CGRC Scope OF System — Timed 10 Questions

Question 1

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

Accepted Answer

The System Security Plan (SSP) boundary description.. A boundary diagram or description is required for the System Security Plan to define what is subject to assessment.

Answer

The Annual Security Awareness Training log.

Answer

The Privacy Threshold Analysis (PTA).

Answer

The System Development Life Cycle (SDLC) policy.

Question 2

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

Accepted Answer

Moderate. FIPS 199 defines the high-water mark based on the highest value among the three security objectives.

Answer

Not Categorized

Answer

Low

Answer

High

Question 3

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

Accepted Answer

The Information System Owner (ISO).. The Information System Owner (ISO) is responsible for the categorization, which is then approved by the Authorizing Official (AO).

Answer

The Lead System Administrator.

Answer

The Chief Information Security Officer (CISO).

Answer

The Third-Party Auditor.

Question 4

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

Accepted Answer

To identify controls that are implemented once and applied to multiple systems.. Common controls are inherited from the organization or another system, reducing the burden on the individual system owner.

Answer

To ensure they are manually tested for every individual system.

Answer

To increase the system's FIPS 199 impact level.

Answer

To exclude them from the System Security Plan (SSP).

Question 5

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

Accepted Answer

Define the boundary based on the specific services and data flows owned by the sub-system.. Clearly defining trust zones and interface points prevents the boundary from expanding unnecessarily.

Answer

Include only the database tier.

Answer

Include the entire enterprise infrastructure to be safe.

Answer

Include all internal network segments regardless of use.

Question 6

You are defining the authorization boundary for a cloud-hosted application in the NIST Risk Management Framework. Which component must be explicitly included within the boundary according to NIST SP 800-37?

Accepted Answer

The cloud service provider's physical security controls for the hosting data center.. The authorization boundary must include all components for which the authorizing official accepts risk, including third-party cloud services that manage the security controls.

Answer

The end-user's local home router configuration.

Answer

The public internet backbone routing protocols.

Answer

The organization's global human resources policy.

Question 7

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

Accepted Answer

A comprehensive network topology diagram showing external service endpoints.. A System Interconnection Agreement (SIA) or Data Use Agreement (DUA) provides the formal record of cross-boundary data flows.

Answer

The system's latest vulnerability scan report.

Answer

The organization's enterprise risk register.

Answer

A listing of all installed software patches.

Question 8

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

Accepted Answer

Confidentiality=Low, Integrity=Low, Availability=High.. Categorization must account for the impact on the organization, regardless of data classification (e.g., public vs. sensitive).

Answer

Exclude the system from FIPS 199 requirements.

Answer

Categorize only based on Confidentiality.

Answer

Confidentiality=Low, Integrity=Low, Availability=Low.

Question 9

What is the primary risk of having an inaccurately defined authorization boundary?

Accepted Answer

Unprotected assets or vulnerabilities left outside the scope of assessment.. An inaccurate boundary leads to 'security gaps' where assets go unmonitored or unprotected.

Answer

Increased cost of hardware procurement.

Answer

Violation of the System Development Life Cycle (SDLC).

Answer

Inability to perform annual performance reviews.

Question 10

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

Accepted Answer

NIST SP 800-60.. NIST SP 800-60 is the guide for mapping information types to FIPS 199 security objectives.

Answer

NIST SP 800-37.

Answer

NIST SP 800-53.

Answer

FIPS 140-3.