environment. The cloud provider offers infrastructure as a service (IaaS). Which of the following should the ISO consider as part of the system boundary?

Accepted Answer

The virtual machines, applications, and data that the organization deploys and manages in the cloud.. In an IaaS cloud deployment, the organization is responsible for the security of the virtual machines, applications, and data it deploys. These components should be included in the authorization boundary because they are under the organization's direct control. The underlying infrastructure, such as physical data centers, hypervisors, and network components, is managed by the cloud provider and should be treated as common controls, with their controls inherited and documented in the system security plan.

Answer

The cloud provider's customer support personnel who manage the IaaS platform.

Answer

The cloud provider's hypervisor and network infrastructure.

Answer

The cloud provider's physical data center security controls.

Question 14

A security assessor is reviewing a system boundary for a high-impact system. The boundary includes a web server, an application server, and a database server, all located in the same data center. The system also uses an external identity provider for authentication. During the review, the assessor notices that the identity provider is not listed in the boundary diagram. What is the most significant risk of this omission?

Accepted Answer

The identity provider's controls will not be assessed, potentially leaving authentication vulnerabilities unaddressed.. Omitting the external identity provider from the boundary means its security controls may not be assessed or formally inherited, creating a critical gap in authentication. The Authorizing Official needs to understand all dependencies to make an informed risk decision. The most significant risk is that authentication vulnerabilities remain unaddressed, potentially compromising the entire system.

Answer

The boundary diagram will be rejected by the Authorizing Official for formatting errors.

Answer

The system will be automatically categorized as low-impact due to the missing component.

Answer

The external identity provider will be required to undergo a separate full authorization, delaying the project.

Question 15

A federal agency is deploying a new cloud-based case management system. The system consists of a web front end, an application server, and a database, all hosted in a single virtual private cloud (VPC). The system owner must define the authorization boundary for the system. Which of the following best describes the authorization boundary in this context?

Accepted Answer

The authorization boundary includes all components of the system within the VPC, including the web front end, application server, and database, as well as the supporting infrastructure managed by the cloud provider.. The authorization boundary must include all components that comprise the system, including those in a cloud environment. For a cloud-based system, the boundary typically encompasses the virtual private cloud resources and the underlying infrastructure provided by the cloud service provider, often addressed through a shared responsibility model. This ensures that all parts processing, storing, or transmitting data are within the scope of the authorization.

Answer

The authorization boundary includes the agency's entire network infrastructure, including all other systems and applications that share the same network.

Answer

The authorization boundary includes only the database, because it stores the sensitive case data, while the web and application servers are considered external interfaces.

Answer

The authorization boundary includes only the physical servers within the agency's data center that host the virtual machines.